PHP2Shell: What Every Online Store in Spain Must Do Now

A server-level flaw, not a plugin problemWhen news breaks about a critical vulnerability in PHP, many shop owners in Barcelona, Lleida or Tarragona in...

A server-level flaw, not a plugin problem

When news breaks about a critical vulnerability in PHP, many shop owners in Barcelona, Lleida or Tarragona instinctively check their CMS dashboard and assume they are covered. That instinct is understandable, but it misses the point. The flaw known as PHP2Shell lives in the PHP interpreter itself, the engine that runs the server-side code of platforms such as WooCommerce, PrestaShop, Magento and many bespoke builds. Updating your theme, your payment module or even the core of your shop does nothing to close it if the underlying PHP binary remains unpatched.

That distinction matters because PHP underpins a very large share of the web. For an online store, remote code execution is not an abstract technical risk: it can expose the catalogue, order history, customer accounts and the connections to payment gateways, carriers, ERP systems and marketplaces. In practical terms, it is a business continuity issue as much as a security one.

Who is actually responsible for the patch

The uncomfortable truth is that the responsibility usually sits outside the marketing team. It belongs to whoever manages the infrastructure: an in-house systems administrator, your hosting provider, your cloud operator or your digital agency. If you run a PrestaShop or WooCommerce store and you are not sure who holds that responsibility, that is the first thing to clarify today.

A useful question to put in writing to your technical partner is simple: which exact PHP version is running in production, and have the emergency patches for the PHP2Shell advisories been applied and the PHP processes restarted? Note the emphasis on production and on restarting. Installing a package is not enough if Apache or PHP-FPM workers keep running the old, vulnerable code in memory.

A practical checklist for store owners

Confirm the real version. Ask for the version reported by the binary that actually serves your site, not the one shown in a control panel. A command-line check on the server is the reliable route.
Move to a supported branch. If your store runs on PHP 8.2, 8.3, 8.4 or 8.5, apply the corresponding fixed release. If it still runs PHP 8.1 or earlier, those branches no longer receive official binary updates, so plan a migration to a supported version without delay.
Restart the PHP service. Active workers can retain vulnerable behaviour until they are recycled. Confirm the restart with your provider.
Test the whole stack. After patching, verify payment modules, shipping rules, tax calculations, marketing and analytics scripts, custom themes, and integrations with ERP, CRM, PIM and marketplaces. Older or unmaintained extensions deserve particular attention.
Check staging and backups. Test environments and backup routines are part of the same estate and should be patched and verified too.

Edge protection buys time, not safety

Some hosting providers and CDN services have deployed temporary firewall rules to filter malicious traffic. These mitigations are welcome while you coordinate the update, but they are a perimeter measure. They do not replace a patched interpreter, and they should never become the permanent answer. Treat them as a bridge, not a destination.

Why this is a moment to review your ecommerce stack

Incidents like this expose a broader truth about running an online shop in Spain: conversion optimisation and security are not separate projects. A store that sells well but sits on an outdated PHP branch, abandoned plugins or an unmanaged server is one incident away from losing trust, orders and, under GDPR, potentially facing notification obligations and fines.

At ALMC.es we build and maintain online stores on PrestaShop and WooCommerce with the full stack in mind: performance, conversion, integrations and a patched, monitored infrastructure. If you are unsure whether your shop is exposed, the right move is not to wait for the next headline. Ask the question, get the version in writing, and make sure someone is accountable for the answer.

Put these ideas into practice

Talk to ALMC about a solution for your business. Explore your options or contact our team.

Results without leaving the page.