PHP2Shell: what shoppers should know

What happened

On 21 October, researchers disclosed two critical flaws in PHP, the language that runs a large share of the web. Tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, they quickly became one of the most searched security terms of the day, including in Türkiye. The UK's National Cyber Security Centre (NCSC) warned that the issue may let attackers execute commands on web servers running PHP, and the PHP team released fixes the same day.

The details

According to Cloudflare, the flaws were disclosed by Calif.io, Wiz, OpenAI and Quarkslab and affect web servers running PHP 5.4 or later. Both involve how PHP handles memory when a request fails, and they can lead to denial of service, remote code execution or data exposure. Malwarebytes reports a severity score of 9.2 out of 10 and says an attacker would not need to log in. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older no longer get routine security updates.

How big is the exposure

Cloudflare, citing W3Techs, says almost 70% of websites use PHP, and Malwarebytes notes that it underpins WordPress, Drupal, Joomla and Magento. Cloudflare switched on firewall rules about nine hours before the public disclosure and says it has already seen attack traffic, with attackers changing their payloads to slip past filters. The NCSC advises organisations to find every PHP installation, update it, and consider taking systems offline if they cannot patch or mitigate quickly. That is why some sites went into maintenance mode this week.

A second alert: compromised certificates

The PHP news landed a day after another internet-wide warning that also trended, in Hong Kong. Cloudflare said the private keys for eight intermediate certificates from eMudhra, which browsers and operating systems widely trusted, had been compromised. With those keys an attacker could forge a certificate for any domain and impersonate a site. Cloudflare found no active exploitation on its own services and urged people never to fix certificate errors by switching verification off.

Why it matters for payments

Checkout pages, bank portals and the website of any money transfer app depend on the same web servers and certificates. Shoppers do not need to install anything: PHP updates are for site owners, not your device. Malwarebytes advises watching for unexpected content, downloads, redirects or repeated login requests, even on familiar sites, and leaving a page if something looks wrong. A site that is offline for maintenance is not, by itself, a sign of a breach.

What to watch next

The timing matters. Captify's UK search data, reported by ExchangeWire, shows Black Friday search intent building from October and jumping to more than seven times normal levels in Black Friday week. Expect more patch notices from hosting firms and online shops in the coming weeks, and watch whether any breaches are linked to PHP2Shell once investigations finish.

What it means for Odix Pay users

The steps below are general good practice. In the Odix Pay app you can manage your Odix cards: freeze a card in a few taps if a payment looks wrong, which affects only that card, and use a virtual card for online shopping. Depending on your card, you approve online payments in the app or with an SMS code. Availability depends on your country, and fees are shown in the app. More stories in the Odix Pay newsroom.