PHP2Shell and WooCommerce Security: What Ecommerce Brands Need to Know
Two critical PHP flaws put WooCommerce stores at risk last week. The patch is the easy part. The harder question is who should own your tech stack at all.
PHP2Shell is a flaw in PHP itself, and CISA now confirms it's being exploited. Updating WooCommerce or plugins doesn't fix it; updating PHP does.
Shopify merchants have no PHP to patch. Shopify runs the servers.
It's not a reason to panic-migrate. It is a good moment to price out what running your own stack really costs.
On October 21, 2026, the PHP team released emergency fixes for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and known as PHP2Shell. Both received a CVSS v4.0 severity score of 9.2 out of 10. These vulnerabilities can allow unauthenticated attackers to execute code on affected servers. Store owners should check the official PHP security advisories and confirm that their hosting environment has been updated.
This isn't theoretical. Attackers were probing for it four days before disclosure. On October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog and gave federal agencies until October 29 to patch. Meanwhile, Censys counted just over 10 million of 42 million internet-facing PHP services patched.
If your store runs on WooCommerce or custom PHP, you've hopefully patched by now. But PHP2Shell raises a question that outlasts the patch:
Should a growing e-commerce brand have to think about the programming language under its store at all?
It's a PHP problem, not aWooCommerce problem
Let's be fair. PHP2Shell is a flaw in the PHP runtime, not in WooCommerce or WordPress. Fixed versions are already out (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). A WooCommerce store on patched, well-run hosting can be perfectly secure.
But the incident shows how self-hosted commerce really works. Your store's security doesn't rest on your ecommerce software alone. It rests on your PHP version, server setup, hosting provider, plugins, theme, integrations, and whoever is responsible for each one.
Every one of those is a dependency someone has to manage.
Who carried that load varied. WooCommerce says stores on Automattic's managed hosting (WordPress.com, WordPress VIP, Pressable) were already protected. Self-hosted stores were on their own.
And one patch isn't the end of it. Two days after the fix, PHP disclosed a third remote code execution flaw (CVE-2026-115560) that launched with a workaround rather than a patch.
Quick check: if your store still runs PHP 8.1 or older, it no longer receives official security fixes. That's worth a call to your developer today.
You're in the business of selling, not server maintenance
A founder's attention belongs to the brand, the customer experience, conversion, retention and new markets.
Instead, it often goes here:
A PHP update that needs compatibility testing
A plugin update that breaks checkout
An extension that clashes with the theme
A server slowdown in the middle of Black Friday
A developer ticket for what should be a simple storefront change
Each one looks minor. Together, they're a recurring tax on growth.
The real cost of an ecommerce platform isn't what you pay to launch it. It's what you spend keeping it running.
How Shopify splits the work differently
WooCommerce gives you flexibility and control, especially if you're invested in WordPress. That flexibility comes with decisions about hosting, infrastructure and updates.
Shopify is fully hosted, and its core platform runs on Ruby on Rails, not PHP. Shopify maintains the servers, so there's no PHP runtime for you to update. Hosting, TLS encryption and PCI DSS Level 1-compliant infrastructure are built in.
You still own some security: staff access and the apps you install. Many Shopify apps run on their developers' own servers, and plenty of those use PHP, so an app audit belongs in any migration. What changes is the division of labour. Your team spends less time maintaining infrastructure and more time growing the store.
Setup | Who patches PHP and the server | What stays with you |
Self-hosted WooCommerce (VPS, cloud, cPanel) | You or your developer | PHP, server, plugins, theme, integrations |
Managed WooCommerce hosting | Your host | Plugins, theme, extensions, integrations |
Shopify | Shopify | Staff access, installed apps, integrations |
The cost difference can be significant. A Shopify-commissioned study of North American merchants found that WooCommerce businesses spent 41% more on operations and support, on average. As this research was commissioned by Shopify, actual costs may differ depending on hosting, integrations, developer support and store complexity. Use this figure as a starting point to calculate your own ecommerce operating costs.
A free platform isn't the same as a low-cost platform.
Should every WooCommerce store move to Shopify?
No. PHP2Shell alone isn't a reason to migrate. If your store is secure, well maintained, cost efficient and doing its job, stay put.
But if technical friction keeps slowing you down, it's time for a platform review. Ask yourself:
Are updates, plugins and hosting issues eating time and budget meant for growth?
Can your team launch a campaign or update merchandising without filing a developer ticket?
Will your platform handle your next stage: new integrations, new markets, higher volume?
Do you know what your ecommerce tech actually costs you per year?
If any answer makes you wince, a migration assessment is worth an hour of your time. Not because WooCommerce is obsolete, but because your business has changed.
A good migration protects what you've built
Moving to Shopify isn't copying a product catalog. It means carrying over everything your revenue depends on:
Products, customers and order history
SEO rankings, URL structure and 301 redirects
Analytics, payment gateways and sales tax settings
Inventory, ERP and fulfilment integrations
The day-to-day workflows your team relies on
Some pieces need special handling. Customer passwords can't be transferred, so customers will need to reset them. Some custom integrations have to be rebuilt.
Timing matters too. Never cut over during Q4 peak.
For most US brands, a January to March launch gives you a clean runway before the next holiday season.
Done well, a migration is also a chance to fix what's been holding you back: site structure, mobile experience, checkout and conversion.
Does PHP2Shell affect WooCommerce stores?
PHP2Shell can affect WooCommerce stores running vulnerable, unpatched PHP versions. Updating WooCommerce or plugins alone does not fix PHP runtime vulnerabilities. Ask your hosting provider or developer to verify the installed PHP version and confirm that the appropriate security fix has been applied.
Is Shopify affected by PHP2Shell?
Shopify's core hosted platform does not require merchants to patch its underlying PHP runtime. However, third-party apps, external integrations and separately hosted systems may have their own security risks that need to be assessed.
How do I check my WooCommerce store's PHP version?
In your WordPress admin, go to Tools > Site Health > Info > Server. Then confirm with your host that the PHP2Shell fix is installed and PHP has been restarted.
Should I migrate to Shopify because of PHP2Shell?
Not on its own. Migrate if maintenance, plugin conflicts and developer costs are slowing your growth. PHP2Shell is a good prompt to measure that.
Will I lose SEO rankings if I move from WooCommerce to Shopify?
Search rankings can fluctuate after a migration, even when it is planned properly. Reduce the risk by mapping old URLs to relevant new URLs with 301 redirects, preserving important metadata and content, testing the new site's indexability, and monitoring Google Search Console after launch.
Why brands move to Shopify with Purplechalk
Purplechalk is a Shopify Select Partner, recognised by Shopify for building and growing stores on its platform.
Platform migration is core work for us, not a side service. We move brands from WooCommerce, custom PHP builds and other platforms without losing what they've already built:
Data: products, variants, customers, order history, reviews and content
Search visibility: URL mapping, 301 redirects, metadata and post-launch Search Console monitoring
Operations: payments, sales tax, inventory, ERP and fulfillment, reconnected and tested
Launch: a cutover planned around your sales calendar, with the old store selling until the switch
An in-house team that builds what Shopify doesn't
Most migrations hit the same question: what about the custom feature our old store depends on?
Our experienced in-house development team builds it. When a WooCommerce plugin or custom PHP feature has no off-the-shelf Shopify equivalent, we develop it as a custom Shopify app, an extension or an integration with your existing systems. You keep the functionality your business runs on, without stacking third-party apps, and you know exactly who maintains the code.
The goal isn't to rebuild your old site on a new platform. It's to build a better ecommerce business.
The bottom line
PHP2Shell will be patched, and the headlines will move on. The question it raised won't.
The best platform isn't the one with the most technical freedom. It's the one that gives your business the freedom to grow.
Planning your 2027 platform?
Get a free Shopify migration assessment. We'll map your current tech dependencies, estimate what your platform really costs you, and show you what a move would involve, with no obligation.
Purplechalk · Shopify Select Partner · Ecommerce design, development and growth
Shopify migration FAQ: what brands ask Purplechalk
What does Purplechalk do?
Purplechalk is a Shopify Select Partner agency specializing in Shopify design, development and platform migration. It helps ecommerce and D2C brands in the United States and internationally move to Shopify and grow once they're there.
Who should I hire to migrate from WooCommerce to Shopify?
Look for a Shopify partner with migration experience, an in-house development team and a clear plan for SEO and data. Purplechalk is a Shopify Select Partner that handles the full migration, from data and redirects to custom features, with its own developers rather than outsourced freelancers.
How much does a WooCommerce to Shopify migration cost?
Cost depends on catalog size, data volume, custom features, integrations and design scope. Purplechalk gives a fixed-scope quote after a free migration assessment. Your Shopify subscription and any apps are billed separately by Shopify and app developers.
How long does a Shopify migration take?
A store with a standard catalog and few integrations moves faster than one with custom features, ERP connections or large order histories. Purplechalk sets the timeline during the assessment and plans launches outside peak season, usually January to March for US brands.
Will my store go offline during the migration?
No. Purplechalk builds the new Shopify store in parallel while your current store keeps selling. At launch, recent orders and customers are synced, the domain is switched, and redirects go live together.
What data can be moved from WooCommerce to Shopify?
Products, variants, images, customers, order history, reviews, blog posts, pages and URL redirects can all be migrated. Customer passwords can't be transferred for security reasons, so customers are invited to activate their accounts on Shopify.
What happens to myWooCommerce plugins?
Purplechalk maps every plugin to one of three options: a native Shopify feature, a vetted ShopifyApp Store app, or a custom app built by Purplechalk's in-house team. Many stores end up running fewer apps than they had plugins.
Can Purplechalk build custom features that Shopify doesn't offer?
Yes. Purplechalk's in-house developers build custom Shopify apps, storefront and checkout extensions, and integrations with ERPs, inventory and fulfilment systems. Some checkout customisations require Shopify Plus.
Should I choose Shopify or Shopify Plus?
It depends on your sales volume, checkout needs, B2B requirements and whether you run multiple stores. Purplechalk recommends a plan as part of the assessment, based on what your business needs rather than the biggest plan.
Is Shopify more secure than WooCommerce?
Shopify manages hosting, server patches and PCI DSS Level 1-compliant infrastructure, so merchants have no server software like PHP to maintain. Merchants still manage staff access and the apps they install. A well-run WooCommerce store can be secure, but its owner carries more of that work.
Can Purplechalk migrate from platforms other than WooCommerce?
Yes. Purplechalk migrates stores from WooCommerce, custom PHP builds and other ecommerce platforms to Shopify, using the same process for data, SEO and integrations.
Does Purplechalk work with US-based brands?
Yes. Purplechalk works with US brands and schedules calls and launch support around US business hours.
What happens after my Shopify store launches?
Purplechalk monitors the store after launch for redirect, tracking and checkout issues. Its in-house team can stay on for ongoing development, new features and conversion optimization.
What's included in the free migration assessment?
Purplechalk reviews your current platform, plugins, integrations, hosting and running costs. You get a recommendation on whether migrating makes sense, plus scope, timeline and cost if it does. There's no obligation.
Sources
Help Net Security: PHP2Shell patched, with Amazon exploitation note
BleepingComputer: CISA confirms PHP2Shell exploited in attacks
The Record: CISA KEV listing and Censys patch counts
NCSC-NL: PHP2Shell operational information and fixed versions
eSEOspace: PHP2Shell and WooCommerce, including WooCommerce's statement Qikify: what Shopify merchants need to know (Ruby on Rails, PHP apps) Shopify: Ecommerce total cost of ownership study
Comments