Is Shopify affected by the PHP security issue?
No.
No action needed for the store itself. Shopify hosts your store and handles its updates, and its platform isn't built on PHP. Check the other systems you run yourself.
Check your website
Run a free check on your website, or on other sites and tools you use.
What to check
- 01
Think beyond your main website
Webshops, booking systems, intranets, customer portals and subdomains (like shop. or blog.) can run on different software. Check those too.
- 02
Check other products you use
Some appliances and software packages include PHP. The Dutch NCSC keeps a list of affected products; watch for updates from your vendors.
Good to know
- Hosting is included with every Shopify plan, and Shopify's updates are automatic. Source ↗
- Shopify's core is built with Ruby on Rails, not PHP (Shopify Engineering, 2020). Source ↗
- Apps and integrations run on their makers' own systems. A separate website, blog or tool next to your store may still run on PHP.
Questions & answers
Do I need to do anything for my Shopify store?
Not for the store itself: Shopify runs and updates the platform. Do check any other websites, blogs or systems you run yourself.
What about my Shopify apps?
Apps run on their developers' own servers, and those developers are responsible for keeping them updated. If an app is critical to your business, it's reasonable to ask its developer.
More: How to check if your website uses PHP · The October 2026 PHP security issue, explained
Other platforms: WordPress · WooCommerce · Joomla · Drupal · Magento · PrestaShop · TYPO3 · Wix · Squarespace