Magento and Adobe Commerce: Handling the PHP2Shell PHP Flaws

By Umair Ali Sadaqat · Updated · Editorial policy

Online stores hold card flows and customer data, so Black October matters more for Magento. How to patch PHP on self-hosted Magento, what changes on Adobe Commerce Cloud, and why the cron and queue servers count too.

A store is the worst kind of site to leave on a vulnerable server: it handles customer accounts, addresses, order history and the pages that send shoppers to payment. The two PHP flaws fixed on 21 October 2026 allow code execution without logging in, so for Magento Open Source and Adobe Commerce this is a same-day job. The Black October overview has the background.

What needs to change

Magento's code is not the bug. PHP is. You need every PHP process that serves the store on 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later in that line (or a distribution package carrying the backported fix).

Magento is strict about which PHP branches each release supports. That is the main reason to stay on your current branch and take only the patch release now. Moving to a new branch is a separate project to plan against Adobe's system requirements for your exact Magento version.

Self-hosted Magento: the order of work

  1. Turn on maintenance mode only if you must. A patch-level PHP update with a restart takes seconds; most stores can do it live in a quiet hour.
  2. Snapshot the server or take a backup of code, app/etc/env.php and the database.
  3. Update PHP packages on every node: web servers, the admin server if separate, and the machines that run cron and message queue consumers.
  4. Restart PHP-FPM on all of them, then restart your queue consumers so they reload on the new build.
  5. Flush caches: bin/magento cache:flush. If you use Varnish, a full purge is reasonable after an emergency change.
  6. Test a product page, add to cart, checkout up to the payment step, and an admin login.

Why cron and queue servers count

Magento leans on scheduled jobs and queue consumers that run as long-lived PHP processes. They are not web requests, so they are not the direct target described in the advisory. They still share the same PHP install in most setups, and an unpatched build on a box that also serves web traffic is exposed. Patch them in the same window so the whole cluster runs one known-good version.

Adobe Commerce on Cloud

On Adobe Commerce Cloud the PHP runtime is chosen in your project configuration and provided by the platform. Check Adobe's status and security notices for their PHP2Shell response, confirm which PHP build your environments now run, and redeploy if their guidance says a redeploy picks up the patched runtime. Ask your Adobe account team for the patch date in writing if you need it for compliance.

Payment and compliance

If you are subject to PCI DSS, critical security patches have to be applied promptly and documented. Write down when you learned of the issue, when each server was patched, and how you verified the version. That record is what an assessor or your payment provider will ask for.

Temporary settings, and why stores need care

If a patch truly cannot go in today, the stopgap guide lists the PHP team's temporary measures. One of them lowers the maximum request size. Stores that accept product imports or large image uploads in the admin should check those workflows after changing it, or set the stricter value only on the public-facing pool.

Signs of trouble specific to stores

Card-skimming code is the classic Magento compromise. After patching, check:

  • Content → Design → Configuration and CMS blocks for script tags you did not add.
  • The core_config_data table for unfamiliar URLs in header or footer script settings.
  • pub/media and pub/static for .php files.
  • Admin users created recently.

The general process is in was my site hacked. If you find skimming code, tell your payment provider promptly; they will have their own steps.

Move your site to WeInc

If your store is small and Magento's upkeep outweighs what it gives you, a hosted site may suit you better. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Website builders for the businesses in this article

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap