Is Shopify Affected by PHP2Shell? What Shopify Store Owners Need to Know
Share
Updated 22 October 2026.
Short answer: if your ecommerce storefront runs on standard hosted Shopify, PHP2Shell is not an update you install in Shopify Admin. The newly disclosed vulnerabilities, CVE-2026-109618 and CVE-2026-109619, affect vulnerable PHP runtimes serving web requests. Shopify themes use Shopify's Liquid template language, and merchants do not manage a PHP version for the hosted Shopify storefront.
That does not mean every system connected to a Shopify business can be ignored. A WordPress blog, an old WooCommerce site, custom middleware, a separately hosted landing page or another PHP-based application can still need attention.
If you run WordPress, WooCommerce or another PHP-based website as well as Shopify, read the full PHP2Shell guide for UK website owners.
What is PHP2Shell?
PHP2Shell is the name being used for two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0 and can allow unauthenticated remote code execution in vulnerable PHP environments.
The PHP project released fixed versions on 21 October 2026:
| PHP branch | Fixed version |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
PHP 8.1 and older are outside normal upstream security support, although some operating-system and long-term-support vendors may backport patches. The official PHP advisory says updating is the only complete solution.
Is Shopify itself affected by PHP2Shell?
For a normal Shopify merchant, the practical answer is: there is no PHP runtime in Shopify Admin for you to identify, upgrade or patch.
Shopify documents Liquid as the template language used to build Shopify themes. Your theme code, products and settings are managed through Shopify rather than through a web-hosting control panel where you select a PHP version.
This is therefore different from WordPress or WooCommerce, where the site normally runs on a PHP runtime supplied by a web host and the site owner or host needs to make sure that runtime is patched.
This article is about what a Shopify merchant needs to do. It is not a statement about every technology Shopify may use internally, and it is not a Shopify security advisory.
What should Shopify store owners actually check?
The useful question is not just “Is my Shopify store affected?” It is “Does my business use any other internet-facing system that runs PHP?”
1. A WordPress blog on a subdomain
It is common for a Shopify store to use WordPress for editorial content on a separate domain or subdomain. That WordPress installation uses PHP and should be checked independently.
Examples include blog.example.co.uk, journal.example.co.uk or an old WordPress installation that still receives traffic.
2. An old WooCommerce store that still exists
If you migrated from WooCommerce to Shopify, check whether the old site, a staging copy or an archive is still publicly reachable. WooCommerce runs on WordPress, so the underlying PHP version matters even if the old store no longer takes orders.
3. Custom middleware and integrations
A developer may have built a separate service between Shopify and your ERP, CRM, warehouse, booking system or supplier. If that service is self-hosted and written in PHP, whoever maintains it should check the runtime.
4. Landing pages, microsites and booking sites
Marketing teams often accumulate separate pages outside the main ecommerce platform. A campaign microsite, a lead-generation site or a booking portal may run on WordPress or another PHP application even when the main store is Shopify.
5. Third-party apps and SaaS tools
You normally cannot patch the infrastructure behind a third-party Shopify app yourself. If a critical tool publishes a security notice, follow the vendor's guidance. Do not assume an app is vulnerable simply because PHP is widely used, and do not uninstall revenue-critical apps based on speculation.
A five-minute Shopify-owner checklist
- Confirm the main store: if it is a standard hosted Shopify storefront, there is no PHP version for you to update in Shopify Admin.
- List everything around it: blogs, microsites, booking systems, old stores, staging sites and custom integrations.
- Identify PHP systems: ask the relevant host or developer whether any of those systems run PHP.
- Get the exact version: if they do, ask whether the PHP2Shell fixes for CVE-2026-109618 and CVE-2026-109619 have been applied.
- Prioritise public systems: the UK National Cyber Security Centre advises organisations to identify affected PHP systems, prioritise internet-facing services and apply updates promptly.
If you migrated from WooCommerce to Shopify, check the old site
This is the scenario I would pay particular attention to. A Shopify migration can leave behind an old WordPress installation, staging URL or developer copy that nobody actively maintains. It may no longer appear in the navigation, but if it is still online it can still be scanned and attacked.
Ask whoever manages your domains and hosting:
We now run the main store on Shopify. Do we still have any public WordPress, WooCommerce, staging or custom PHP sites on our domains or hosting account? If yes, please confirm the exact PHP version and whether CVE-2026-109618 and CVE-2026-109619 are patched.
Does updating a Shopify theme fix PHP2Shell?
No. A Shopify theme update and a PHP runtime security update are different things. Shopify theme code uses Liquid, HTML, CSS and JavaScript at the storefront layer. PHP2Shell concerns vulnerable PHP runtimes serving web requests.
If your separate WordPress or WooCommerce site is affected, updating the Shopify theme does nothing to patch that server.
Do Shopify apps need updating?
Only follow an app vendor's instructions if the vendor says action is required. Shopify apps can be built with many different technology stacks, and merchants usually do not control the vendor's server runtime.
The right response is to check notices from genuinely critical suppliers rather than trying to guess which programming language every app uses.
What if I am not sure what is connected to my Shopify store?
That uncertainty is worth fixing even after this security story passes. A simple map of the store, domain, apps, analytics, feeds, landing pages and external systems makes future incidents much easier to respond to.
I am not a cybersecurity incident-response provider. If you suspect a compromise, contact your host or a qualified security specialist. If the problem is that nobody is quite sure what sits around the Shopify store, I can help you untangle the ecommerce side and identify what needs an owner.
Book a free 20-minute call with Mind the Shop or, for a wider Shopify configuration check, see the 20-point Store Health Check.
Frequently asked questions
Is Shopify affected by PHP2Shell?
A standard Shopify merchant does not manage a PHP runtime for the hosted Shopify storefront, so there is no PHP version to patch in Shopify Admin. Separate systems connected to the business, such as WordPress, WooCommerce or custom PHP applications, should be checked independently.
Does Shopify use PHP for themes?
Shopify documents Liquid as its theme template language. Theme code is not updated by changing a PHP version in Shopify Admin.
Is WooCommerce affected by PHP2Shell?
WooCommerce runs on WordPress, which uses PHP. The vulnerability is in PHP rather than WooCommerce itself, so the PHP runtime serving the WooCommerce site needs to be checked and patched.
What should I do if my old WordPress site is still online?
Ask the host or developer for the exact PHP version and confirmation that CVE-2026-109618 and CVE-2026-109619 are fixed. If the old site is no longer needed, discuss taking it offline properly rather than leaving an unmaintained installation exposed.