In short: Website security for a pharmacy is about health data: anyone who pre-orders a medicine or photographs a prescription reveals something about their health. Clarify who operates your web server, have the PHP patch and restart confirmed, and watch for hidden medicine advertising, which attackers like to plant on pharmacy sites.
Which PHP systems pharmacies use
Many pharmacies have a website with opening hours, an out-of-hours duty notice and a pre-order form. Often a function for uploading prescription photos or medication plans is added, plus requests for the delivery service and appointments for consultations or vaccinations. Mail-order pharmacies and pharmacies with online retail also run a shop, for example on WooCommerce or Shopware 6.
Some sites come from website packages offered by cooperatives or specialised providers, others were built by a local agency. For PHP2Shell, this determines who operates the server and is thus responsible for the PHP patch.
Delivery service requests are particularly revealing. They combine home address, phone number and medicine, often from elderly people or those in need of care. Anyone who captures such records knows who lives alone, which medicines are needed regularly and when deliveries take place. That makes them interesting to fraudsters who specifically approach elderly people.
Health data: why even a pre-order form is sensitive
Name plus medicine amounts to health data. Such details belong to the special categories of personal data under Art. 9 GDPR. Pharmacists are also bound by a duty of confidentiality, and breaching it can be a criminal offence under Section 203 of the German Criminal Code (StGB).
On the web server, such data sits in several places: in the form plugin's database, in uploaded prescription photos, in mail queues and in the shop with order histories. Anyone who can execute code via PHP2Shell can usually reach all of it without having to log in.
Pharmacy and website security: what an attack does
- Data leak: Pre-orders and prescription photos allow conclusions about illnesses. The risk for those affected is high, and reporting duties under the GDPR are likely. You assess the 72-hour deadline with your data protection officer.
- Pharma spam: Attackers plant hidden pages advertising prescription-only medicines. Search engines downgrade the site or show a warning, as described in the guide Removing a Google warning.
- Lost pre-orders: If the form fails or redirects, customers stand at the counter and the medicine has not been ordered.
- Manipulated shop: Modified code in the order process can capture payment data or send customers to fake pages.
An update of the shop or CMS does not close PHP2Shell. The vulnerability is only fixed with PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a backport confirmed by the provider, and only after all PHP processes have been restarted.
The responsibility gap in the pharmacy
| Area | Typically responsible | Often unclear |
|---|---|---|
| Management system, tills, telematics infrastructure | Software house or pharmacy IT | Connection to the online shop |
| Website from a cooperative package | Provider of the package | Written patch confirmation |
| Own website or shop | Agency and host | Who updates and restarts PHP |
In pharmacy groups, each branch may also have its own forms or domains that nobody keeps track of centrally.
Designing pre-orders and prescription uploads to minimise data
Many pharmacy forms store more than necessary. A pre-order needs a name, a way to reach the customer and the desired product, not date of birth, address or diagnosis. Prescription photos should not sit permanently in a publicly reachable upload folder but be deleted after collection.
Also check where the form data goes. If every pre-order lands as an unencrypted email in a shared mailbox that many staff can access, the mailbox needs as much protection as the server. And if a form plugin additionally stores every enquiry in the database, an archive of health data that nobody needs grows there month by month.
The less sits on the web server, the smaller the damage if it is compromised after all. You make the decision on retention periods with your data protection officer.
The first hours for pharmacy management
- Ask the operator of the web server in writing about the PHP patch level and restart.
- Without confirmation: switch off the pre-order form and prescription upload and switch to phone. A notice on the home page is enough.
- Have logs preserved from 20 October 2026 onward.
- Check in Google Search Console whether unknown pages or security issues are reported.
- After agreement with the data protection officer, have old prescription photos and form entries that are no longer needed deleted.
How does PHP SOS help?
- We clarify with the package provider, agency or host who patches PHP, and obtain the confirmation with the package version.
- We check the website and shop for webshells, planted pharma spam and modified order code and remove any malware found.
- We show where health data sits on the server and help to limit retention periods and uploads.
- We document findings so that your data protection officer can assess the reporting duty.
Frequently asked questions
Is our pharmacy management system affected by PHP2Shell?
The pharmacy management system and the connection to the telematics infrastructure usually run separately from the website. What is affected are PHP web servers, that is, usually the website, pre-order form and online shop. Whether interfaces exist between the shop and the management system should be checked by your IT service provider.
Our website comes from a site-builder package of our cooperative. Who is responsible?
With website packages from cooperatives, wholesalers or specialised providers, the provider usually operates the server. The PHP patch is then with them. Ask in writing about the current status, because responsibility for your customers' data stays with your pharmacy.
What is a pharma hack?
This is the name for attacks in which hidden pages or links advertising medicines are planted on a compromised website. Visitors often see nothing of it, but search engines do. For a pharmacy this is particularly sensitive, because such content appears under a trusted name.