ecommerce Shopify security

The PHP security bug and your Shopify store

A serious security bug in PHP, a programming language that runs a big share of the web, went public this week. Your Shopify store itself is fine. The apps plugged into it are the part to check, and that check is a 20-minute tidy-up we'd recommend anyway.

Is my Shopify store affected?

Not directly. Shopify runs on its own platform and themes use Liquid, Shopify's own template language. There's no PHP for you to update.

The bug has been nicknamed PHP2Shell. It lets an attacker take over a server running PHP without logging in, and PHP released the fix on 21 October. Security firm Wiz says every PHP version from the last decade is affected. Sophos reports attackers are already using it.

As at 23 October, we haven't seen a public statement from Shopify about the bug. That doesn't worry us, because there's nothing in Shopify's own platform for it to fix. Shopify did, on 20 October, ask every app developer to tighten security this week. It's also restricting app keys so they only work from the developer's own servers. We think that's the right call.

Where could it reach you?

Through your apps. Most Shopify apps run on the developer's own servers, not on Shopify's, and some of those servers run PHP. If one was broken into, an attacker could see or change whatever that app has permission to touch.

That's why permissions matter. A reviews app might only read your products. A returns or email app can usually see orders and customer details, and those are the ones worth asking about first.

It also reaches anything you run beside your store, like a WordPress blog, a landing page or a small tool a freelancer built. That's where New Zealand looks exposed. The National Cyber Security Centre says it's aware of attacks and recommends patching immediately. A tracker run by Adam Holt at TheColab.ai checked nearly 278,000 .co.nz domains on Thursday. Of the sites showing an exact PHP version, fewer than one in ten were on a fixed release. By Friday morning that was closer to one in six.

Those numbers likely look worse than reality, because many hosts apply the fix without changing the version number they report. We'd still treat it as a nudge. If you have a side site like this, ask whoever hosts it today whether PHP has been updated. A one-line email is enough.

What have app developers said so far?

Very little, which is normal in the first few days. Two Shopify app developers have gone public, and both deserve credit for being quick and clear. Qikify says all 11 of its apps run on PHP, were patched by 22 October and showed no sign of attack. Avada says none of its apps use PHP.

We've also checked the apps our clients rely on most. Several don't use PHP at all, going by what the companies have published themselves. Judge.me runs on Ruby on Rails, and Klaviyo's developer docs describe a Python platform. For a few others the answer isn't public yet.

No public statement doesn't mean there's a problem. Some developers email their merchants directly rather than post online.

What should you do this week?

Tidy your app list. Japanese Shopify agency Popaz has published a sensible checklist for store owners, and it matches what we'd tell our own clients:

Open Settings → Apps and look at what each app can view and edit.
Remove apps nobody can explain, but find out what they do first. An inventory app you never open may still sync every night.
For apps that can see orders or customers, ask the developer three things: are you affected, is it fixed, and do I need to do anything?
If a developer or agency built you a custom app, find out who maintains it and where it's hosted.
In Settings → Users, remove former staff and finished collaborators, and turn on two-step login for everyone.
Ignore urgent "security update" emails asking you to log in. Use your usual bookmark instead.

None of this needs panic. Don't uninstall a key app on a hunch, because it can break your store and adds nothing if the developer has already patched. A short, tidy app list is a safer store, PHP bug or not. That's the job.

If you'd like a second pair of eyes on your app list, we're happy to take a look.