PrestaShop stores on old PHP have no patch coming.
The new PHP flaws affect every PHP version before the fixed releases. PrestaShop 1.6 and 1.7 stores usually run PHP versions that are end of life, so moving off them is the only real fix.
Is the PHP PrestaShop runs on affected?
Run php -v on the server. A patched version on disk only protects you after every PHP worker restarts. Distro packages can carry backported fixes under older version numbers, so we confirm against your vendor's changelog.
What makes these sites a target.
Old store versions, old PHP
PrestaShop 1.6 and 1.7 run only on older PHP versions, so many stores can't move to a patched release without a platform upgrade.
Modules lag behind
Payment, shipping and theme modules often block both PrestaShop and PHP upgrades.
Checkout data is the target
A server takeover exposes customer accounts, orders and admin sessions.
Imports and back-office uploads
Catalog imports and product images use the large form posts these exploits use.
How we fix it on PrestaShop.
The first commands we run, read-only:
php -v
# Back office: Advanced Parameters > Information > PHP versionInventory
We record PrestaShop, PHP and module versions and check them against patched PHP releases.
Plan the path
Current stores move to a patched PHP release. Older stores get a scoped upgrade plan, with hardening until it's done.
Upgrade and restart
We upgrade on staging, test checkout and modules, then switch production and restart the PHP workers.
Harden and verify
We add edge rules and php.ini limits that keep the back office and imports working.
Any cloud, any VPS, any server.
The fix is the same everywhere: a patched PHP build, restarted workers and hardened settings. We work on VMs, containers, Kubernetes, serverless runtimes and control-panel hosting.
Pick how much you want us to do.
Exposure check
- Every PHP version and server you run, listed
- Clear verdict: exposed or not, and how urgent
- Written report with next steps
Fixed fee, credited toward remediation
Guided remediation
- Upgrade plan for your platform and hosting
- Temporary hardening while you wait
- Edge and WAF rules written for your routes
- We review your team's work and verify it
Hourly or fixed package
Full repair and upgrade
- Staging test, upgrade and rollback plan
- Patched PHP on every server and container
- All workers restarted and verified
- Hardening, monitoring and a closing report
Fixed quote per environment
Patch watch
- We track PHP and platform advisories
- Quarterly version and config checks
- Priority response for the next critical CVE
Monthly retainer
From first call to verified fix.
Authorize
You sign a short scope and authorization. We don't scan or touch any system without it.
Inventory
We record every PHP version, server, container and worker process in scope.
Plan
You get a fixed quote, a schedule and a rollback plan before any change.
Patch and restart
We upgrade PHP and restart every worker so no vulnerable code stays in memory.
Verify
We confirm the fix on every host and hand over a written report.
Don't restart the server yet.
If you see shells or tools like curl launched by PHP processes, PHPSESSID cookies longer than 256 bytes, or a spike in PHP worker crashes, contact us before you patch. Restarting wipes the memory evidence that shows what an attacker did. We preserve that evidence first, then work with an incident response firm if the investigation needs one.
PrestaShop questions.
Can you upgrade PrestaShop 1.7 to a current version?
Yes. It's quoted separately because of module and theme work, and we harden the current store while that project runs.
Will our payment modules survive?
We test each one on staging and find replacements for any that are abandoned.
Do we have to close the store?
Usually not. The production switch takes a short maintenance window.
Find out where you stand this week.
Tell us what you run on PrestaShop and where it's hosted. We'll reply within one business day with a time for the exposure check.
Include your platform, approximate number of sites or servers, and your hosting provider.