PHP security update: No action required for Qikify users

On October 21, 2026, two security vulnerabilities in PHP were publicly disclosed. We understand that security news can raise questions about the safety of the apps you rely on, so we'd like to explain what happened and what we've done to protect Qikify apps.

Here's what you need to know.

PHP is a programming language that powers many websites and web applications. It runs on servers behind the scenes, rather than on your computer or your customers' devices.

On October 21, two PHP security vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as "php2shell," were publicly disclosed.

Under certain conditions, these vulnerabilities could allow an attacker to execute malicious code on a vulnerable server, access data they shouldn't be able to see, or disrupt a website or application.

The vulnerabilities affect the PHP runtime itself. Updating application plugins or website code alone does not resolve the issue; the server must run a fixed PHP version.

For technical details, see the official PHP security announcements.

Some merchants have also asked about a recently disclosed security vulnerability in Node.js. Qikify apps do not run on Node.js in production, so this vulnerability does not affect our apps.

Shopify manages the hosting and maintenance of its core platform, which is not built on PHP.

Third-party apps may use different technologies and operate on separate infrastructure, so their security depends in part on how their developers maintain their servers.

If you use Qikify apps, we've completed the necessary security updates across our infrastructure. All Qikify apps are now running patched PHP versions in production, and you don't need to make any changes to your store.

Qikify apps run on PHP, so we treated this disclosure as a priority and took immediate steps to reduce risk and deploy the permanent fixes.

1. Additional protection was in place before public disclosure.

All Qikify apps run behind Cloudflare. Cloudflare deployed Web Application Firewall (WAF) protections against php2shell at 03:02 UTC on October 21, approximately nine hours before the vulnerabilities were publicly disclosed.

These protections provided an additional layer of defense while we prepared and deployed the PHP security updates.

You can read more about Cloudflare's response in its technical explanation of php2shell protection.

2. All Qikify apps have been patched.

We updated the PHP runtime for every Qikify app to an officially patched release. All updates have been deployed to production, with completion times listed below.

3. We reviewed our security monitoring data.

We reviewed available Sentry error and request logs for indicators of exploitation. No indicators of exploitation were found in the logs reviewed, and our apps remained stable throughout the remediation process.

As of October 22, 2026, at 10:07 UTC+7, all Qikify apps had been patched and were running fixed PHP versions in production.

The PHP team released fixed versions for the affected supported branches on October 21, 2026:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

These releases address CVE-2026-109618 and CVE-2026-109619. A server running the appropriate fixed release, or a newer release in the same branch that includes the fixes, is protected against these vulnerabilities.

For further details, see the PHP security announcements and CERT-EU Security Advisory 2026-018.

Before the permanent PHP updates were deployed, we implemented additional safeguards:

• Cloudflare WAF: All Qikify apps run behind Cloudflare, whose WAF protections provided an additional layer of defense against attempts to exploit these vulnerabilities.
• Temporary PHP hardening: We disabled PHP session upload progress tracking, a feature our apps do not use, as an interim precaution. Sessions and file uploads continued to work normally. This temporary measure was removed from the relevant apps once their patched PHP versions went live.
• Security monitoring: We reviewed available Sentry error and request logs for indicators of exploitation. No indicators were found in the logs reviewed.

These measures helped reduce risk while remediation was underway. Cloudflare WAF and temporary hardening provided additional protection; the permanent fix was to update the PHP runtime across all Qikify apps.

You do not need to:

• Update or reinstall your Qikify apps.
• Change your Shopify settings.
• Modify your theme or checkout configuration.
• Contact our support team specifically to request this fix.

All remediation was performed on our servers. Your Qikify apps should continue working as usual.

For additional technical information, see:

• PHP official security announcements
• CERT-EU Security Advisory 2026-018
• Cloudflare's php2shell protection overview

If you have any questions about Qikify apps, our support team is happy to help. You can contact us directly from inside the app or through our email: support@qikify.com

Qikify’s approach to security

The safety of a Shopify app depends on how its developer maintains and manages its servers. It also matters whether the developer has the maintenance and management structure to respond quickly when an outage or problem occurs, including the ability to gather information, the technical skills, the people, and the compensation.

As threats from AI-powered hacking and attacks become a reality, keeping systems secure is getting harder and the response is becoming more complex. In this environment, we promise our customers that we will always stay alert to security information, respond quickly and carefully, and keep our environment as secure as we possibly can.

Across the Qikify app series, our development, product and support teams work together, each from a different perspective, to ensure quality and security. We will spare no effort to continue earning your trust.

We will keep monitoring our systems and apply security updates as needed. Thank you.

— The Qikify Team