Hey Square sellers,
We’re sharing an important security update for online sellers. Two critical vulnerabilities were recently disclosed in PHP, the technology used to run many websites and online stores. Below, we’ll walk through what we’ve already updated for stores we host, what independently hosted stores need to check, and where to get help.
What you need to do depends on who hosts your store:
- Square Online or Weebly: We’ve already applied the security updates. You don’t need to take action to address these vulnerabilities for the store we host.
- An independently hosted store using Square with WooCommerce, Magento/Adobe Commerce, OpenCart, or PrestaShop: Contact your hosting provider or developer now to confirm your store has both fixes.
Here’s what that means for your business.
If Square Online or Weebly hosts your store
We’ve applied updates to the servers hosting your store to address both PHP vulnerabilities. We’ve handled those updates for you. Based on our assessment to date, we have not identified evidence of compromise of our systems in connection with these vulnerabilities.
If you also operate a separate website or store hosted elsewhere, check with that site’s hosting provider or developer. Accepting Square payments on another website doesn’t mean Square hosts it.
If your store is independently hosted
Contact your hosting provider or developer now, even if they already manage updates for you.
Here’s what to ask:
- Can you confirm that the PHP software running my store has fixes for both recently disclosed vulnerabilities? If either fix is missing, can you apply it immediately and confirm when it’s complete?
If they’ve already applied the updates, ask them to confirm your store is covered for both vulnerabilities. If they can’t update promptly, ask for a safe remediation plan and escalate to your technical support contact.
Updating your Square plugin or storefront software alone won’t fix these vulnerabilities. Your hosting provider or developer needs to address the PHP server software.
Why this matters
On an affected server, these vulnerabilities could let someone without a login run code. A compromised store could expose customer information, allow changes to checkout, or interrupt sales.
The reported vulnerabilities are in PHP itself. This advisory does not identify a flaw in the Square plugin.
This is precautionary guidance, not confirmation that your store has been compromised. If you suspect unauthorized changes or access, contact your hosting provider or developer immediately. Applying the fixes does not establish whether a store was previously compromised or remove an existing compromise.
Where to get help
Read our PHP security updates Help Center article for technical details and update guidance you can share with your hosting provider. Your provider or developer can confirm your PHP update status and make any required server updates.
For questions about your Square integration, contact Square Support.
