Security warning · PHP2Shell · As of 21.10.2026
The update only helps shops that already run on current PHP. For everyone else there is a fast way out: the express relaunch in 2 to 4 weeks.
On 21 October 2026, PHP2Shell revealed two critical vulnerabilities in the core of PHP. Magento, Shopware, WooCommerce, TYPO3 and many custom ordering portals run on PHP. Official updates are only available for PHP 8.2 to 8.5. REEA checks how exposed your shop is and rebuilds older online shops with their product data, customer accounts and ERP integration.
Situation
PHP2Shell is the name for two critical vulnerabilities in the PHP programming language. Attackers can use them to run their own code on the web server without logging in, including access to the shop database. Every server running an unpatched PHP version is affected, regardless of the shop system.
Calif and Wiz Research discover the bugs independently of each other. Source: Wiz Research
The PHP team brings the release of the updates forward. Source: php.net
Among others, universities and state authorities take their websites offline as a precaution. Source: ORF, Handelsblatt
Versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. There is no official release for PHP 8.1 and older. Source: php.net
Security firms report first attack attempts and expect automated mass scans. Source: Cloudflare, SecurityWeek
Official warnings: BACS · BSI · CERT-EU · php.net
Online shops
A shop stores customer accounts, takes payments and is connected to ERP, PIM and payment providers. If an attack succeeds, it is not about a defaced home page but about customer data, revenue and access to your core systems.
Many shops on older Magento 2 or Shopware 6 versions and WooCommerce with old extensions run on PHP 8.1 or older. Magento 1 and Shopware 5 have not received vendor updates for some time.
Payment modules, configurators and interfaces often stop working on new PHP. The update turns into a project.
Anyone who can run code on the server can alter the checkout step and skim card data without the shop noticing.
Credentials for SAP, Microsoft Dynamics or the PIM sit on the shop server. A compromised shop becomes the entry point into the company network.
Unlike an information site, every day of downtime costs orders directly, and in B2B also the trust of regular customers.
Protection rules from hosts or Cloudflare reduce the risk. Cloudflare itself calls them a stopgap that does not replace the PHP update.
Enterprise
Alongside the shop there are customer portals, multilingual TYPO3 websites, campaign pages and internal ordering portals. Each installation needs its own update, often with a different service provider.
Which systems run on PHP, on which version, and who is responsible? Without this list, the forgotten microsite stays open.
Since 30 April 2026, TYPO3 v12 no longer receives free support, and v11 has been without it for longer. Older installations often run on older PHP as well.
Since 1 April 2025, operators of critical infrastructure must report cyberattacks to the BACS within 24 hours. If personal data is affected, a report to the FDPIC may be required.
Business customers, insurers and auditors want to know whether you have responded. A documented plan answers these questions.
Self-check
Answer six short questions. The result shows an assessment from low to critical and the next steps. Nothing is sent and nothing is stored.
Your assessment
Your assessment appears here once you have answered the questions.
Risk
The assessment is based on your answers. Whether your shop is really affected can only be confirmed reliably with access to the server or hosting.
Immediate measures
The most important measure is updating to a patched PHP version. This is what the PHP team and the authorities recommend. These five steps help you clarify and reduce the risk today.
Emergency bridge
Then we secure it temporarily and plan the express relaunch in parallel. The shop keeps selling until the new one is online.
Request the emergency bridgeDecision
Not every affected shop needs a relaunch. With older shops, however, the update only fixes the acute problem, and the next vulnerability hits the same outdated technology. If more than one point on the right applies, patching usually costs more than a new shop.
Express relaunch
In the express relaunch, REEA takes over product data, customer accounts, order history and all addresses from the old shop and rebuilds it on a current, supported platform. Interfaces to ERP, PIM and payment providers are taken over or reconnected. You approve each step before we move on.
Review version, PHP, extensions and interfaces. You receive scope, target platform and a fixed price.
Temporary protection for the old shop, export of products, customers, orders, content and addresses.
Home page, product page, basket and customer account as a clickable prototype, with data from your ERP.
New shop on your domain, with redirect plan, payment methods and tested ERP integration.
Security updates, backups and monitoring on a fixed schedule, hosting in Switzerland or the EU.
Around 90 specialists in the REEA Group's own development centre work in parallel on data migration, design and interfaces. Proven building blocks for Shopware and Magento shorten the build. The pace depends on how quickly content and approvals are available. Very large ranges, many languages or a new ERP integration take longer, and we tell you before we start.
Proof points from Switzerland
Both shops are connected to SAP and were built together with Swiss SAP consultancies. The consultants were responsible for the ERP, and we were responsible for the shop and interface.
AISymfony shop with SAP integration
Müller + Krempel AG supplies primary packaging for pharma, food and cosmetics. Business customers were to order online, with data directly from SAP.
An online shop based on Symfony, connected to SAP.
Business customers order online. REEA looks after the shop on an ongoing maintenance basis.
AI2customer groups in one shop: business and private customers
ALBIRO AG supplies workwear, protective clothing and safety clothing. One shop was to serve both business and private customers, connected to the SAP backend.
Shop on Magento with Symfony and a web app, connected to SAP.
Both customer groups buy in the same shop. REEA maintains it on an ongoing basis and now also supports a sister company within the group.
Why REEA
An express relaunch is only as good as the operation that follows. These figures stand behind it.
Costs
The shop security check is free of charge. We give you the fixed price for your express relaunch right afterwards, depending on shop system, range and interfaces.
Starting point
free
Express relaunch
fixed price
Operation
monthly
All prices in CHF, excluding VAT.
FAQ
What matters is not the shop system but the PHP version on the server. If it runs PHP 8.1 or older, or the update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 is missing, the shop is at risk.
Shopify updates the shop itself. You should still check your own apps, middleware or campaign pages on PHP servers.
It reduces the risk until the update, but does not replace it. Providers such as Cloudflare, which offer these protection rules, say the same.
For shops with a manageable range and an existing ERP interface, yes. Very large ranges, many languages or a new ERP integration take longer. We give you a binding schedule after the shop security check.
We migrate customer accounts and order history. Whether passwords can be migrated depends on the old and the new system. Otherwise your customers receive an invitation to set a new password.
Every old address gets a target in the new shop. This preserves what you have built up on Google.
Yes, secured by temporary protection and restricted admin access. We transfer orders placed until the switchover into the new shop.
If personal data is affected and there is a high risk for the people concerned, Art. 24 of the Swiss Data Protection Act requires a report to the FDPIC as soon as possible. Operators of critical infrastructure must also report cyberattacks to the BACS within 24 hours. This answer is general information and not legal advice.
Anyone who accepts card payments must comply with the PCI DSS requirements that the payment provider sets out in the contract. A known, unfixed vulnerability on the shop server can breach these obligations.
That depends on the policy terms. Many policies require security updates to be installed promptly. Check your obligations in the contract.
Next step
In the shop security check we look at your shop, server and interfaces together. You get an honest assessment of whether a PHP update is enough or whether an express relaunch in 2 to 4 weeks is the better way.
Free of charge and without obligation. We usually reply on the same working day.
