Is Shopify More Secure Than WordPress (WooCommerce)? What PHP2Shell Means for Your Store

The short answer: for most merchants, yes. Shopify is a hosted platform, so Shopify patches the servers, runs the checkout and holds a PCI DSS Level 1 certification that, it says, extends to every store by default. WooCommerce runs on WordPress and PHP, which means you (or your host) own every layer of security, from the PHP version up to each plugin.

That is not the same as saying WooCommerce is insecure. A well-run WooCommerce store on good hosting can be very secure. The difference is who does the work, and what happens on a week like this one.

Updated 22 October 2026. We will update this article as the PHP2Shell story develops.

What happened with PHP this week?

On 21 October 2026 the PHP project released emergency fixes for two critical flaws in PHP itself. The flaws are now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language that runs WordPress, WooCommerce, Magento, Drupal and much of the web. W3Techs puts PHP on 69.3% of websites whose server-side language it can detect.

Here is what we know, in plain English:

• What the flaws do. Under memory pressure or after certain errors, PHP can leave memory in a broken state. A later request handled by the same PHP worker can abuse that state to run code without logging in, or to read server memory that may hold passwords, tokens and API keys. Source: PHP security advisory, Wiz.
• How serious. Both flaws are rated CVSS v4.0 9.2 (critical). An early score of 10.0 that circulated online was wrong.
• Who is affected. The PHP project says all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Your own code does not need a bug for your site to be exposed. Wiz showed the attack working against the official wordpress:latest container image.
• Is it being exploited? Yes. watchTowr and Sansec reported attacks in the wild on 21 October. Cloudflare saw attacks hours before the patch was released, and Amazon found an exploitation attempt dating back to 17 October.
• The fix. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive official releases from the PHP project, although the PHP team published source-only backports for 7.4, 8.0 and 8.1.

The story went well beyond the tech press. The BBC published an explainer, What is PHP and why did it spark a global cyber-security scramble?, and reported that websites were taken down around the world while the update rolled out, including pages run by the Finnish government, Edinburgh council and the BBC itself. The New York Times reported that AI had discovered the flaw, under the headline A.I. Discovered a Critical Vulnerability in PHP, a Coding Language Behind Many Websites. The flaws were found by AI-assisted research from Wiz and from Calif, working with OpenAI. In the UK, the National Cyber Security Centre (NCSC) advised organisations that cannot patch to consider taking systems offline until they can be fully mitigated.

Does PHP2Shell affect my Shopify store?

Not directly. Shopify merchants don't run PHP. Shopify is a hosted platform that Shopify operates on its own infrastructure (its core application is built on Ruby on Rails), so there is no PHP version in your store for you to update.

Two caveats. First, we have not seen an official Shopify advisory about PHP2Shell, so we are describing how the platform works rather than quoting Shopify. Second, third-party apps run on their developers' own servers. If an app you have installed runs on PHP, that app's developer needs to patch. It's worth asking your critical app vendors.

Does PHP2Shell affect my WooCommerce store?

Very likely, unless your host has already patched or mitigated it. Ecommerce security firm Sansec put it bluntly: "Magento, Shopware and WooCommerce stores are exposed even when their own code is clean."

The catch is that WordPress automatic updates won't fix it. WordPress.org said that no WordPress update is required or planned for these issues. WordPress updates WordPress. PHP is part of your server, and your host (or whoever manages your server) has to update it.

What WooCommerce merchants should do this week

1. Ask your host, in writing, whether PHP is patched. You want to see 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or confirmation that your Linux distribution's patched package is installed. Distribution packages can carry the fix under an older version number, so a written answer from the host is better than guessing.
2. If you are on PHP 8.1 or older, treat it as urgent. There is no official PHP release for these versions. The PHP team has published source-only backports for 7.4 to 8.1, and some Linux distributions and LTS vendors ship backported fixes, but the safe answer is to move to a supported PHP version, or to a host that does it for you.
3. Plan for 31 December 2026. PHP 8.2 reaches end of life on that date, according to php.net. If 8.2 is your patched version, you have roughly ten weeks before you need to move again.
4. Check for signs of compromise. Amazon found an exploitation attempt as early as 17 October, so start your checks from then. Look for new admin users, unfamiliar plugins, changed checkout scripts and unexpected files. Rotate passwords and API keys (payment gateway, Klaviyo, shipping) if you have any doubt, because the flaw can expose memory.
5. Know your reporting duty. If customer personal data was exposed, the ICO expects a report within 72 hours of you becoming aware, where the breach meets the reporting threshold.

Why Shopify is more secure by default

Shopify's security advantage is mostly structural. You are renting a store on a platform that Shopify patches, monitors and certifies, rather than running software on a server.

• PCI DSS Level 1 for every store. Shopify says its Level 1 PCI DSS certification covers your store, its shopping cart and its hosting by default. PCI DSS is the card industry's security standard, and Level 1 is its most demanding level.
• No servers, PHP or plugins to patch. Shopify runs the infrastructure. When a platform-level flaw appears, it's Shopify's job to fix it, and you don't have to schedule the update.
• A locked-down checkout. Since checkout.liquid was retired (for Shopify Plus stores, August 2024 for the information, shipping and payment pages and August 2025 for the thank you and order status pages; other plans' thank you and order status pages followed in August 2026), customisations run through Checkout Extensibility, which sandboxes customisation code. That matters for card-skimming attacks, which work by injecting scripts into the payment page.
• Free TLS and edge protection. Shopify provides free TLS (SSL) certificates for every domain on the platform. Its traffic runs through Cloudflare's CDN, DDoS protection and web application firewall, according to a Cloudflare case study.
• A long-running bug bounty. Shopify has paid security researchers more than $10.2 million through its bug bounty programme, with a maximum bounty of $200,000.
• Permissioned apps. Apps must declare the data they need (access scopes), and the merchant approves those scopes on install. Apps that want protected customer data must meet Shopify's data-protection requirements, such as encrypting data at rest and in transit.

How WordPress and WooCommerce security works

WordPress security is a shared-responsibility model with more owners than most merchants realise. Think of it as five layers, each of which can let an attacker in:

1. The server and PHP. Owned by your host, or by you on a VPS. PHP2Shell sits here.
2. WordPress core. Maintained by a security team of more than 50 experts. Minor and security releases have installed automatically since WordPress 3.7, so core is generally the best-maintained layer.
3. Plugins, including WooCommerce itself, payment gateways and the extensions most stores rely on. Each one is maintained by a different developer.
4. Your theme.
5. You. Admin accounts, passwords, updates, backups and PCI paperwork.

Most of the risk sits in layer 3. Patchstack's State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025. 91% were in plugins and 9% in themes. WordPress core had just six, all low priority. Patchstack also found that 46% of vulnerabilities had no fix from the developer by the time they were made public, and that heavily targeted vulnerabilities were first exploited after a weighted median of five hours. Patchstack sells WordPress security tooling, so read those figures as vendor research, but they match what we see in practice.

WooCommerce has had its own serious plugin incidents. A critical flaw in WooCommerce Payments in 2023 (CVE-2023-28121) could give attackers admin access, and it was attacked at scale that July. In May 2026, Sansec reported attackers exploiting a flaw in the FunnelKit Funnel Builder plugin, which is used on more than 40,000 WooCommerce stores, to inject card skimmers into checkout pages.

PCI compliance works differently too. WooCommerce's own documentation says "PCI DSS compliance is ultimately the responsibility of the store owner" and that the core WooCommerce plugin is not PCI certified. Using a hosted or off-site payment gateway (Stripe, PayPal and similar) reduces your scope, but it doesn't remove it.

Good managed WordPress hosting helps a lot, but read the small print. Hosts patch the server and many will help after a hack, but most still expect you to keep plugins and themes up to date. With PHP2Shell, some hosts blocked attacks before the patch was even out and had PHP patched within hours. Others told customers on self-managed servers to patch it themselves.

Key comparison at a glance

Where Shopify is not automatically safe

Shopify takes most of the platform risk off your plate. It doesn't take all of it. These are the areas we see go wrong most often on Shopify stores:

• Staff accounts and passwords. Shopify's terms make you responsible for account security. Turn on two-step authentication for every staff account. On non-Plus plans you can't force staff to use it, so make it a policy. Shopify Payments requires two-step authentication on the account that runs it.
• Apps. Shopify's terms say third-party services are used at your own risk. Every app with broad access scopes is a door into your customer data. Remove apps you no longer use, and question any app that asks for more than it needs.
• Scripts and pixels outside checkout. Your theme, tracking pixels and app embeds still run on product and cart pages. Keep the list short and know who added each one.
• Collaborator access. Agencies and freelancers should use collaborator accounts with a request code (now the default), not shared owner logins.
• Backups. Shopify doesn't offer a native full-store backup and restore. You can export CSVs, but for a proper safety net you need a backup app.

Shopify has also had incidents. In 2020, Shopify found two rogue members of its support team running a scheme to obtain customer transaction records from fewer than 200 merchants. No platform is immune to insider risk or social engineering.

What else merchants should weigh up

• The cost of security. On WooCommerce, security is a line item: managed hosting, a security plugin or WAF, a maintenance retainer, and someone's time every week. On Shopify, most of it is in the subscription. Compare total cost, not just the plan price.
• Time to patch. PHP2Shell was being exploited before the patch was public, and in one case four days before disclosure. The question isn't only "is my platform secure?" but "how fast does someone fix it, and who is that someone?"
• The newer PCI script rules. Since 31 March 2025, PCI DSS v4.0.1 expects ecommerce merchants to authorise and monitor payment-page scripts (requirements 6.4.3 and 11.6.1). Merchants who fully outsource their payment page and use SAQ A must instead confirm their site is not susceptible to attacks from scripts. Shopify handles this inside its sandboxed checkout. On WooCommerce, it depends on your gateway setup and on what else runs on your pages.
• PHP versions keep moving. Each PHP branch gets about four years of support (the last two security-only), so WooCommerce stores need regular PHP upgrades, and upgrades can break plugins. Budget for it.
• Flexibility versus control. If your store depends on custom functionality that only WordPress can deliver, a well-managed WooCommerce stack can be the right answer. Just go in knowing who owns each layer.

Should you move from WooCommerce to Shopify?

Don't migrate in a panic this week. Patch first: get your host to update PHP, check for signs of compromise and rotate credentials. Then make the platform decision calmly.

Moving is worth considering if any of these sound familiar: you rely on a long list of plugins, you have no one on a maintenance retainer, your PHP version is out of date, or you found out about PHP2Shell from the news rather than from your host. Those are the stores where Shopify's managed model removes the most risk.

HTM Digital is a Shopify Partner. We plan and run WooCommerce to Shopify migrations for UK and European brands, keeping your products, customers, order history and SEO intact. If you'd like a second opinion on your current setup, get in touch.

Sources

• PHP project, Security advisory and release announcement, 21 October 2026
• PHP project, Supported versions
• Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, 21 October 2026
• Sansec, PHP2Shell research, 21 October 2026
• watchTowr, PHP CVE-2026-109618 FAQ, updated 22 October 2026
• Amazon Security Blog, Amazon threat intelligence identifies PHP2Shell exploitation prior to public disclosure, 21 October 2026
• NCSC, Critical security issue affecting PHP, 21 October 2026
• WordPress.org, Critical PHP security release, 21 October 2026
• Computer Weekly, What to do as critical PHP flaws puts millions of websites at risk, 21 October 2026
• BBC News, What is PHP and why did it spark a global cyber-security scramble?, 22 October 2026
• The New York Times, A.I. Discovered a Critical Vulnerability in PHP, a Coding Language Behind Many Websites, 21 October 2026
• W3Techs, Usage statistics of PHP, October 2026
• Patchstack, State of WordPress Security in 2026
• WordPress.org, Security
• WooCommerce, PCI DSS compliance and WooCommerce
• Shopify, PCI compliance, Bug bounty, Checkout compliance
• PCI Security Standards Council, Guidance for e-commerce requirements after 31 March 2025
• ICO, 72 hours: how to respond to a personal data breach