For PrestaShop, PHP2Shell remediation requires patching the PHP runtime. The application version helps identify compatibility blockers; it cannot establish exploitability or prove that either CVE is fixed.
PrestaShop - PHP compatibility for the PHP2Shell fix
| Release sample | Declared PHP requirement | Declared patch candidates | Original source |
|---|---|---|---|
| 9.0.0 | >=8.1 | raw.githubusercontent.com ↗ | |
| 8.2.0 | >=7.2.5 | raw.githubusercontent.com ↗ | |
| 8.1.0 | >=7.2.5 | raw.githubusercontent.com ↗ | |
| 8.0.0 | >=7.2.5 | raw.githubusercontent.com ↗ | |
| 1.7.8.11 | ^7.1.3 | None of these patch baselines matches ↗ | raw.githubusercontent.com ↗ |
Candidates match only this declaration against the first PHP2Shell fixes on supported branches. They do not establish tested compatibility, vendor support or a complete dependency match. PHP compatibility for the PHP2Shell fix ↗
Identify the PHP2Shell repair scope
Files and package identity
composer.lockapp/config/modules/themes/
PrestaShop - Remove blockers to patch PHP2Shell
PrestaShop’s composer.json minimum is not its full tested-PHP matrix. Check the target release documentation, Symfony dependencies, payment modules, theme and overrides together. Test Update Assistant on a database copy and verify multistore behavior and order history. Keep a matching files-and-database rollback; reverting the PHP selector does not undo a shop schema migration.
Dependencies and custom code to review
Official upgrade documentation ↗PrestaShop - PHP compatibility for the PHP2Shell fix ↗Check site functions after the PHP2Shell fix
Inventory before fixing PHP2Shell
Use an authorized working copy.
php -v
php --ini
php -m
composer --no-plugins check-platform-reqs --lockPrestaShop - PHP2Shell patch verification
Verify both CVE fixes in the PHP actually serving this site. Replace or restart old Web workers, queue workers and replicas. A working homepage or a newer CLI binary is insufficient evidence.
3. Restart and verify every instance ↗