Critical PHP flaw puts retail websites and e-commerce systems on alert

Two critical vulnerabilities in PHP, known as PHP2Shell, pose a severe risk to retail and e-commerce websites relying on platforms like Magento, WooCommerce, and WordPress by enabling unauthenticated remote code execution and potential exposure of sensitive data. Immediate updating of PHP versions is necessary, with authorities warning of imminent large-scale exploits and AI accelerating both vulnerability discovery and attack development.

This Wire brief sits within Fusion42's coverage of E-commerce, and 16 sources have reported it between 21 Oct 2026 and 22 Oct 2026.