PrestaShop modules and core updates ship PHP files. The store remains exposed while the old PHP handler is selected.
What to look at
The back office advanced parameters page reports a PHP version. On shared hosting that string is the one to send the host. On a VPS, map it to the FPM pool yourself.
Remediation
Apply the distribution or host fix, restart PHP, and load the front office and a checkout. PrestaShop 1.6 era stores are often stuck on old PHP. That is a legacy remediation project: vendor backport if it exists, otherwise a planned upgrade of both the app and the runtime.
Nginx or Apache in front of PrestaShop is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating PrestaShop fix PHP2Shell?
No. PrestaShop runs on PHP. The PHP binary or package that serves it has to be patched or replaced.