A security flaw affects PrestaShop shops: what to do now

On 21 October a serious security flaw was fixed in PHP. PHP is the program on the hosting server that runs PrestaShop shops: it works on every page load. The flaw does not depend on the shop's settings, so it can affect any PrestaShop shop, small ones too.

An important difference: it is not PrestaShop that does or does not get a fix, it is PHP. The PHP project released official fixed versions only for the PHP versions it still supports; fixes for older PHP come from Linux distributions and long-term support (LTS) vendors. Each PrestaShop version, however, supports only certain PHP versions, so the PrestaShop version decides whether an official fixed PHP can run under the shop, or a fixed build of the old PHP is needed.

What does this mean in practice?

Through the flaw an attacker can get in without logging in, with a simple request, and in the worst case run their own program on the server. Customer data, orders and the shop itself can then be at risk.

According to security companies, the flaw is already being used in attacks, so it is worth dealing with now.

Which PHP has a fix?

• PHP 8.2, 8.3, 8.4 and 8.5: an official fixed release exists (8.2.35, 8.3.36, 8.4.27, 8.5.12). The hosting provider simply updates these.
• PHP 7.4, 8.0 and 8.1: no official new release. The PHP security team published a patch, and Linux distributions and LTS vendors provide their own fixed packages. The hosting provider can fix the old PHP with one of these.
• PHP 7.3 and older: no fix from the PHP project, not even a patch. Some Linux distributions (for example AlmaLinux, Ubuntu with extended support) and LTS vendors fixed their own old PHP packages; whether such a PHP runs on the server, the hosting provider can tell.

If the fix cannot go in right away, the PHP advisory also describes temporary settings that reduce the risk but do not remove it. The hosting provider can set these.

Since then, hosting platforms have shipped patched packages for older PHP versions too; cPanel, for example, did so for PHP 8.1 on 20 October 2026. The version number does not change (patched PHP 8.1 still reports 8.1.34), so the fix cannot be read from the version number: ask your hosting provider.

Which PrestaShop runs on which PHP?

The “newest PHP it supports” column comes from PrestaShop’s own system requirements (sources at the end of the article).

In short, by version:

• PrestaShop 9 Runs on an official fixed PHP release. It is enough if the hosting provider updates PHP to the fixed release. If the shop still runs on PHP 8.1, it has to move to 8.2 or newer first; PrestaShop 9 supports this.
• PrestaShop 8 and 1.7.8 Does not run on an official fixed PHP release, because the newest PHP it supports (8.1 and 7.4) no longer gets new releases. Here a fixed build of the old PHP protects: the patch, or the fixed package of a Linux distribution or LTS vendor. If that is in place on the server, the shop is protected against this flaw. In the long run, upgrading to PrestaShop 9 gives a PHP that the PHP project fixes itself.
• PrestaShop 1.7.7 and older, 1.6 Supports PHP 7.3 at most, for which the PHP project gives no fix at all, not even a patch. Protection comes from the PHP on the server having been fixed by the Linux distribution or an LTS vendor; the hosting provider can tell. In the long run, here too, upgrading to PrestaShop 9 gives a PHP that the PHP project fixes itself.

How do I see which version I have?

In the PrestaShop admin, on the Advanced Parameters > Information page. It shows the PrestaShop version and the PHP version. The PrestaShop version number is also shown in the top left corner, next to the logo.

If unsure, the shop address is enough when applying for the upgrade; we check the version.

If PHP is fixed, is the shop safe?

From the PHP flaw, yes. But PrestaShop and its modules have flaws of their own that a PHP fix does not touch. Two matter most right now, because they can be exploited without logging in:

• Faceted Search filter module (10/10): in versions 3.0.0–4.0.3 a single request can run code on the server when the filters include a price or weight slider. Fix: version 4.0.4 of the module.
• Contact form (9.3/10): a submitted message can hand over the back office when a staff member opens it. It affects every PrestaShop before 8.2.6 and 9.0.0–9.1.0. Fix: 8.2.6, 9.1.1 or the official hotfix module.

These flaws sit in the shop's own files, and the hosting provider does not fix them. Details, the other affected modules and how to fix an old PrestaShop: Critical PrestaShop vulnerabilities: what needs fixing on your shop now.

What to do now

There are three separate tasks: fixing PHP now (the host), fixing the flaws in PrestaShop and its modules now (the shop), and upgrading an old PrestaShop as a planned project.

1. Check the versions on the page above: PrestaShop and PHP.
2. Ask the hosting provider in writing whether the PHP running under the shop has received the October security fix (an official fixed release, the patch, or the fixed package of the distribution or LTS vendor).
3. Fix the critical flaws in PrestaShop and its modules on the shop: Faceted Search at 4.0.4 or later, and the contact form flaw fixed by updating or with the official hotfix module.
4. Plan the upgrade to PrestaShop 9 if the shop runs an older version. Only PrestaShop 9 runs on a PHP that the PHP project fixes itself; under an older PrestaShop, every future PHP flaw means waiting for a fix from the distribution or an LTS vendor. The upgrade touches the theme, the modules and the data, so it is prepared on a test copy first and goes live only after checking. You can apply for the upgrade on the PrestaShop upgrade page.

Frequently asked questions

Sources: PHP security advisory, Tenable, php.net, AlmaLinux, Ubuntu, system requirements of PrestaShop 9, PrestaShop 8, PrestaShop 1.7, Faceted Search advisory and Contact form advisory