Real insights on building faster, smarter, and more scalable commerce experiences.
Meghna Vinod
GeneralCustom PHP commerce platforms face PHP2Shell too. Find every hidden PHP runtime, patch containers, protect .env secrets and decide whether to modernize.
Meghna Vinod
PimcorePHP2Shell puts Pimcore PIM and DAM at risk. See which Pimcore versions have a fix, how to patch, check product data integrity and secure ERP connections.
Aakash Ashok
magentoPHP2Shell hits every Magento store on PHP. See which versions have no fix, how to patch self-hosted Magento 2, check for skimmers and protect customer data.
Meghna Vinod
AdobePHP2Shell and Adobe Commerce: What Every Store Needs to Patch, Check and Protect Key Takeaways PHP2Shell is two critical PHP flaws (CVSS 9.2) that let attackers run commands on your server without a login. Adobe Commerce patches do not fix it. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every worker. Your deployment model decides who patches: Adobe for SaaS, your team for Cloud Infrastructure, you or your host on-premises. According to Amazon, attacks began on October 17, four days before the fix, so check for new admin users and unknown PHP files. Codilar offers an exposure check with findings in 48 hours, plus patching, a compromise sweep and managed services. On 21 October 2026, PHP shipped emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. This guide answers three questions: Is our store exposed, who fixes it, and what should we check once the patch is on? What PHP2Shell Is and What's at Stake PHP2Shell involves two flaws in the PHP runtime itself, both rated critical with a CVSS score of 9.2 out of 10. When PHP aborts a request mid-task, it can leave memory in a broken state that a later request can abuse: a use-after-free condition (a memory bug where software keeps using memory after releasing it, letting an attacker place their own data there). The result is remote code execution (an attacker runs their own commands on your server from the internet) without a login. PHP processes each request before Adobe Commerce code runs, so clean code and audited extensions often make no difference. Any web-facing PHP setup is at risk, and Apache mod_php carries the highest risk. What an Attacker Can Do With It Run commands on your server without logging in Read passwords and API keys leaked from server memory Plant payment skimmers or hidden admin accounts Inject spam pages on your domain and drag down your search rankings. Create PCI DSS and GDPR exposure if card or customer data is reached "There are no complete mitigations; updating is the only safe choice." PHP Security Team, PHP2Shell advisory. Which Adobe Commerce Stores Are Exposed Adobe Commerce stores on an unpatched PHP build are exposed to PHP2Shell, and your deployment model decides who has to fix it. Adobe Commerce as a Cloud Service (SaaS) Adobe operates the runtime. Confirm with your account team, and check any PHP middleware you host yourself. Adobe Commerce on Cloud Infrastructure (PaaS) Adobe manages the cloud infrastructure, and your team pins the PHP version in the application configuration. We found no Adobe guidance specific to these CVEs as of October 23, 2026, so open a support ticket and ask: Has the patched build reached integration, staging and production? Does each environment need a redeploy? Does the Fastly WAF cover PHP2Shell on every environment? On-Premises, Self-Hosted or Third-Party Hosting You or your hosting provider owns PHP. Update the PHP packages, then restart PHP-FPM or Apache so every worker loads the fixed version. Ask your host for written confirmation of the version now serving your store. Your setup decides who patches. Assign one owner to confirm the fixed PHP version on every environment, staging included. The PHP 8.1 Gap in Older Adobe Commerce Versions PHP released fixes only for 8.2 and newer. PHP 8.1 and older get no official release, so stores on those versions depend on vendor or community backports that someone has to apply and test. Per Adobe's system requirements: On Adobe Commerce 2.4.4 to 2.4.6, plan two moves. First, secure the store on your current PHP version. Apply a vendor or community backport of the fix and the interim hardening settings, and test them before they reach production. Then upgrade Adobe Commerce onto a supported PHP version. According to Adobe’s lifecycle policy, PHP 8.1 reached end of life on December 31, 2025, and Adobe warns that PCI compliance is at risk for stores still running it. How to Patch Adobe Commerce Against PHP2Shell Step 1: Confirm the PHP version actually serving the store Check from a web request. The command-line binary can differ from the one serving pages, so verify through the web server or hosting dashboard. Step 2: Update to a fixed PHP release Patched versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Restart PHP-FPM or Apache, because running workers keep old code in memory. Step 3: Use interim mitigations only as a bridge Settings PHP suggests while you patch: session.upload_progress.enabled = 0, then restart workers A low post_max_size (8M, or 32M with uploads) WAF virtual-patch rules in blocking mode What not to rely on: Maintenance mode and error suppression do nothing here, because PHP handles the request first. A WAF helps but is not a fix. According to Cloudflare, attackers were mutating their payloads to get past its rules. Step 4: Regression-test revenue journeys Test checkout, payments, search, integrations and admin uploads on the patched build. Check for Signs of Compromise After Patching Amazon's honeypots recorded an exploitation attempt on 17 October, four days before the fix existed. As of October 23, 2026, we found no public report of a confirmed breach. A missing confirmation does not prove your store is clean, and the patch does not remove anything that got in before it. Review activity from 17 October for: New or changed admin users Unknown PHP files in pub/, media or upload directories Unexpected cron jobs or scheduled tasks PHP processes launching shells, curl or wget Unusual outbound connections from PHP workers Rotate Credentials That May Have Leaked Rotate API tokens, integration keys, admin and database passwords, and payment gateway keys used during the exposure window. Don't Overlook Search Visibility Check the Security Issues report in Google Search Console and crawl for pages you didn't publish. If spam pages have already hurt your rankings, our SEO team can help you clear them from search results and win back lost traffic. Encrypt Customer Data at Rest to Limit the Damage Patching closes the way in. You also need to know what an attacker could read if they got through. Adobe Commerce hashes customer passwords and encrypts payment credentials, but names, email addresses, phone numbers and street addresses sit in the database as plain text. A leaked backup or a stolen database login exposes all of it. PII Shield, Codilar’s field-level encryption framework built with Libsodium, helps limit that damage: Encrypts customers, carts, orders, invoices, shipments, credit memos and admin users Decrypts in real time for authorised users, so checkout, search and admin work as usual It does not replace patching. A copied database yields encrypted records that stay unreadable without the keys. The video below shows how PII Shield protects customer data at the database level. How Codilar Helps Secure Your Adobe Commerce Store Against PHP2Shell Stabilize in 48 Hours Start with a free PHP2Shell Exposure Check, run read-only and with your written consent, with findings in 48 hours. Where action is needed, our engineers patch PHP or secure the store within its current PHP version through tested backports, hardening and WAF virtual patching. The target is 48 hours for standard environments, with checkout and integration regression-tested. Secure What Matters Compromise sweep, credential rotation, custom hardening and SEO clean-up. Strengthen for The Next One We move stores onto supported PHP and Adobe Commerce releases and add PII Shield for field-level encryption. After the move, our managed services and DevOps teams keep your environment patched and monitored. Secure Your Adobe Commerce Store Today Adobe Commerce security depends on every layer beneath the storefront, and PHP2Shell sits in the lowest one. Update PHP on every environment, check for signs that someone got in before the patch, and set up monitoring so you can act on the next vulnerability the day it is announced. Book a free PHP2Shell Exposure Check, and we will review your PHP version and your Adobe Commerce release together. Running another PHP platform? Read our guides for Magento and Pimcore. Frequently Asked Questions Is Adobe Commerce affected by PHP2Shell? Yes. Adobe Commerce runs on PHP, and PHP2Shell affects every PHP installation serving web requests. Who fixes it depends on your deployment: Adobe for Cloud Service, Adobe images plus your redeploy for Cloud infrastructure, and you or your host for on-premises and third-party hosting. Does an Adobe Commerce security patch fix PHP2Shell? No. The flaws are in the PHP runtime, not Adobe Commerce code. You need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport for older versions, then a restart of every PHP worker. Updating Adobe Commerce or extensions alone won't close it. We're on Adobe Commerce on Cloud infrastructure. Do we need to do anything? Yes. Ask Adobe Commerce Support whether the patched build has reached every environment, whether a redeploy is needed, and whether WAF protection covers all of them. Then review logs from 17 October for signs of compromise. Can we secure Adobe Commerce without upgrading PHP straight away? Yes, as a short-term measure. A tested backport, configuration hardening, and WAF virtual patching can secure a store within its current PHP version. It's a bridge, not a destination: PHP 8.1 is end of life, so plan an upgrade to 2.4.7 or later on PHP 8.3 or newer. How do we know if our store was compromised before patching? Review activity from 17 October for new admin users, unknown PHP files, unexpected cron jobs, PHP processes launching shells and unusual outbound connections. Rotate credentials used in that window and check Google Search Console for warnings. Treat anything unfamiliar as an incident.
Aakash Ashok
AdobeAdobe Commerce 2.4.9 runs on PHP 8.5. See the support dates for every version, the PHP 8.2 end of life, and how to sequence your upgrade.
Aakash Ashok
AdobeOutgrowing BigCommerce? Learn how a move to Adobe Commerce (Magento) works, from the migration process to realistic timelines for your store.
Aakash Ashok
ShopifyShopify Canvas launched October 1, 2026. Learn what it supports, what it does not at launch, and whether it is the right tool for your Shopify store right now.
Nikki Kumari
Ecommerce RoundupeCommerce Roundup September 2026 September 2026 arrived with the most severe security event in Adobe Commerce's history, a Shopify platform expansion that makes every eligible store reachable by AI agents at checkout, and the first major holiday season forecasts that confirmed what platform developments had been signaling all year. The brands that spent September firefighting a zero-day vulnerability are entering Q4 behind the ones that spent it preparing for BFCM. Here is everything that mattered. Platform Updates September 4 to 8: Adobe Commerce StyleSmuggler CVE-2026-75650 September 2026 is not a normal Adobe Commerce security month. Adobe released two separate security bulletins within 24 hours for Adobe Commerce and Magento Open Source. It was an emergency Priority 1 update for CVE-2026-75650 on September 7, followed by the regularly scheduled September security update on September 8. The distinction matters because the monthly September patch does not include the CVE-2026-75650 hotfix. Both must be applied independently. Dutch e-commerce security firm Sansec confirmed the first exploitation of CVE-2026-75650, codenamed StyleSmuggler, at 22:20 UTC on September 4, 2026. The vulnerability carries a CVSS score of 10.0, the maximum possible severity rating, and requires no authentication. It abuses Magento's template system through PHP code injection triggered by the Payment Transaction Failed Reminder email. A fully patched store running Adobe's July and August 2026 updates was compromised within hours of the first confirmed exploitation. Adobe published emergency security bulletin APSB26-146 on September 7, three days after the first confirmed exploitation. StyleSmuggler deploys a Rust-based Linux backdoor that disguises itself as a legitimate system process and restarts automatically via cron. Patching closes the vulnerability but does not remove an existing compromise. Any store that was accessible between September 4 and September 7 without the hotfix applied needs a forensic scan, full credential rotation, and confirmation that no secondary backdoors were installed. Also Read: Adobe Commerce StyleSmuggler CVE-2026-75650: What Every Merchant Must Do Right Now September 8: Adobe Commerce as a Cloud Service September Release Adobe Commerce as a Cloud Service published its September 8 release to Production, containing all changes from Adobe Commerce version 2.4.9. The update introduced new GET and PUT /V1/system/config REST API endpoints that allow integrations to read and update Commerce system configuration values programmatically. Development teams can now synchronize configuration across staging and production environments through API calls rather than manual Commerce Admin reconfiguration. Also Read: Adobe Commerce as a Cloud Service: What the June 2027 Enforcement Deadline Means for Merchants September 15: Shopify Admin New Look Rolls Out Starting September 15, the Shopify admin began rolling out progressively to merchants with a redesigned interface covering color, typography, spacing, and icons. Search, notifications, and the store picker moved to side navigation. Sidekick moved from a side panel to a floating chat at the bottom of the screen. Apps using Admin UI extensions pick up the new styles automatically. Apps that use Polaris Web Components 1.0 remain unchanged until the developer chooses to migrate to Polaris 2.0. The rollout is progressive and merchants will see it at different times through October. September 21: Shopify Analytics Session Measurement Change Starting September 21, 2026, Shopify changed how it counts sessions in Analytics. Merchants comparing session data across this date will see a visible change in reported numbers that reflects the new measurement methodology rather than a real change in traffic. Any dashboard or reporting setup that trends sessions from September 21 needs to be annotated and rebaselined before BFCM planning decisions are made based on that data. September 25: Shopify Tax to Automatically Tax Return Shipping Fees from October 23 Starting October 23, 2026, Shopify Tax and Tax Platform will automatically tax return shipping fees like other shipping charges for US merchants. The change is automatic for merchants using Shopify Tax or Tax Platform, meaning no manual configuration is required. Merchants using manual workarounds to calculate, collect, import, or reconcile tax on return shipping fees should review those processes before October 23 to avoid double-counting tax on the same transaction. September 28: Shopify Opens Checkout to Browser-Based AI Agents On September 28, Shopify announced WebMCP support for checkout, including Shop Pay for all eligible merchants. Browser-based AI agents can now read the checkout, update order details, and complete purchases with buyer authorization. Shopify had previously supported WebMCP for storefronts and carts, allowing AI agents to search products and add items to the cart. The September 28 update extends that capability to full purchase completion. The announcement followed Shopify CEO Tobias Lütke's confirmation one week earlier of a partnership with Meta to enable Meta's Muse agent to shop and check out with Shop Pay on all Shopify stores. Shopify also confirmed that Instinct, a personal AI shopping agent, can now search Shopify's merchant network for live product information including prices, sizes, and availability. For merchants on Shopify, every eligible store is now reachable by AI agents from product discovery through purchase, with no additional configuration required. Also Read: Shopify Agentic Commerce: What It Means for Merchants in 2026 Industry Updates The 2026 Holiday Season Numbers: AI Drives the Forecast September brought the first major holiday season forecasts for 2026 and the numbers are the clearest signal yet that AI commerce is a present revenue channel. BFCM 2026 will be the first major shopping event where AI agents actively shop on behalf of buyers at scale. For Shopify and Adobe Commerce merchants, the commercial implication is specific. Product pages that AI agents cannot read will not appear in AI-driven holiday recommendations regardless of how strong the SEO or paid media investment is. The brands that invested in catalog readiness and structured product data in September are the ones that will appear in AI recommendations during BFCM and Cyber Week. The brands that did not will find their products absent from a channel that is already generating one in five visits. TikTok Shop Tightens Fulfillment and Seller Requirements TikTok Shop rolled out a Seller Center navigation update on September 7 that relocated where daily tools live, arriving alongside new order packaging requirements and updated shipping and fulfillment policies published September 3. TikTok Shop is now actively enforcing fulfillment metrics consistent with a delivery-performance marketplace: a Late Dispatch Rate at or below 4% and an On-Time Delivery Rate at or above 80%. For Shopify merchants selling through TikTok Shop, these requirements need to be operational before BFCM traffic arrives. A seller center that cannot meet the fulfillment standards during peak volume faces the same consequences as one that misses them during a normal week, at significantly higher cost to the business. Upcoming Events BFCM 2026: November 27 to 30 Black Friday and Cyber Monday fall on November 27 to 30, 2026. With eight weeks from today, the preparation window is closing. Adobe's forecast of $47.5 billion in Cyber Week online sales and 130% growth in AI-driven retail traffic confirm this will be the most commercially significant and technically demanding BFCM in eCommerce history. Merchants who have not confirmed checkout extensibility status, tracking pixel migration, infrastructure scaling, and AI product discovery readiness should treat October as the last viable preparation window before the November code freeze. Also Read: Shopify BFCM Checklist 2026: What Most Merchants Miss Until It Costs Them Shopify API 2026-10: October 1 The Shopify API 2026-10 version releases on October 1. Alongside this release, new carrier services created via the Admin API will no longer automatically add rates to the General shipping profile and will require manual configuration. API version 2025-10 is retired on October 16, 2026. Any custom apps or integrations built on that version will stop working after that date. Development teams should audit every custom integration before October 1 to confirm compatibility with 2026-10. Amazon Business Reshape: Nashville, October 2026 Amazon's fifth annual B2B commerce conference takes place in Nashville in October 2026. The event covers AI-driven procurement, quantity-tier pricing, and the expansion of B2B buyer-facing features to third-party sellers. For brands operating both B2B and DTC commerce, Reshape is the highest-signal Amazon event of the year for wholesale strategy.
Nikki Kumari
ShopifyPreparing your Shopify store for BFCM 2026? Check checkout extensibility status, tracking pixel migration, app performance, and cloud costs before November.
Nikki Kumari
AdobeAdobe Commerce AI product discovery is now live. Understand what Catalog Agent does, how semantic search works, and more
Nikki Kumari
ShopifyLearn how Shopify ERP integration connects orders, inventory & finance. Explore methods, common pitfalls, and how Codilar can help you get it right.
Meghna Vinod
GeneralAdobe Commerce zero-day CVE-2026-75650 StyleSmuggler is actively exploiting stores. Apply hotfix VULN-39341 immediately.
Nikki Kumari
With the world's leading digital commerce agency.
