Retailers worldwide are being urged to check their website security after two critical software vulnerabilities raised concerns over potential cyber attacks, online trading disruption and the exposure of business and customer data.
Retailers are facing an urgent website security warning following the discovery of two critical vulnerabilities in PHP, a programming language widely used to operate websites and online shopping platforms.
Go deeper with GlobalData
Discover B2B Marketing That Performs
Combine business intelligence and editorial excellence to reach engaged professionals across 36 leading media platforms.
The flaws, collectively known as PHP2Shell, could allow cyber criminals to run malicious commands on vulnerable web servers without needing a username or password. This type of attack could give criminals access to sensitive information, disrupt online sales or compromise other systems.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were disclosed on 21 October 2026. Both received a critical severity rating of 9.2 out of 10 under the CVSS 4.0 cybersecurity scoring system.
The British Independent Retailers Association (Bira) has urged businesses to check whether their websites are affected, highlighting the challenges facing smaller retailers that rely on external technology providers.
Security fixes are available, but retailers need to confirm that the software supporting their websites has been updated.
Why retailers could be affected
PHP is widely used to power websites, including those built with WordPress and e-commerce software such as WooCommerce.
Retailers use these platforms to process orders, display products, manage stock information and communicate with customers.
The newly discovered vulnerabilities affect the underlying PHP software rather than a particular retail platform. This means a website could appear to function normally while running vulnerable software in the background.
Updating WordPress, WooCommerce or another website application may not resolve the problem if the underlying PHP software remains unpatched.
If exploited, the flaws could allow attackers to run commands on affected servers, potentially exposing customer information, interrupting online sales or compromising other systems.
For retailers, the consequences could include lost revenue, delayed orders, recovery costs and potential data protection obligations.
However, not every website using PHP is necessarily vulnerable. The level of exposure depends on the software version and server configuration. The proportion of websites actually affected has not been established.
Independent retailers urged to act
Bira issued its warning on 22 October, advising independent retailers to contact their website developers or hosting providers as a priority.
Andrew Goodacre, chief executive of Bira, said: “This is a serious warning and one that independent retailers should not ignore.”
The association highlighted the growing reliance of smaller businesses on websites for online sales, stock information and customer communications.
Many independent retailers may not know whether their websites use PHP or which version is installed. This can make it harder to identify security risks, particularly when website maintenance is outsourced.
Goodacre said: “You do not need to be a technical expert to protect your business.”
He advised retailers to ask their developers or hosting providers to confirm that PHP has been updated to a secure version.
Businesses should also establish who is responsible for maintaining their website software and applying security updates.
How the security flaws work
The two vulnerabilities involve weaknesses in the way PHP manages computer memory.
CVE-2026-109618 concerns errors that can occur when PHP runs out of memory. CVE-2026-109619 involves the use of information linked to memory that has already been released.
Under certain conditions, attackers could exploit these weaknesses to run malicious commands remotely.
Neither vulnerability requires an attacker to log in first, although successful exploitation depends on how PHP is installed and configured.
Potentially affected server environments include Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
The level of risk varies between installations, making it important for retailers to have their technology providers check the software and configuration supporting their websites.
The publication of technical research and demonstrations of possible attacks has increased the urgency of installing security fixes.
AI-assisted research uncovers vulnerabilities
The discovery of the flaws has also highlighted the growing role of artificial intelligence (AI) in cybersecurity research.
Researchers used advanced AI models to investigate weaknesses in PHP’s memory management and examine how the flaws could be exploited.
The PHP Foundation credited organisations including Calif, OpenAI and cybersecurity company Wiz for their involvement in the research and disclosure process.
Calif and Wiz have acknowledged using AI models to support their investigations.
The findings show how AI-assisted research can help identify complex software vulnerabilities. They also underline the need for businesses and technology providers to respond quickly when security flaws become public.
The coordinated disclosure of the vulnerabilities was brought forward after information about them emerged ahead of the planned announcement.
Security fixes now available
The PHP project released security updates on 21 October 2026 to address the vulnerabilities.
The first fixed versions for the main PHP branches were:
- PHP 8.5: Version 8.5.12
- PHP 8.4: Version 8.4.27
- PHP 8.3: Version 8.3.36
- PHP 8.2: Version 8.2.35
Retailers should ensure their websites are running an appropriate fixed version or a security update confirmed by their software provider.
Older PHP versions require particular attention.
PHP 8.1 and earlier releases no longer receive regular security updates from the main PHP project. Businesses using these versions may need to upgrade or obtain a security fix from their software distributor.
Some providers have released fixes for older versions without changing the main PHP version number. Retailers should therefore ask their hosting providers to confirm that the installed software addresses both vulnerabilities.
Updates must also cover the PHP software actively running the website, including relevant servers and hosting environments.
Updating a website’s content management system alone does not necessarily mean its underlying server software is secure.
What retailers should do now
Bira is encouraging retailers to contact their technology providers and confirm that the necessary security measures are in place.
Retail businesses should take five steps:
- Contact the website developer or hosting provider. Ask whether the website uses an affected PHP version and whether security updates have been installed.
- Confirm that both vulnerabilities have been fixed. Request details of the PHP version or security package in use and check that updated services have been restarted where necessary.
- Check for outdated software. Establish whether unsupported PHP versions need upgrading or additional security fixes.
- Review website activity. Ask the technical provider to check for suspicious activity or signs of unauthorised access, particularly if updates were delayed.
- Check backup arrangements. Confirm that reliable website backups are available and can be restored if an attack disrupts operations.
For retailers using managed hosting services, the provider may be responsible for installing PHP updates.
Businesses should nevertheless seek confirmation that their websites have been checked and any necessary fixes applied.
Backups and security monitoring can help limit the impact of an attack, but they do not replace security updates.
Website security becomes a retail business risk
The warning highlights the importance of cybersecurity as retailers increasingly depend on digital systems for sales, fulfilment and customer service.
For online retailers, a website attack could interrupt transactions, delay deliveries and affect customer communications.
Store-based businesses could also face disruption if their websites support click-and-collect, stock availability checks or other services connected to physical stores.
Smaller retailers may face greater challenges when responding to security threats, particularly if they lack in-house technical expertise or rely on third-party providers.
However, the discovery of the vulnerabilities does not establish that retailers have suffered widespread attacks or that customer data has been compromised.
Cybersecurity company Palo Alto Networks’ Unit 42 withdrew an earlier assessment linking an attack on a European government agency to PHP2Shell after it could not confirm that the vulnerabilities had been used to gain initial access.
This distinction is important because a critical security flaw requires urgent attention, but its severity does not necessarily reflect the scale of actual attacks.
For retailers, the immediate priority is to establish whether their websites are exposed and confirm that the necessary PHP security fixes have been applied.
The incident also highlights the need to maintain the software behind online stores, not just the customer-facing websites.
