PHP2Shell and OpenCart: a critical PHP vulnerability threatens online stores

PHP2Shell: a critical PHP vulnerability that threatens OpenCart stores

OpenCart is an open-source online store platform written in the PHP programming language. Every visitor request, from viewing a product to checking out, goes through PHP on the server. On 21 October 2026, the PHP project released urgent security patches for two critical vulnerabilities, which researchers named PHP2Shell. SI-CERT published alert SI-CERT 2026-07.

What’s affected	PHP itself on the server (not OpenCart, a theme or a module), practically all versions that process web requests
Identifiers	CVE-2026-109618 and CVE-2026-109619
Severity	Critical, CVSS 9.2 (CVSS v4.0)
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Attack status	On 26 Oct 2026, CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalogue
Official patch for PHP 8.1 and older	Not available, as these versions are no longer supported

What an attacker can do to an online store

• Run their own code on the server without logging in and without a vulnerable module. They can plant a script on the server (a web shell) that gives them lasting access to the store.
• Read part of the server’s memory. Researchers at Wiz warn that this may contain passwords, login tokens, API keys and certificates. For an online store, this also means payment system keys and access to connected services (shipping, accounting, ERP).
• Access customer and order data in the database: names, addresses, email addresses, phone numbers and purchase history. Such a breach is a personal data breach that must be handled under the GDPR.
• Change the store: plant a fake card payment form, redirect visitors to other websites, or insert unwanted content that can get the store flagged as dangerous by Google.

Why updating OpenCart isn’t enough this time

The flaw is in the PHP running underneath the store, so no module, OpenCart update or admin setting can close it. By 23 October 2026, the OpenCart project hadn’t issued a statement about PHP2Shell, and the latest releases, 3.0.5.1 and 4.1.0.4, came out on 11 August 2026, before the PHP fix. The solution is an updated PHP on the server and a restart of the PHP service, which with shared and managed hosting is usually your hosting provider’s job.

Where to check which PHP version your store uses

• In your hosting control panel (e.g. cPanel: Select PHP Version or MultiPHP Manager, Plesk: the domain’s PHP Settings ).
• With your hosting provider: ask which PHP version runs your domain and whether it includes the PHP2Shell fix. Distributions and providers sometimes backport a fix to an older version without changing the version number.
• If we maintain your store, we’ll check the version and let you know.

The biggest problem: OpenCart stores on old PHP

Official PHP2Shell patches only exist for PHP 8.2, 8.3, 8.4 and 8.5. But many Slovenian OpenCart stores still run on PHP 7.4, 8.0 or 8.1, because they were built years ago and haven’t been technically updated since. The PHP project no longer issues any security patches for these versions, and support for PHP 8.2 ends on 31 December 2026.

With OpenCart, switching to a newer PHP in the hosting control panel usually isn’t possible without adapting the store first. Older versions of OpenCart itself, themes (e.g. Journal) and third-party modules (payment systems, couriers, accounting integrations, price comparison sites) are often not compatible with newer PHP. The results are a blank page, a 500 error, a broken cart or checkout, or errors that only show up at payment or invoicing.

So just waiting isn’t safe: many hosting providers eventually drop unsupported PHP versions and force stores onto a newer PHP. If the store isn’t ready, sales can suddenly stop.

Which OpenCart version supports which PHP

Most modules on the OpenCart marketplace are still written for branch 3.0, so for most existing stores the safest path is upgrading to OpenCart 3.0.5.1 together with the theme and modules. There’s no automatic upgrade within branch 3, so it has to be done manually, on a test copy of the store. Moving to OpenCart 4 makes most sense when redesigning the store.

Other vulnerabilities in OpenCart and modules in 2026

PHP2Shell isn’t the only threat. In 2026, several vulnerabilities were published in OpenCart itself and in its modules. For OpenCart stores, this means regular maintenance of the core and modules is just as important as an up-to-date PHP.

OpenCart 4.1.0.3 and 4.1.0.4 – XSS in the customer account

• Identifiers: CVE-2026-84437 and CVE-2026-84438, medium severity, published 2 Sep 2026.
• What can happen: malicious JavaScript code can be injected through the address and name fields in the customer account (cross-site scripting). The details are public, and the OpenCart developers haven’t responded to the report.
• Recommendation: there’s no fix in an official release yet. Stores on OpenCart 4.1 should have a firewall (WAF) installed and their theme customisations reviewed.

OpenCart up to 4.1.0.4 – unpaid orders with reward points

• Identifier: CVE-2026-119558, low severity, published 30 Oct 2026.
• What can happen: a logged-in customer can use a sequence of steps with reward points and free checkout to place an order at full price without paying for it.
• Recommendation: if you use reward points, check orders with a free checkout status and don’t ship them without a verified payment.

OpenCart 4.0.2.3 – code execution via the theme editor

• Identifier: CVE-2026-3714, medium severity, published March 2026. It’s an incomplete fix for the older flaw CVE-2024-36694.
• What can happen: a user with admin access can run their own code through the theme editor. It’s mainly dangerous if administrator passwords are weak or already stolen.
• Recommendation: upgrade to the latest release of branch 4.1, use strong passwords and restrict admin access.

Payment modules – an example of a critical flaw (CVSS 9.8)

• Identifier: CVE-2026-85531 in Sipay’s Virtual POS module for OpenCart, published October 2026.
• What can happen: the module doesn’t correctly check the signature of payment messages, so an attacker can forge a payment confirmation without logging in.
• Why it matters to you: the module isn’t widely used in Slovenia, but the example shows that payment modules are the most sensitive part of a store. Old payment modules that haven’t been updated for newer PHP are often outdated security-wise too.

What OpenCart store owners should do: a checklist

1. Check your PHP version with your host. If it’s not one of the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35), or if it’s 8.1 or older, contact your hosting provider or us straight away.
2. Ask for written confirmationthat the fixed PHP is installed and the PHP services have been restarted.
3. Check the version of OpenCart, the theme and modules. If OpenCart is older than 3.0.3.9, the store won’t work on PHP 8 without an upgrade.
4. Don’t switch PHP “blindly”. First carry out and test the upgrade on a test copy: the cart, checkout, all payment and shipping methods, and invoicing.
5. Look for signs of a hack from 17 October 2026 onwards: unknown administrators, unknown PHP files in the image or system/storagefolders, changes to checkout templates, unusual redirects.
6. Change passwords and keys (admin, FTP/SSH, database, payment system keys) if a hack can’t be ruled out.
7. Make a backup of the files and database and check that you know how to restore it.

You’ll find more store management guides in the OpenCart supportsection. WordPress website owners can read the article PHP2Shell: a critical PHP vulnerability threatens WordPress websites.

Free, no-obligation review

Is your OpenCart store ready for PHP 8.3 or 8.4?

We’ve been developing and maintaining OpenCart stores for more than 15 years. We’ll review your store and prepare a clear upgrade plan with an estimate of the work and cost before you decide on anything.

• Core: OpenCart version and upgrade path
• Modules and theme: PHP 8.3+ compatibility
• Server: PHP version, PHP2Shell fix, hosting readiness
• Estimate: scope of work, timeline and cost

OpenCart PHP 8.3+ upgrade →podpora@qstom.si

Sources

• SI-CERT 2026-07: Critical vulnerabilities in PHP (PHP2Shell) (in Slovenian)
• PHP.net: security release announcement
• PHP.net: supported PHP versions
• The Hacker News: CISA confirms active exploitation of PHP2Shell
• Wiz Research: PHP2Shell
• PHP2Shell and OpenCart: What Store Owners Need to Do
• OpenCart 3.0.5.1 and 4.1.0.4 with PHP 8.5 support
• PHP 8.5 and OpenCart: version compatibility
• OpenCart: releases on GitHub
• CVE records: CVE-2026-84437, CVE-2026-84438, CVE-2026-119558, CVE-2026-3714, CVE-2026-85531