Critical PHP vulnerability · CVE-2026-109618
PrestaShop
Is your PrestaShop vulnerable to php2shell?
A PHP flaw lets an attacker run code on your shop's server. Our free module checks it with a real test on your own server and, while it's at it, reviews versions, performance and the most common security issues.
- Free
- PrestaShop 1.6 to 9
- Your data never leaves your shop
example-shop.com
High risk · 3 critical issues
- php2shellVulnerable
- PrestaShop 1.7.8.11Upgrade to 8.2 / 9
- PHP 7.4Unsupported
- install/ folderExposed
- Memory 256MOK
Sample data. The real report is generated on your server, as a PDF.
What is php2shell?
php2shell is the name given to two PHP security flaws disclosed in October 2026 (CVE-2026-109618 and CVE-2026-109619). PHP is the language PrestaShop runs on, so it affects almost every shop, whatever its version.
In short: by deliberately triggering a memory error, an attacker can get the server to run code it shouldn't. From there they could install malware on the shop, steal data or redirect payments.
Am I affected?
It depends on how your server's PHP was built and patched, not just on its version number. Some patched servers still report "7.4.33", and some up-to-date servers aren't patched.
That's why the module doesn't trust the number: it runs a harmless test on your own server (a controlled memory error, without exploiting the flaw) and watches how PHP reacts.
What we did for our hosting customers
As soon as the flaw was disclosed, we didn't wait for each customer to get in touch.
Patched every version
We patched PHP on every server we manage, including the older versions that no longer have official support but many shops still depend on.
Firewall
We added a firewall rule that blocks the requests used to exploit the flaw, as a second line of defence.
Server-by-server review
We checked every server one by one with the same test the module runs, and told each customer how theirs stood.
If your shop is hosted elsewhere, the module tells you in five minutes whether your server is exposed. And if you like, we can help you patch it or move it to one of our servers.
What the module checks
Versions
Your PrestaShop against the latest stable release and the minimum we recommend; your PHP against the supported versions, and whether the two are compatible. Also your MySQL or MariaDB version.
Server and performance
Memory, maximum execution time, upload limits, CPU, RAM, OPcache and required extensions, compared with what PrestaShop needs to run smoothly.
Security
Known flaws in your PrestaShop version, installed modules with security advisories, a forgotten install folder, an admin panel with the default name, debug mode, visible errors, SSL not enforced and exposed files (database backups, .git, phpinfo…).
php2shell, with a real test
The test runs on the same PHP that serves your shop. It also checks whether the mitigation is enabled and whether your firewall blocks the attack.
If it comes out vulnerable or can't be checked, ask your hosting provider to confirm it or apply the patch.
Result and PDF
A traffic light per section, an overall score and a PDF report generated on your server, ready to hand to your developer or hosting provider.
AI-agent review and EU compliance (optional)
If you press the button, our tool analyses your shop from the outside, as a customer or an AI agent would, and reviews EU legal requirements. Only your shop's public address is sent.
Works on PrestaShop 1.6, 1.7, 8 and 9. It only installs in the back office: it doesn't touch your shop front or the database (apart from its own settings).
Your data: what is sent and what isn't
The module is designed so you can use it without having to trust us.
What never leaves your server
- The module sends nothing on its own: not when you install it, not when it audits, not when it creates the PDF.
- No telemetry and no background calls to our servers.
- Your customers' or orders' data, internal paths, passwords and keys are never sent.
What only happens if you press a button
- "Update references": downloads a public table with the latest versions and security advisories. It's a download, like checking for updates: it carries no data about your shop and we don't even keep your IP.
- AI-agent review and EU compliance: it warns you first that only your shop's public address will be sent.
- "Contact Línea Gráfica": before sending, it shows you exactly what goes (your contact details and the audit summary) and needs you to tick your consent.
Data protection information
Controller: Línea Gráfica. Purpose: to send you the confirmation link and, if you ask us to, contact you about your shop's security; if you tick the marketing box, also to send you news. Legal basis: your consent, which you can withdraw at any time. Retention: if you don't confirm your email, we delete it after 7 days; if you do, for as long as the relationship lasts or until you ask us to delete it. Recipients: we don't share your data with third parties. Rights: access, rectification, erasure, objection, restriction and portability by writing to contacto@lineagrafica.es. More information in our privacy policy.
Download the free module
Install it like any other module from Modules → Upload a module and press "Audit". You'll have the result in a few minutes.
Leaving your email is optional. If you do, we'll send you an email to confirm it and let you know when there's a new version of the module or a major PrestaShop security flaw.
Something came out red?
We'll fix it for you: server patching, PrestaShop and PHP upgrades, clean-up if the shop has already been compromised, or a move to our hosting, already patched and monitored.