The Emergency PHP Security Patch: What Online Store Owners Need to Check Right Now

If your inbox filled up this week with urgent warnings from your hosting company, Adobe Commerce, Shopware, or BigCommerce, you were watching one of the biggest internet-wide security scrambles in years.

An emergency security flaw, widely referred to in the industry as PHP2Shell, hit PHP, the software engine that powers roughly 70% of websites across the internet. If your store runs on Adobe Commerce (Magento), WooCommerce, Shopware, or OroCommerce, it runs on PHP. Because details of the flaw leaked out a day early, US and European cybersecurity agencies took the rare step of telling organizations to either apply the emergency patch immediately or pull their websites offline until they could.

I was at the Cloudflare Connect conference in San Francisco when the news broke and made the morning keynote. While I was on the conference floor, our engineering team was already back home patching our managed client stores.

You do not need a computer science degree to protect your store this week, but you do need to know what to ask the people who manage your site, and how to make sure an emergency security setting has not quietly broken your checkout.

Why “we updated your plugins” is not enough

When a security alert hits, the most common reassurance a store owner hears from a web agency is: “Don’t worry, we updated all your plugins and extensions.”

This time, that will not protect you.

Think of your online store like a delivery truck. Your theme, your checkout extensions, and your platform (Magento, WooCommerce, or Shopware) are the body and the cargo area. PHP is the engine underneath the hood. This week’s flaw is inside the PHP engine itself. Left unpatched, it can let an outside attacker run unauthorized code on your server without ever logging in, putting customer data and your checkout page at risk.

Updating your store’s plugins or extensions without updating the PHP engine on your server leaves the front door unlocked. Your hosting provider or engineering team has to update PHP itself on the server and restart it so the new version is actually running.

The hidden revenue trap: how emergency firewall rules can break “Add to Cart”

Here is the business risk nobody puts in the security alert: the emergency settings some hosts are turning on to block attackers can stop real customers from buying.

While waiting to apply the full server patch, many hosting providers and security teams turned on temporary firewall rules that block large or complex form submissions. That sounds harmless until you look at how ecommerce platforms work.

On Magento, Shopware, and WooCommerce, clicking “Add to Cart” on a product page (especially a product with size, color, or custom options) sends a multi-part form request to your server. Several security advisories this week included example firewall limits that were far too strict for a real online store. When a host or developer copies those example numbers straight into production, a shopper who picks a size and clicks “Add to Cart” gets an error page instead of their shopping cart.

Even if your agency told you your store is patched and protected, go to your live store right now on your phone and desktop and test three things:

1. Pick a product with multiple options (such as size, color, or a bundle) and click Add to Cart.
2. Create or log into a customer account and walk all the way through Checkout.
3. Have someone on your team test uploading a product image or CSV in your store admin panel.

If any of those steps stalls or throws an error, ask your host or agency to adjust their new firewall upload limits right away.

What if your store runs on an older version of PHP?

Not every store can be patched with a single click this week, and this is where store owners get caught off guard.

The official emergency patch was only released for newer, actively supported versions of PHP (versions 8.2 through 8.5). Many established Magento and WooCommerce stores still run on PHP 8.1 or older because upgrading would require updating an older theme or custom checkout integration.

If your store is on PHP 8.1 or an older version, a standard update will not automatically fix the problem. Your hosting company either has to apply a special custom security patch for older servers, or your development team needs to move your store onto a supported version of PHP while keeping a protective firewall (such as Cloudflare’s WAF) in front of your site.

One more detail we found while patching servers this week: even when a live store was running on a newer, patched version of PHP, we found an older or unused copy of PHP still sitting on the same server from a past setup. Leaving an unused, unpatched copy of PHP on the server is like locking your front door while leaving a spare key under the mat. Make sure your team removes any unused versions of PHP from the server completely.

Four questions to send your agency or hosting provider today

You can copy and paste these four questions into an email or Slack message to whoever manages your store. Here is what to ask, and how to read their reply:

What about Shopify and BigCommerce stores?

If your store runs on a hosted SaaS platform like Shopify or BigCommerce, the core checkout and storefront servers are managed by the platform. BigCommerce sent a partner notice this week confirming they patched their own systems immediately.

However, you still have one thing to check: custom apps, middleware, and staging tools. Many Shopify and BigCommerce merchants have a custom PHP app sitting on a separate server that syncs inventory with an ERP, generates custom PDF quotes, or powers a dealer portal. If your business has any custom connectors or portals running on your own cloud account, ask your developer to check those servers too.

The short version

Do not settle for “we updated your plugins.” Ask your hosting provider or agency to confirm in writing that the PHP engine on your server was updated and restarted, verify that no unused copies of PHP were left behind on the box, and walk through a real Add to Cart and checkout on your live store today to make sure emergency firewall rules are not blocking your customers.

Key takeaways

• This week’s flaw is in the server engine, not your plugins. Updating Magento, WooCommerce, or Shopware extensions alone does not protect your store.
• Emergency firewall settings can block shoppers. Overly strict form limits added during the scramble can break the “Add to Cart” button on products with options. Test your live cart and checkout today.
• Older stores (PHP 8.1 and below) need extra attention. They do not get the standard one-click update and require a verified host patch or an upgrade plan.
• Clean up leftover server software. Even if your live store runs a patched version of PHP, any unused PHP versions sitting on the server should be removed.
• Shopify and BigCommerce merchants should check custom integrations. Your main storefront is covered by the platform, but custom ERP connectors or dealer portals hosted on your own servers still need to be checked.

FAQ

Does updating our Magento, WooCommerce, or Shopware plugins fix this PHP security issue? No. The vulnerability sits in the underlying PHP engine on your web server, not in your store’s theme or plugins. Your hosting provider or development team must update PHP itself on the server (to version 8.2.35, 8.3.36, 8.4.27, or 8.5.12) and restart the server processes for the fix to take effect.

Why did our “Add to Cart” button stop working after our host added security protection? Many hosts turned on emergency firewall filters that block form submissions with more than a handful of fields. Because adding a product with options to the cart in Magento, Shopware, or WooCommerce sends a multi-field form request under the hood, overly strict default firewall settings can mistake a normal shopper for an attack and block the cart. Ask your host to raise the limit for ecommerce traffic and test your cart immediately.

How do I know if my store is on an older version of PHP that did not get the standard update? Ask your hosting provider or developer what version of PHP your live store is running today. If the answer starts with 8.2, 8.3, 8.4, or 8.5, an official update is available now. If your store runs on PHP 8.1, 8.0, or 7.4, there is no standard release from the PHP team, so your host must confirm they applied a custom backported fix or help you upgrade to a supported version.

Is Cloudflare enough to keep our store safe while we wait to patch? Cloudflare automatically rolled out firewall rules that block known attacks against this flaw, even on free plans. That gives store owners a valuable shield while their team schedules the server update, but both Cloudflare and government cybersecurity agencies emphasize that a firewall is a temporary shield, not a replacement for updating PHP on your server.

Are Shopify and BigCommerce stores affected by the PHP patch scramble? Your main Shopify or BigCommerce storefront and checkout are managed by the platform, so you do not need to patch them yourself. You only need to check if your business runs separate custom PHP applications on your own servers, such as a WordPress blog on a subdomain, a custom dealer portal, or middleware that connects your store to your ERP or warehouse.

Want a second set of eyes on your store?

If you are getting vague answers from your hosting provider, if your store is stuck on an older version of PHP, or if you want an experienced ecommerce engineering team to verify that your server and checkout are clean, we are happy to help.

Schedule Free Consultation

Paul Byrne is President of Razoyo, a software and ecommerce engineering firm in The Colony, Texas helping merchants and founders run reliable production systems since 2011.