Major PHP vulnerability. Is your online store safe?

For stores still running older versions of PrestaShop, this situation can raise important questions.

At 10.Cero we offer a technical assessment service to look into these questions and help you work out what your store needs to keep running securely and sustainably.

What happened today: "PHP2Shell"

On 21 October 2026 the PHP team released urgent updates to fix two critical vulnerabilities, known as "PHP2Shell". They affect practically every PHP version of the last decade, and PHP powers around 70% of the world's websites, including every PrestaShop store.

What makes them so serious is how easy they are to exploit:

• No username or password needed. Sending crafted requests to any page of the site is enough, much like uploading a file.
• Attackers can take control of the server and read what is in its memory: passwords, access keys and data from other visitors.
• On shared hosting the risk multiplies. Many sites share the same machine and the same PHP processes, so a single exposed site can open the door to the rest.
• Attacks are already under way. Security companies such as Cloudflare have detected exploitation attempts from day one.

The fix is to update PHP to a patched version: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. There is no official fix for PHP 8.1 and earlier, and that is the problem for many stores: if your PrestaShop version does not run on PHP 8.2 or later, your server cannot be protected just by updating PHP.

The first step is to ask your hosting provider whether they have applied the update and which PHP version your store runs on.

A security update that can affect your whole store

PHP is one of the core components of PrestaShop. When a critical vulnerability appears in the language itself, updating the application is not always enough: you also need to make sure the server runs a PHP version that includes the corresponding security fix.

The problem arises when a store runs an old version of PrestaShop that does not officially support the PHP versions required.

This is where things stand today: which PHP versions still receive security patches and which ones each PrestaShop release can run.

1.6.1PHP 5.6 – 7.1 1.7.8PHP 5.6 – 7.4 8.xPHP 7.2 – 8.1 9.0PHP 8.1 – 8.4 9.2PHP 8.1 – 8.5 PHP5.67.07.17.27.37.48.08.18.28.38.48.5

SupportedSecurity only until 31/12/2026No security patches

Sources: php.net (supported versions), PHP security advisories of 21/10/2026 (CVE-2026-109618 and CVE-2026-109619) and the official requirements of each PrestaShop release.

In that scenario, the owner may face a difficult decision: keep a familiar, working installation with compatibility limits, or take on an upgrade that may affect modules, themes and customisations.

The answer is not to upgrade blindly. Before deciding, it pays to know the real state of the installation and weigh up the available options.

Why consider PrestaShop 9.2?

PrestaShop 9.2 can be an opportunity to modernise your store. Besides supporting PHP up to 8.5, it brings one-page checkout and an AI assistant in the back office: we cover it in detail in what is new in PrestaShop 9.2.

Moving to a more recent version lets you check compatibility with current PHP versions, review technical dependencies and stop maintenance problems from piling up.

However, a migration should not be driven by the version number alone. You need to check whether essential modules are still available, whether the theme can be adapted and what happens to the customisations built for the store.

That is why, before starting a migration, a technical assessment helps you understand its scope and anticipate possible difficulties.

The 10.Cero assessment service

At 10.Cero we work on custom development, migrations and maintenance of PrestaShop stores.

Our technical assessment service is designed to establish the state of your installation and explore how it could move to PrestaShop 9.2.

1. Security and PHP environment review

   We identify the versions in use and assess whether a security fix compatible with the current installation exists.

2. Modules, theme and customisations

   We look at everything that may affect the upgrade: payment, shipping and invoicing modules, integrations and in-house developments.

3. Assessment of the move to PrestaShop 9.2

   We analyse technical feasibility, foreseeable incompatibilities and the work that may be needed to adapt the store.

4. Action plan

   You get a technical basis to decide between keeping the current installation with the right fixes, upgrading components or planning a migration.

A planned migration beats an emergency upgrade

Every store is different. An installation with standard modules can look very different from one that relies on in-house developments or specific integrations.

An upfront assessment lets you spot risks before acting, reduce surprises during the migration and organise the work by priority.

Not every store needs exactly the same solution, either. In some cases the current installation can be kept secure; in others, upgrading PrestaShop may be the most sensible option in the medium term.

The goal is an informed decision, not a version change without knowing the consequences.

Want to know whether your store is ready?

At 10.Cero we can help you review your PrestaShop installation, assess its technical compatibility and decide which steps to take to improve its security and prepare its evolution.

Don't wait for an incompatibility or an urgent update to interrupt your business. Knowing the state of your store in advance lets you plan changes calmly.

Note: compatibility and the availability of fixes must be checked for each installation. A technical assessment does not replace applying the necessary security patches straight away.