PHP2Shell & E-commerce: Protecting Magento, WooCommerce & Shopware
Online stores are among the highest-value targets for PHP2Shell. Researchers confirmed unauthenticated remote code execution against Magento 2.4.9, and because the flaw is in the PHP engine, WooCommerce and Shopware stores are exposed too.
Why e-commerce is especially at risk
- Data theft. The memory-disclosure side of the bug can leak session tokens, API keys and TLS private keys straight out of worker memory — a direct path to card-skimming (Magecart-style) attacks.
- PCI DSS. Running a known-critical, unpatched RCE on a cardholder-data environment is a compliance problem, not just a security one.
- Checkout uses uploads. The attack rides on multipart/form-data, the same content type as file uploads and many checkout flows — so you can't simply block it without breaking the store.
Action plan for stores
- Update PHP now to a patched release (8.2.35, 8.3.36, 8.4.27 and 8.5.12). This is the only complete fix.
- Rotate secrets after patching if you were exposed during the attack window — API keys, admin sessions, and any keys that could have been in memory.
- Watch for Magecart. Review checkout templates and third-party scripts for unexpected changes.
- Don't rely on app-level WAFs alone. Researchers note that some protections (including Sansec Shield) run after the vulnerable PHP code, so they don't block this.
Temporarily blocking multipart/form-data stops the attack but also breaks uploads and most checkout flows. For a live store, prioritize patching over blocking. See temporary mitigations for the trade-offs.