You may have seen the news this week about two serious security flaws in PHP, nicknamed “PHP2Shell” (officially CVE-2026-109618 and CVE-2026-109619). If you’ve been wondering whether your store is at risk, here’s the short answer:
Your Freewebstore store is not affected, and you don’t need to do anything.
Here’s what happened and why your store is safe.
What are the PHP2Shell flaws?
PHP is a programming language that runs a huge share of the web, including WordPress, WooCommerce, Magento and lots of other ecommerce software. On 21 October 2026, the PHP team announced fixes for two critical flaws that could let an attacker take control of a web server running PHP, without needing a password. Both are rated 9.2 out of 10 for severity, and security researchers have already seen attempts to use them.
The fix is to update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later). That’s why many website owners and hosting companies have been busy this week.
Why your store isn’t affected
The flaws are in PHP itself, so they can only affect websites that run PHP. Freewebstore doesn’t use PHP to run its infrastructure or stores.
We hope this puts your mind at rest. Happy Selling
Leave a Reply