Your Store Looks Secure. Your Apps Might Not Be.

Most ecommerce store owners spend a lot of energy thinking about their storefront - the design, the product pages, the checkout flow. Security, by contrast, tends to get treated as someone else's problem. If you're on a managed platform, surely the platform handles all of that?

Not quite. And the gap between what merchants assume and what's actually true is where real risk lives.

In October 2026, PHP issued critical security updates for versions 8.2 and 8.3, addressing vulnerabilities serious enough to allow unauthenticated remote code execution. In plain terms: an attacker exploiting these flaws could potentially take control of a server without needing a username or password. PHP urged all affected users to update immediately.

For store owners, the immediate reaction might be: "That's not my problem - I'm on a hosted platform." But that assumption deserves a closer look.

The Hidden Attack Surface You're Not Thinking About

Here's the part most merchants miss. Even if your core ecommerce platform is fully managed and up to date, the apps, plugins and third-party integrations connected to your store are a different story entirely.

Many of these tools - loyalty programmes, subscription managers, product recommendation engines, review collectors - run on their own servers, often built on PHP. The platform you sell through doesn't maintain those servers. The app developers do. And not every developer is equally rigorous about keeping their infrastructure current.

This creates three very different outcomes depending on who built your apps and how seriously they take maintenance:

  • Well-maintained apps: The developer patches promptly and you never notice anything.
  • Poorly maintained apps: Updates are delayed, leaving a window of exposure that could last days, weeks or longer.
  • Abandoned apps: Nobody is maintaining the backend at all. The vulnerability stays open indefinitely.

The scary reality is that many stores have apps installed from years ago - tools that were useful once, that now sit quietly in the background, potentially running outdated software with nobody actively watching them.

Who Is Actually Responsible for What?

This is where merchants often get caught off guard. Responsibility for security updates is more fragmented than most people realise.

The core platform is typically the platform's responsibility. But any third-party app running its own server infrastructure? That's the app developer's problem - and by extension, yours, if their failure creates a breach that touches your customer data.

Custom integrations built specifically for your store by a development agency? Those sit with whoever built them - which means if that agency has moved on or the relationship has ended, it may fall to you to find someone who can maintain it.

The merchant sitting at the centre of all of this generally cannot reach in and update a third-party app's PHP version themselves. All they can do is ask the right questions - or make the decision to replace tools that aren't being properly maintained.

The Practical Audit Every Store Owner Should Do

This isn't about becoming a security expert overnight. It's about asking smarter questions of the tools you've already deployed.

Start With a Full App Review

Go through every app or integration connected to your store - including ones you barely use anymore. An unused loyalty app you installed two years ago and forgot about can still have access to customer data. Dormant doesn't mean safe.

Ask About Infrastructure Maintenance

For your most critical tools - anything that touches payments, customer accounts, order data or email - it's reasonable to contact the developer and ask whether their infrastructure has received recent security updates. A reputable developer won't be offended by the question.

Audit Permissions

Check what customer and store data each app actually has access to. App permissions can creep over time, especially if you've granted broad access during installation and never revisited it. Tighter permissions mean a smaller blast radius if something does go wrong.

Flag Anything That Looks Abandoned

No recent updates, no active support channel, no developer response to messages? These are warning signs. An app with no active maintenance is a liability, regardless of what it does.

The Bigger Picture: Technical Debt Costs More Than You Think

There's a broader question hiding inside all of this, and it's one that matters for store growth as much as store security.

Many online stores are carrying significant technical debt - outdated code, neglected integrations, plugins that haven't been touched in years. The cost of maintaining all of that quietly compounds over time. At some point, the money being spent to keep ageing technology barely functional might be better invested in modernising the whole operation.

This is particularly true for stores running on older self-hosted platforms where the store owner is responsible for server-level decisions. An upgrade to a newer PHP version on a WooCommerce store with modern plugins and a well-maintained theme might be relatively straightforward. The same upgrade on a store with a decade of custom development baked in can become a major project.

The right answer depends heavily on the specific situation - but the honest question worth asking is whether the money currently flowing into maintenance is actually building anything, or just holding things together.

As we explored in our post on why ecommerce stores bleed money on development problems, the cost of technical inaction tends to be invisible right up until it isn't.

Security and Conversion Are More Connected Than You'd Think

Store security might feel like a back-office concern, but it has very direct implications for the shopper experience. A breached app can expose customer data. A compromised integration can disrupt checkout. An abandoned tool running vulnerable code can become the entry point for problems that surface publicly - and visibly.

Trust is the foundation of every sale. Shoppers who worry about whether their data is safe don't convert. And the trust crisis affecting AI-powered shopping is already putting pressure on stores to demonstrate they're responsible custodians of customer information.

The stores that take technical hygiene seriously - not just their storefront design, but their entire connected ecosystem - are the ones building the kind of trust that compounds into long-term conversion rates.

That's also why the tools you add to your store matter. An AI shopping assistant for ecommerce that's built with proper security architecture and maintained by a team that takes infrastructure seriously is a very different proposition from a half-abandoned plugin sitting on an unpatched server.

What Smart Store Owners Do Next

Security audits don't need to be intimidating. The basics are straightforward:

  • List every connected app and integration - including ones you've forgotten about.
  • Check when each was last updated by its developer.
  • Review permissions and remove anything unnecessarily broad.
  • Contact developers of critical tools to confirm their infrastructure is maintained.
  • Remove or replace anything abandoned or unresponsive.

None of this replaces proper technical advice for complex situations - but it's the kind of proactive thinking that separates stores that stay ahead of problems from those that discover them the hard way.

The ecommerce landscape is moving fast. AI-powered tools, agentic commerce, personalised shopping experiences - all of it depends on a foundation of technology that's actually sound. You can't build confidently on infrastructure you haven't examined.

This article was inspired by Critical PHP Security Issue.

LISA is an AI shopping assistant for ecommerce that helps stores convert more visitors through intelligent, personalised guidance - built on infrastructure that takes security and reliability seriously. If you'd like to see what LISA can do on your store, book a demo and we'll show you exactly how it works in practice.