Magento (Adobe Commerce) runs on PHP, so a Magento site is affected by PHP2Shell if its server runs PHP older than the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). Updating Magento itself doesn't fix it; your host or developer updates PHP. Adobe's system requirements list PHP 8.5 for 2.4.9, PHP 8.3 and 8.4 for 2.4.8, and PHP 8.2 and 8.3 for 2.4.7.
- Magento (Adobe Commerce) runs on PHP
- Yes
- newest fixed release
- 8.5.12
Is Magento (Adobe Commerce) affected by PHP2Shell?
Magento Open Source and Adobe Commerce are written in PHP. Each 2.4.x release supports specific PHP versions, so stores often need a Magento update to move PHP forward. PHP2Shell is a flaw in PHP itself, not in Magento (Adobe Commerce), so updating Magento (Adobe Commerce) or its plugins doesn't fix it. A Magento (Adobe Commerce) site is affected if its server runs PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12), released October 21, 2026.
How to see your PHP version in Magento (Adobe Commerce)
- Magento's admin doesn't show the PHP version.
- Look in your hosting panel's PHP settings, or ask your developer to run
php -von the server. - Or send your host the ready-made email from your PHP Scanner result.
Who updates PHP for a Magento (Adobe Commerce) site
Usually your developer or a Magento-focused host. Stores on Adobe Commerce cloud get PHP through Adobe's environment configuration.
Guides for common hosts: Cloudways, cPanel.
Which PHP version Magento (Adobe Commerce) supports
Adobe's system requirements list PHP 8.5 for 2.4.9, PHP 8.3 and 8.4 for 2.4.8, and PHP 8.2 and 8.3 for 2.4.7. Whatever the line, use its newest release: for PHP2Shell that means 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later.
What PHP Scanner looks for on a Magento (Adobe Commerce) site
PHP Scanner recognizes Magento (Adobe Commerce) from Magento cookies such as mage-cache-sessid, Magento headers such as X-Magento-Tags, Magento scripts in the page (text/x-magento-init). Many Magento (Adobe Commerce) servers hide their PHP version, which is good practice; then your result asks you to paste the version from the steps above for an exact rating.
Questions people ask
Is my Magento (Adobe Commerce) site safe from PHP2Shell?
No outside check can promise that. What you can confirm is that its PHP is a fixed release (8.2.35, 8.3.36, 8.4.27, 8.5.12) or newer. If it is, PHP2Shell's fix is in.
Does updating Magento (Adobe Commerce) fix PHP2Shell?
No. PHP2Shell is in PHP, which your host or developer updates. Keep Magento (Adobe Commerce) updated as well, but it's a separate job.
What PHP version should Magento (Adobe Commerce) run?
Adobe's system requirements list PHP 8.5 for 2.4.9, PHP 8.3 and 8.4 for 2.4.8, and PHP 8.2 and 8.3 for 2.4.7. Use the newest release of whichever line you're on.
My host says PHP is up to date but the version looks old. Why?
Some hosts and Linux distributions add security fixes without changing the version number. Ask your host to confirm in writing that the PHP2Shell fix is applied.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.