Global retailers are being advised to verify the security of their websites due to two critical vulnerabilities in software that could lead to cyber attacks, disrupt online trading, and expose sensitive business and customer data.
These flaws, known as PHP2Shell, could allow cybercriminals to execute malicious commands on vulnerable web servers without needing login credentials.
Critical vulnerabilities in PHP
The discovery of two critical vulnerabilities in PHP, a widely used programming language for websites and online shopping platforms, has prompted an urgent security warning for retailers.
Identified as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities were disclosed on 21 October 2026, both receiving a critical severity rating of 9.2 out of 10 under the CVSS 4.0 cybersecurity scoring system.
The British Independent Retailers Association (Bira) has called on businesses to verify if their websites are affected, emphasizing the challenges smaller retailers face when relying on external technology providers.
While security fixes are available, retailers must ensure their website software has been updated.
Urgent security checks for retailers
PHP powers numerous websites, including those built with WordPress and e-commerce platforms like WooCommerce.
Retailers utilize these platforms for order processing, product display, stock management, and customer communication.
The vulnerabilities affect PHP itself, not specific retail platforms, meaning a website may seem functional while running vulnerable software.
Updating WordPress, WooCommerce, or similar applications might not resolve the issue if the underlying PHP remains unpatched.
If exploited, these flaws could enable attackers to execute commands on servers, potentially exposing customer data, disrupting sales, or compromising systems.
Potential Fallout for Retailers
Consequences for retailers may include lost revenue, delayed orders, recovery costs, and data protection obligations.
Not all PHP-using websites are necessarily vulnerable; the risk depends on the software version and server configuration. The actual proportion of affected websites remains unknown.
Bira issued its warning on 22 October, advising independent retailers to prioritize contacting their website developers or hosting providers.
Andrew Goodacre, Bira’s chief executive, stated: “This is a serious warning and one that independent retailers should not ignore.”
The association highlighted smaller businesses’ growing reliance on websites for sales, stock management, and customer interaction.
Many independent retailers may be unaware of their website’s PHP usage or version, complicating risk identification, especially when maintenance is outsourced.
Goodacre advised: “You do not need to be a technical expert to protect your business.”
He recommended retailers ask their developers or hosting providers to confirm PHP has been updated to a secure version.
Businesses should also clarify who is responsible for website software maintenance and security updates.
Technical Breakdown of Vulnerabilities
The vulnerabilities stem from PHP’s memory management weaknesses.
CVE-2026-109618 involves errors when PHP runs out of memory, while CVE-2026-109619 relates to using information from already released memory.
Under specific conditions, attackers could exploit these weaknesses to execute remote commands.
Neither vulnerability requires attacker login, though successful exploitation depends on PHP installation and configuration.
Potentially affected server environments include Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.
The risk level varies, making it key for retailers to have their technology providers assess their website software and configuration.
Related Post: UK shoplifting drops but retailers demand faster police action
The publication of technical research and attack demonstrations has increased the urgency of applying security fixes.
Researchers employed advanced AI models to investigate PHP’s memory management weaknesses and potential exploitation methods.
The PHP Foundation acknowledged Calif, OpenAI, and cybersecurity firm Wiz for their research and disclosure contributions.
Calif and Wiz confirmed using AI models in their investigations.
The vulnerabilities’ coordinated disclosure was expedited after information leaked before the planned announcement.
Security Fixes and Updates
The PHP project released security updates on 21 October 2026 to address these issues.
The initial fixed versions for major PHP branches were:
Retailers should ensure their websites run an appropriate fixed version or a confirmed security update from their software provider.
Older PHP versions require special attention.
PHP 8.1 and earlier no longer receive regular security updates from the main project. Businesses using these versions may need to upgrade or obtain fixes from their software distributor.
Some providers have released fixes for older versions without changing the main version number. Retailers should ask their hosting providers to confirm the installed software addresses both vulnerabilities.
Updates must cover the PHP software running the website, including relevant servers and hosting environments.
Updating a content management system alone does not guarantee secure underlying server software.
Bira encourages retailers to contact their technology providers and confirm necessary security measures are in place.
Action Steps for Retailers
Retailers should take five steps:
1. Contact the website developer or hosting provider to determine if the website uses an affected PHP version and if security updates have been installed.
2. Confirm both vulnerabilities are fixed. Request details of the PHP version or security package and ensure updated services have been restarted if needed.
3. Check for outdated software. Determine if unsupported PHP versions require upgrading or additional fixes.
4. Review website activity. Ask the provider to check for suspicious activity or unauthorized access, especially if updates were delayed.
5. Verify backup arrangements. Ensure reliable website backups are available for restoration in case of attack-related disruptions.
For managed hosting services, the provider may handle PHP updates, but businesses should still seek confirmation of checks and fixes.
Backups and monitoring can limit attack impact but do not replace security updates.
Online retailers face potential transaction interruptions, delivery delays, and communication issues from website attacks.
Store-based businesses may also experience disruption if their websites support click-and-collect, stock checks, or other in-store services.
Smaller retailers may struggle more with security threats, particularly without in-house expertise or when relying on third-party providers.
