There's nothing for you to patch on your Shopify site: Shopify runs the servers, and you don't install or update PHP there. If your business also runs a WordPress blog, a booking tool or a portal on another address, check that address separately.
- PHP for you to manage
- No
- runs the servers
- Shopify
Why there's nothing to patch on Shopify
Shopify runs your store on its own servers. You don't install, choose or update PHP, so PHP2Shell isn't something for you to patch on your Shopify store. PHP2Shell affects servers running PHP from before the fixed releases (8.2.35, 8.3.36, 8.4.27, 8.5.12). On a hosted platform like Shopify, the platform looks after its own servers.
Other parts of your business to check
Many businesses on Shopify still have something running on PHP somewhere else. Check each of these addresses separately:
- a WordPress blog or landing pages on another address
- a booking, quoting or client portal tool hosted elsewhere
- an old site still live on a subdomain
What PHP Scanner looks for on a Shopify site
When you check a Shopify site, PHP Scanner recognizes it from Shopify headers such as X-ShopId and assets served from cdn.shopify.com, and shows "Nothing for you to patch" with the evidence.
Questions people ask
Is Shopify affected by PHP2Shell?
There's no PHP on Shopify for you to manage or update, so there's nothing for you to patch. Shopify looks after its own servers.
Does Shopify use PHP?
Your Shopify site doesn't run on PHP that you choose or maintain. If you moved from WordPress, make sure the old site isn't still live on another address.
What should I check instead?
Any other website, blog, store or portal your business runs outside Shopify. Enter each address in PHP Scanner.
Sources
Checked against these sources on October 22, 2026. PHP Scanner is a free tool from Catch Digital and is not affiliated with the PHP project.