Is the PHP Vulnerability Affecting Your Online Store?

This week, a post on Hacker News surfaced details about a bug in the programming language PHP.

The news is pretty chilling. People are saying it’s about as bad as it gets because the bug can open the door for hackers to take over your site.

Even worse, a large portion of the web is running a version of PHP that’s too old for the official fix released by the PHP Project. The solution is to update to a newer version but many website owners don’t know how or even if they’re affected in the first place.

WordPress, the world’s most popular content management system (CMS), powers more than 40% of all websites and an estimated 33% of WordPress systems are using a version too old for the official fix.

WooCommerce, the open-source ecommerce plugin built on WordPress, runs roughly a third of all online stores, and every one of those installations depends on PHP.

If you’re like most people, you don’t know if your site is vulnerable or where to begin addressing a technical issue like this.

You might be thinking that if your store is up and running and you don’t see any problems with it, you’re fine. Unfortunately, that’s not the case.

With platforms like WooCommerce, you’re in a difficult position. While your web hosting provider manages the server's PHP engine, you’re responsible for ensuring your store can survive an update.

If your hosting provider pushes the emergency patch, will your older plugins and custom code crash? If you’re stuck on an outdated, unsupported PHP version because your site would break on a newer one, your host can’t safely update you.

Because Merchant Tech is built with Rust, an inherently memory-safe language, our architecture is highly resistant to the low-level memory corruption bugs that plague C- and PHP-based web platforms. Combined with our fully managed infrastructure, security updates are applied at the platform level, so your store stays protected without you having to manage patches or worry about broken plugins.

Critical issues like the PHP vulnerability may continue to affect your WooCommerce site, especially if you’re not actively updating and maintaining it.

What is PHP?

PHP is a programming language used for popular web platforms and applications including WordPress, which WooCommerce runs on.

The PHP vulnerability stems from two issues in the codebase — both rated 9.2 out of 10 on the security severity scale — that lets people run their own code on your server.

How is the PHP vulnerability affecting online stores?

It opens the door for hackers to scan your database, see your user’s data, access API keys, and add spam or malware to your web pages. They can choose not to do anything in the moment, but leave a backdoor and come back later.

They don’t even need to login or trick an admin into clicking a malicious link. They can just scan the internet for PHP users with this vulnerability and then attack.

Because PHP is a foundational layer in code, it doesn’t matter how secure your website or online store is or how well you built it. Because all of that sits on top of the PHP, which is the compromised code.

What can you do?

You only need to take action if your store runs on a self-hosted platform like WooCommerce.

For WooCommerce owners, follow these two steps:

1. Check your version: Inside WordPress, click Tools > Site Health, expand the Server tab, and note your PHP number.
2. Contact your host: If you aren't on the latest patched release (8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+), ask your hosting provider's support team if your server received the October 21 PHP security patch.

On platforms like WordPress and WooCommerce, you’re not only susceptible to vulnerabilities like the PHP bug, you’re also responsible for keeping your site up to date. You’re on the hook for monitoring server runtimes, testing plugin conflicts, and maintaining a safe site for your customers.

And if your income relies on a secure, functional online storefront, these types of vulnerabilities are a huge threat to your livelihood.

How Merchant Tech keeps your store secure

If you don’t want to be on a platform like WooCommerce and WordPress, you can recreate your website on Merchant Tech. It’s a modern, secure e-commerce alternative that doesn't rely on PHP or third-party plugins. When an urgent security patch drops, you don’t have to wait and hope your plugins still work with it.

We keep our ear to the ground for security issues, make updates for customers so they don’t have to, and use Rust — a high-performance, high-security language for your website.

Using a platform like Merchant Tech lifts the burden of having to deal with issues like the PHP vulnerability. If you’re switching from another platform like WooCommerce, a migration specialist will take care of store setup for you.

Talk to a migration specialist about switching.

Kate Maruyama

Kate is a Senior Editor at Merchant Tech where she oversees content that helps merchants understand platform tools, optimize their online stores, and grow their businesses.