Short answer: no. YouParcel's fulfillment application does not run on PHP, so the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) do not affect it. Our website, www.youparcel.com, does not run on PHP either. This update explains what PHP2Shell is, why it matters for ecommerce operations, and what to check if your own store or tools use PHP.
- What: PHP2Shell is the name for two critical flaws in the PHP runtime, disclosed in October 2026, that can let an unauthenticated attacker run code on a server with a crafted web request.
- YouParcel: our fulfillment application and website are not built on PHP and are not affected.
- Your store: many ecommerce platforms and plugins do run on PHP, including WooCommerce, Magento (Adobe Commerce) and PrestaShop. If you use one of them, check that PHP has been updated.
- The fix: PHP released patched versions on October 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What is PHP2Shell?
PHP2Shell refers to two vulnerabilities in the core PHP runtime:
- CVE-2026-109618: remote code execution through memory corruption during request cleanup.
- CVE-2026-109619: remote code execution through request state that is reused by a later request on the same worker.
Both are rated critical because they can be exploited without logging in. Any public-facing server running an unpatched PHP version should be treated as at risk until it is updated.
Is YouParcel affected?
No. The application that runs our fulfillment operations (receiving, inventory, order processing, picking, packing and shipping) is not built on PHP. The PHP runtime flaws described in the PHP2Shell advisories therefore do not apply to it, and no action is needed from our customers for their YouParcel account.
Not using PHP does not remove every security risk, and we do not treat it that way. We keep our software and infrastructure up to date, limit system access to the people who need it, and continue to monitor the third-party services we rely on.
Does your online store use PHP?
This is where PHP2Shell is most likely to touch an ecommerce business. Popular self-hosted platforms such as WooCommerce, Magento and PrestaShop run on PHP, as do many WordPress sites, plugins and admin tools. Hosted platforms such as Shopify manage their own servers, so there is nothing for merchants to patch there.
What to do if you run PHP
- Find every PHP installation. Include your store, staging sites, WordPress blogs, plugins, internal admin tools and containers, not only the main site.
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later), following the official PHP release notes. On managed hosting, ask your provider to confirm the update.
- Check your logs for unusual requests or new admin users around the disclosure date.
- Rotate API keys if you suspect a compromise. This includes the keys that connect your store to your 3PL, marketplaces and payment providers.
Frequently asked questions
Is my YouParcel account affected by PHP2Shell?
No. YouParcel's fulfillment application does not use PHP, so CVE-2026-109618 and CVE-2026-109619 do not apply to it.
My store runs on WooCommerce or Magento. Can orders still reach YouParcel?
Yes. The integration keeps working as usual. Updating PHP on your store protects your store itself; it does not change how orders flow to our warehouse.
Who can I contact with questions?
Your YouParcel account team, or our team through the contact page.
.webp)
.svg){kind=small}