WooCommerce is a WordPress plugin. Updating it updates store code. Checkout still runs on the PHP runtime of that WordPress site.
What to look at
Payment and cart sessions sit in PHP workers. A PHP-FPM restart during a patch drops in-flight checkouts. Schedule the restart, and confirm the store’s PHP socket rather than a marketing site on the same machine that uses a newer pool.
Remediation
Patch the runtime, restart outside the peak order window if you can, and place a test order on staging first. A gateway plugin that only loads on PHP 7.4 is a reason to test, not a reason to skip the vendor backport for 7.4 if one exists.
Nginx or Apache in front of WooCommerce is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating WooCommerce fix PHP2Shell?
No. WooCommerce runs on PHP. The PHP binary or package that serves it has to be patched or replaced.