PHP2Shell: Steps for bLoyal eCommerce Clients

Last updated: October 22, 2026

On October 21, 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”) were disclosed. They let an attacker take over a website running an unpatched version of PHP without logging in. The bLoyal platform itself is not affected (see bLoyal platform not affected by PHP2Shell). Some eCommerce integrations, however, run on servers that you or your hosting provider manage.

For all eCommerce integrations with bLoyal, please rotate credentials after you patch, not before. If your site ran an affected PHP version, assume its stored secrets may have been exposed. Once the update is done, change your website admin passwords, payment gateway API keys, and other stored credentials. Contact bLoyal Support to rotate your bLoyal connection credentials. If you change credentials before patching, the new ones can be stolen the same way.

WooCommerce

The bLoyal WooCommerce plugin runs on your WordPress server and uses whatever PHP version your host provides. The plugin isn’t the cause of this vulnerability. Even so, any WordPress site on an unpatched PHP version is exposed, no matter which plugins are installed. We can’t update your server for you, so please take these steps today:

1. Confirm with your host, even if it’s managed. Many managed WordPress hosts are updating automatically, but please get confirmation from yours.
2. Check your PHP version. Ask your hosting provider, web partner or IT team. You can also check it yourself in WordPress under Tools > Site Health > Info > Server.
3. Update to a patched release:
   • PHP 8.2, 8.3, 8.4 or 8.5: update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later.
   • PHP 7.4, 8.0 or 8.1: these versions aren’t covered by the main release. Apply the PHP security team’s source patch or a patched package from your hosting provider or Linux vendor. Treat this as a temporary fix and plan to upgrade.
   • PHP 7.3 or older: no patch exists. Upgrade to PHP 8.3 or newer as soon as possible. We recommend skipping 8.2, which stops receiving updates at the end of 2026.
4. Don’t rely on workarounds. Configuration changes can reduce exposure, but they don’t make a server safe. Only updating PHP does.
5. Check every site. This includes staging sites, test sites and any other sites on the same server or hosting account.
6. Look for signs of compromise. Watch for unfamiliar admin users, unexpected file changes, new plugins you didn’t install, or unusual orders. If you see anything suspicious, contact your hosting provider right away, and let bLoyal Support know.

Is the bLoyal plugin compatible with newer PHP versions? If you have questions about the plugin’s compatibility with PHP 8.x, contact bLoyal Support before you upgrade.

Shopify

Shopify hosts your store, so you don’t need to update PHP yourself. bLoyal’s Shopify app backend was upgraded to a patched PHP version on October 22, 2026.

Magento

Magento is PHP-based, so we recommend following the WooCommerce steps above with your hosting provider or development partner.

Need help?

Contact bLoyal Support with any questions about your bLoyal integration.