In short: The PrestaShop vulnerability currently making headlines is PHP2Shell and sits in PHP, not in the shop. A PrestaShop update does not help against it. After the PHP patch and restart, you should check the override folder, the modules, the checkout and the employee accounts.
What PHP2Shell means for PrestaShop merchants
PrestaShop is a PHP application that is widespread among small and mid-sized merchants, often on shared hosting or simple virtual servers. According to the PHP team, the flaws CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication, regardless of the shop's status.
For a shop, a lot is at stake: customer accounts, addresses, orders, invoices and access to payment and shipping services. Attackers often target the checkout of shops, where they can read payment entries before they reach the payment provider.
Then there is the time factor. According to media reports, a first attack attempt was observed on 17 October 2026, and the patches appeared on 21 October 2026. A shop that was reachable during that period may be affected even if everything looks normal today. No confirmed indicators of compromise exist so far; hints come from unusual behaviour, new files and changes in the database.
PrestaShop vulnerability: checking the PHP version in the Back Office
Under Advanced Parameters > Information, PrestaShop shows server and PHP details for the running installation. Fixed upstream versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosts sometimes apply fixes as a backport, in which case the displayed number stays the same. Have the status confirmed in writing.
Which PHP versions your PrestaShop version supports can be found in the system requirements in the manufacturer's documentation on prestashop.com. Older shops on versions 1.6 and 1.7 often run on older PHP releases; in that case, what is described under Immediate measures without a patch applies until an upgrade is possible.
Typical hiding places for malicious code in PrestaShop
| Location | Content | What to check |
|---|---|---|
app/config/parameters.php (older versions config/settings.inc.php) |
Database credentials, cookie key | Modification date, renew if you suspect an incident |
override/ |
Overridden classes and controllers | Every file must be explainable |
modules/ |
Modules from the marketplace and from third parties | Unknown modules, modified files |
themes/ |
Templates and JavaScript, also for the checkout | Foreign scripts |
img/, upload/, download/ |
Images, customer uploads, digital products | No PHP files |
var/cache/, var/logs/ |
Cache and logs | Secure logs, regenerate cache |
install/ |
Installation folder | Must not be present in live operation |
The override folder deserves special attention. Code placed there replaces parts of PrestaShop, for example order or payment processing, and is not removed automatically during updates.
Harmless checks on the command line and in the database (table prefix depends on the installation):
find override -name "*.php" -newermt "2026-10-17"
find img upload download -type f -name "*.php"
ls -d admin*
SELECT email, firstname, lastname, active FROM ps_employee;
If customers report unusual payment pages or card misuse after a purchase, take the checkout offline and secure logs from 20 October 2026 onward. A manipulated checkout can capture data on every further purchase.
Back Office, employee accounts and modules
The Back Office is located in a directory with an individual name that is assigned during installation. Under Advanced Parameters, check the employee accounts and profiles for unknown or orphaned access, for example from former agencies. If possible, restrict the admin directory to known networks.
Modules from the marketplace and from third parties extend payment, shipping, marketing and interfaces. Every module is additional PHP code, and modules without active maintenance are among the most common entry points in PrestaShop shops. Uninstall and delete anything unused instead of just deactivating it. You should also check webservice keys for the API for unknown entries.
What a PrestaShop update can and cannot do
An update of PrestaShop or individual modules closes flaws in that code. It does not patch PHP, does not restart processes and removes neither overrides nor foreign modules, scripts in the theme or new employee accounts. If personal data was captured, a reporting obligation may also exist; general information is offered by GDPR reporting obligation: 72 hours, and your data protection officer handles the assessment in the individual case. What merchants should also keep in mind is summarised in IT security for online shops.
Shops with several countries or a multistore function often run several domains on the same installation. A finding then affects all shops, even if the anomaly was noticed in only one.
How does PHP SOS help?
- Together with your host, we clarify the PHP status, backport and restart.
- We secure logs, files and database and document the initial state.
- We check overrides, modules, theme, upload folders, employee accounts and webservice keys.
- If we find something, our malware removal takes care of the cleanup and the renewal of access credentials.
Frequently asked questions
Does a PrestaShop update close PHP2Shell?
No. PrestaShop updates fix flaws in the shop code. The PHP2Shell flaws sit in the PHP interpreter and are closed only by a PHP update or a confirmed backport, with a restart of all PHP processes.
Where do I see the PHP version in PrestaShop?
In the Back Office under Advanced Parameters > Information. Server and PHP details are listed there. A backport that has been applied cannot be recognised from the number; your host confirms that.
What is the override folder and why check it?
In the override folder, PrestaShop classes and controllers can be overridden. Code there runs in place of the original, for example in the checkout. Unknown overrides are therefore an important checkpoint after a suspicion.
Does the admin directory have to be renamed?
During installation, PrestaShop assigns its own name to the admin directory. This makes it harder to find but does not replace strong passwords, two-factor authentication or access restrictions.