If headlines about a "PHP vulnerability" left you uneasy this week, you are not alone. Since the news broke on October 21, many merchants and partners have written to us with the same two questions: is my store at risk, and do I need to do anything?
Running a store already pulls your attention in a hundred directions, and a lot of what's being shared about this doesn't help. Many posts and reposts make it sound worse than it is, with alarming headlines and little explanation of what the flaw is. So before anything else: there's no need to panic. This post explains what happened in plain language, what it means for Shopify stores, and what you can do today.
What happened, in plain language
On October 21, 2026, the PHP team released emergency fixes for two critical security flaws in PHP itself. Researchers have nicknamed them "PHP2Shell" (officially CVE-2026-109618 and CVE-2026-109619), and both are rated 9.2 out of 10 for severity. (Cyber Kendra)
PHP is the programming language underneath a huge part of the web, including WordPress, WooCommerce, Magento and many custom websites. About 70% of websites with a known server language use it, so a flaw in PHP itself, present in every version since 5.4, reaches far beyond any single site.
Think of PHP as a car's engine and a website's code as the driver. Most security problems you hear about are driver mistakes, like a buggy plugin or a weak password. This time the fault is in the engine, so even a website with fully up-to-date code stays exposed until the PHP underneath it is updated.
PHP2Shell is a flaw in the engine (PHP itself), not in a website's own code
What could an attacker do with it? By sending a specially crafted request, they could make a vulnerable server run their own code, crash it, or leak bits of memory that may contain passwords, tokens or API keys. No login is needed. (BleepingComputer)
Why did it feel so sudden? Details leaked online on October 20, one day before the planned announcement, so the fix was pushed out early and security teams around the world moved fast. Cloudflare reported seeing attack attempts hours before the official disclosure and switched on extra firewall protection for its customers, including free plans. (PPC Land) Firewalls only buy time, though. The PHP team's own advice is that updating is the only safe choice. (Cyber Kendra)
Three days from leak to patch: how PHP2Shell unfolded
So, is my Shopify store affected?
The short answer: your store itself is not something you need to patch. Shopify's core platform isn't built on PHP. It runs on Ruby on Rails, and Shopify runs and maintains its own servers, so there is no PHP on your side for you to update. (Narrows Web)
Your business probably runs on more than the storefront, though. Here is where PHP can show up around it:
| Part of your business | Who runs it | Could PHP be involved? |
|---|---|---|
| Your Shopify store and checkout | Shopify | No. Shopify's core isn't built on PHP |
| Third-party apps you installed | Each app developer, on their own servers | Possibly. Many apps run on PHP behind the scenes |
| Custom or private apps built for you | You or your developer | Possibly, and this one is your responsibility |
| A separate website, blog or landing page (for example on WordPress) | You or your host | Very likely if it is WordPress or similar |
Apps are what merchants ask us about most. An app does not run inside your store. It runs on its developer's servers and connects to your store through Shopify, so what matters is whether each developer you rely on has patched their servers.
That is why agencies and partners are contacting app developers this week, and you can do the same.
What we did at Qikify
Qikify's apps do run on PHP on our servers, like many apps in the Shopify ecosystem. As soon as the news broke, our team got to work on it.
Our apps sit behind Cloudflare, so the firewall rules Cloudflare rolled out against these attacks were protecting our servers before the patch went live. As an extra precaution, we also switched off one PHP feature our apps don't use (session upload progress tracking). Sessions and file uploads kept working normally, and we turned it back on once the patch was in place.
By 10:07 AM on October 22 (UTC+7), every Qikify app was patched and running on a fixed PHP version: 8.2.35 for Checkout Customizer, Upsell & Cross-sell, Slide Cart Drawer and the rest of our core apps, and 8.3.36 for Koin, Mysbox, Duos and Volume Discounts. Our QA team has checked that everything runs normally with no feature changes, and our error and request logs show no sign of exploitation.
Every Qikify app was patched by October 22, with no action needed from merchants
We could act this fast partly because we have been through this before. In July we handled a security incident of our own, and what we learned from it shaped how we responded this week.
You do not need to do anything for your Qikify apps. There is nothing to update, reinstall or reconfigure on your side. For the full technical details, see our official security notice.
What you can do this week
You don't need to be a security expert for any of this. Most of these steps take under 15 minutes, and they are a good excuse to tidy up your store.
8 quick checks to tidy up your store's security this week
- ☐ Don't rush to uninstall apps. Some posts are telling merchants to remove apps across the board, but uninstalling in a hurry can break features your store relies on, and it won't add any protection if the app's developer has already patched. Instead, go to Settings > Apps in your Shopify admin and remove only the apps, AI tools or automations you no longer use.
- ☐ For the apps you keep, send the developer a short message: "Does your app use PHP, and have you applied the PHP2Shell patch?" A good developer will be glad you asked and should give you a clear answer.
- ☐ If you run anything outside Shopify, like a WordPress blog, a landing page or a custom app a freelancer built, ask your host or developer to update PHP now. A firewall helps in the meantime, but updating is the actual fix. (BleepingComputer)
- ☐ These flaws can leak server memory, which may include passwords and API keys. (Cyber Kendra) If a custom app of yours ran on PHP that wasn't updated in time, ask your developer to rotate its access tokens. It's also a good moment to rotate any key that was pasted into code or shared with a former collaborator or AI tool.
- ☐ Look through your staff accounts and collaborator access, remove anyone who no longer needs it, and turn on two-step verification.
- ☐ Be careful with "urgent security" emails this week, since scammers like to ride big security news. If an email asks you to log in or install something to "fix PHP", go to Shopify directly instead of clicking the link.
- ☐ Watch your store for a few days. If you see theme changes you didn't make, apps you don't recognize or odd checkout behavior, contact that app's support team right away.
- ☐ Open your checkout in an incognito window and make sure you land on the real Shopify checkout page.
You are not doing this alone
It has been a heavy year for online security, and a flaw in something as basic as PHP is unsettling. The response was fast, though: within a day of the leak, the PHP team, hosting companies and security firms had fixes and protections out.
If you have questions about your store, your apps or anything in this post, our support team is happy to help.
For our official update on Qikify apps, read the security notice here.
