PHP Site AuditAdobe Commerce
How should Magento and Adobe Commerce sites handle PHP2Shell?
Adobe Commerce depends on a release-specific set of PHP, database, search, cache, and queue services. Before changing PHP, compare the proposed runtime with Adobe’s system requirements for the exact Commerce release and identify whether Adobe, a cloud provider, or your operations team controls that service. Then request the appropriate package/advisory and restart evidence, and test storefront, Admin, checkout, queues, and integrations in staging.
Check the full Commerce compatibility matrix
Commerce compatibility depends on the exact Commerce patch release and its tested service configuration. Adobe’s system-requirements page distinguishes Commerce on Cloud from on-premises deployments and lists dependencies such as PHP, database, search, Redis, and message-broker versions. A change that looks like a routine PHP update can still intersect with extensions, custom modules, CLI tooling, indexers, or deployment images. Check the table for the installed Commerce release before choosing a target runtime.
Keep the PHP runtime in its service context
Do not assume that a runtime accepted by one Commerce patch line is supported by another, and do not copy a version from a different environment. A lower-risk security backport may be offered by the platform vendor, while an upstream runtime move can change compatibility. The PHP project advisory establishes upstream fixes; Adobe or the service owner establishes the supported combination and the package actually deployed.
Identify the operator for each layer
Write down whether this is Adobe Commerce on Cloud or an on-premises installation; the Commerce release and patch level; the production and staging environment names; and who controls PHP, database, search, cache, and queue services. On Cloud infrastructure, Adobe’s documentation notes that hosted service versions are selected and tested in that environment. For some changes, an application repository edit alone does not perform the service upgrade; follow the platform’s supported process and support channel.
Request service-specific patch evidence
A useful support request asks the operator to state the exact environment, PHP service/package or image revision, the vendor advisory covering CVE-2026-109618 and CVE-2026-109619, whether the fix is a backport, the planned deployment window, and how service restart or replacement will be confirmed. Ask whether CLI jobs, cron, consumers, and web nodes use the same image or service definition. Do not assume that an Admin display or one web request represents all Commerce processes.
Test storefront, Admin, and background operations
In staging, reproduce the proposed service configuration and deploy the same Commerce code and extensions planned for production. Use the team’s release runbook to check compilation, static content, indexers, cron, message consumers and cache behavior. Exercise a customer path from product detail through cart and checkout using a safe payment sandbox, and confirm order creation and notifications. Check Admin login and a representative administrative task, not just a successful homepage response.
After production rollout, compare service inventory and change records to the approved compatibility set. Confirm web and CLI tasks use the expected PHP package, observe healthy queues and scheduled jobs, and review application and infrastructure errors. If a staging test omits a connected payment, search, or fulfillment service, record that limitation. A public HTTP scan cannot inspect the Commerce package, internal consumers, or hosted service configuration, and cannot certify the patch.
Include a named rollback decision-maker and the Commerce platform support contact in the change plan. Code rollback, service rollback and database restoration are different actions and can affect orders differently. If compatibility fails, preserve the release identifiers and service inventory, then ask the platform owner for the supported recovery path before changing multiple dependencies.
Common questions
Can I choose any PHP version listed as supported by PHP?
No. Match the exact Commerce release and deployment type to Adobe’s supported service matrix and your platform operator’s package options.
Who updates PHP on Adobe Commerce Cloud?
Responsibility depends on the environment and service. Identify the control owner and follow Adobe’s documented Cloud process for hosted services.
Does a healthy storefront prove every Commerce process was updated?
No. Web nodes, CLI jobs, cron and consumers may use separate images or runtimes; confirm each relevant path.