Security notice · 23 October 2026
PHP2Shell:Payshen is not affected.
PHP's critical security release of 21 October 2026 fixes two flaws in PHP itself. No Payshen system runs PHP, and no Payshen system or data was exposed. If your own store or backend runs PHP, update it today.
The notice
Four things to know.
- 01
What happened
On 21 October 2026 PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, rated 9.2). On a server that handles web requests with an unpatched PHP, anyone can run code of their own, without signing in and before any application code runs. The flaws are being exploited, and PHP says updating is the only safe fix.
- 02
Payshen was not affected
No part of Payshen runs on PHP: not the API, the dashboard, the payment pages, webhooks or the routing engine. No Payshen system was exposed, and no merchant or customer data held by Payshen was at risk. There is nothing to change in your Payshen account and no key to replace.
- 03
Our PHP SDK and WooCommerce plugin
Neither contains affected code: the flaws are in PHP's own request handling. Both run on your servers, though, so they are only as safe as the PHP under them. The PHP SDK 0.2.0 and the WooCommerce plugin 1.1.0 require PHP 8.2 or newer and are tested on PHP's patched releases. The plugin's settings page warns when your server's PHP may be missing the fix.
- 04
What to do if you run PHP
Update PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or install your Linux distribution's patched package. On managed hosting, ask your host whether the fix is applied. PHP 8.1 and older get no official fix: move to a supported version. Every server that runs PHP for web requests needs it, whether or not it talks to Payshen.
PHP's own advisory: php.net. Questions, or something that looks wrong: report it to us.