Before your holiday code freeze: a PHP2Shell and PHP 8.2 checklist for online stores

The short answer

If you run a WooCommerce, Magento or other PHP store, use the weeks before your Black Friday code freeze for three jobs:

1. Confirm the PHP2Shell fix is actually running, with evidence, not a version number (source: AlmaLinux).
2. Apply PHP’s recommended setting for CVE-2026-115560, which no PHP release fixes as of October 23, 2026 (source: php.net advisory on CVE-2026-115560, October 23, 2026).
3. Check for signs of trouble since October 17, when attempts began (source: BleepingComputer).

The PHP 8.2 upgrade can wait until after Cyber Monday (November 30, 2026), but not past December 31, when PHP 8.2 stops receiving security fixes (source: php.net supported versions). Plan it now.

Why stores first

Store platforms tend to patch slowly, and attackers notice. Researchers at Sansec found that 62% of Magento stores were still vulnerable six weeks after the SessionReaper flaw was disclosed (source: The Hacker News). In March 2026, attacks on a Magento flaw called PolyShell reached 56.7% of all vulnerable stores, according to Sansec (source: BleepingComputer).

PHP2Shell matters more to a store for one specific reason. Even without taking over a server, one of the flaws can leak memory from other visitors’ requests, which may include passwords, session tokens and API keys (source: The Hacker News). On a store, that can include customer sessions and the keys to your payment and shipping integrations.

The checklist: before the freeze

1. Know who runs PHP for your store

Many shared and managed hosts reported patching PHP on their managed plans. If you run your own VPS, cloud server or self-managed control panel, nobody patches PHP for you (source: GoDaddy). Most Magento stores and many larger WooCommerce stores run on servers their owners or agencies manage.

2. Get evidence the fix is running

A version number can’t prove whether PHP is patched. Many hosts and Linux distributions ship the fix as a backport that keeps the old version number. The command-line php -v may not even be the PHP that serves your website. And a patched package isn’t actually running until PHP’s worker processes are restarted (source: AlmaLinux).

For each server that runs your store (including the admin, cron and queue servers if they’re separate), collect four things:

• the PHP build that serves the site;
• a fixed release or a package changelog naming both CVEs;
• a restart time after the update;
• the CVE-2026-115560 setting.

The five checks, step by step. If your host runs PHP, ask them these questions in writing.

3. Apply the CVE-2026-115560 setting

PHP recommends turning off session upload progress (session.upload_progress.enabled=0) in the server configuration and restarting PHP, until its next regular bugfix release (source: php.net advisory on CVE-2026-115560, October 23, 2026). It’s a one-line configuration change, not a code change, so it fits before a freeze. Test checkout and any file uploads afterwards.

4. Review for signs of compromise since October 17

Amazon’s threat intelligence team saw the first exploitation attempts on October 17, four days before the patches were released (source: BleepingComputer). Look for:

• unfamiliar files and new admin accounts;
• new scheduled tasks and anything unusual started by the web server;
• on a store, unfamiliar scripts on checkout and payment pages.

PHP’s advisory warns that “absence of an error in logs is not proof of safety.” (source: GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)) If you find something, stop. Preserve the evidence before anyone cleans up, and bring in incident response.

5. Rotate secrets if the server was exposed

If the store’s server ran unpatched PHP while reachable from the internet, rotate admin and database passwords and the API keys stored on it, including payment, shipping and marketplace integrations. Coordinate payment-key changes with your provider so checkout doesn’t break mid-season (source: The Hacker News).

6. Keep the firewall, but don’t rely on it

Web application firewalls can block many attack attempts and buy time, but security responders agree they don’t replace the patch. Attackers changed their payloads to get past firewall rules within hours (source: Beazley Security Labs). Cloudflare says it switched on PHP2Shell firewall rules for all its plans, including Free. They only protect traffic that passes through Cloudflare, and Cloudflare notes some configurations aren’t covered (source: Cloudflare).

During the freeze: what not to do

Black Friday is November 27 and Cyber Monday is November 30, 2026. Once your freeze starts:

• Don’t switch PHP versions. A version switch is a code-compatibility change, and it’s exactly what freezes exist to prevent.
• Do keep watching. If a fix for CVE-2026-115560 ships during the freeze, plan the package update for the first quiet day after it, unless your host applies it for you.
• Do keep the evidence. If a customer, a payment partner or your insurer asks in December, you’ll want the dated record from step 2.

After Cyber Monday: the PHP 8.2 deadline

PHP 8.2 stops receiving security fixes on December 31, 2026 (source: php.net supported versions). If your store runs 8.2 or older, December is your upgrade window. Go to PHP 8.4, which gets security fixes until December 31, 2028, or 8.5, until December 31, 2029 (source: php.net supported versions).

Do the preparation now, before the freeze:

• an inventory;
• each plugin’s or extension’s declared PHP support;
• a static compatibility scan;
• a staging copy.

That way December is for testing and switching, not discovery. The PHP 8.2 checklist has the phases, and WooCommerce stores still on 7.4 can follow the 7.4 to 8.4 guide.

Sourced facts

Full wording, primary sources and dates: /sources.

Want the evidence before your freeze?