Shopify App Data Security in 2026: PHP Flaws, Delisted Apps, and Your Store Data

Report Pundit is not affected by the October 2026 PHP vulnerabilities, and it isn't on any published list of delisted Shopify apps. We build Report Pundit on Ruby on Rails, not PHP, so the two PHP flaws (CVE-2026-109618 and CVE-2026-109619) can't reach our servers. If you use Report Pundit, there's nothing you need to do.

Two October stories landed on merchants at the same time. The first is PHP2Shell, the nickname for two critical PHP flaws that PHP patched on October 21. The second is the wave of App Store removals: between October 14 and 22, Shopify delisted 478 apps, 16 of them with more than 1,000 reviews. In the same weeks, attackers used at least three apps to send shoppers to fake checkout pages that stole card details.

These are separate problems. The reporting we reviewed on the checkout attacks never mentions PHP, and the PHP flaws don't explain the delistings. Below, we take them one at a time, explain what Shopify's new security checks look for, show how Report Pundit protects your store data, and finish with a checklist you can run on any app you've installed.

Key takeaways

• Report Pundit is unaffected. It runs on Ruby on Rails with no PHP, and it hasn't been named in the checkout hijack or in the October delistings.
• The PHP flaws are critical, and fixes exist. Both score 9.2 on the CVSS 4.0 scale. PHP shipped patches in 8.2.35, 8.3.36, 8.4.27, and 8.5.12, and CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26.
• Shopify itself doesn't run PHP. Its core platform runs on Ruby on Rails. The risk sits with apps that run PHP on their developers' servers.
• 478 apps were delisted from October 14 to 22, 305 of them on October 20. Only three vendors confirmed malicious code (Hulk Product Options, Selleasy, and Swym Wishlist Plus), and Shopify hasn't explained most of the other removals.
• Other reporting and analytics apps were delisted too. Mipler, a Shopify reporting app with 660 ,reviews, left on October 21 with no reason published. Seven small profit and analytics apps went between October 15 and 21, including ProfitHelm, Profit Panel, Profit Pulse AI, and LTV Analytics. None has a published reason, and a delisting on its own isn't evidence of a security problem.
• The confirmed attacks ran through storefront code. Malicious JavaScript reached stores mainly through app settings that accept custom code.
• Delisting doesn't uninstall an app. It blocks new installs, but the app keeps running on stores that already have it until the merchant removes it.

What are the October 2026 PHP vulnerabilities?

CVE-2026-109618 and CVE-2026-109619 are two remote code execution flaws in PHP itself, and researchers have nicknamed the pair PHP2Shell. Both score 9.2 (Critical) on the CVSS 4.0 scale. PHP released fixes on October 21, 2026, as Rapid7's breakdown of the two CVEs explains.

In plain terms, the first flaw is a memory bug that triggers when PHP runs out of memory. The second is a use-after-free bug, where a worker reads stale memory left behind by an earlier request. Either one can let an attacker run code on the server. Whether an attack works depends on the setup. Apache with mod_php is the riskiest combination, and the public proof-of-concept exploits so far only work on specific mixes of operating system, PHP version, and web server.

Which PHP versions are affected?

Source: Rapid7's analysis of CVE-2026-109618 and CVE-2026-109619, last updated October 27, 2026.

Updating is the only complete fix. Server settings can shrink the exposure in the meantime, but Sophos's guidance on the PHP flaws and Rapid7 both point out that they don't close the hole.

Are attackers exploiting the flaws?

The reports don't fully agree, so they're worth reading closely. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, citing evidence of active exploitation. Rapid7 says it hasn't seen exploitation in the wild, only attempts, and Sophos reported scanning and a handful of failed attempts as of October 22. Palo Alto Networks' Unit 42 first tied a breach at a European government agency to the flaws, then retracted that. Its threat brief also cites telemetry showing more than 22.6 million internet-exposed instances that are potentially vulnerable.

If you run PHP, treat this as urgent, even though reliable exploits look hard to build. PHP also disclosed a separate remote code execution flaw, CVE-2026-115560, on October 23. PHP says it needs an unusual mix of configuration and application code, and the PHP2Shell mitigations cover it too.

Does the PHP vulnerability affect Shopify stores and apps?

Not Shopify itself, but possibly some of the apps around it. Shopify's core platform runs on Ruby on Rails, and Shopify manages its own servers, so there's no PHP on the store side for you to patch, according to Qikify's guide for Shopify merchants.

Apps are a different story. Every Shopify app runs on its developer's servers, not inside your store, so an app built on PHP stays exposed until its developer applies the update. That matters because app servers often hold the API access tokens that connect them to your store. If a developer ran unpatched PHP, Qikify recommends asking them to rotate those tokens and any exposed keys.

Three places deserve a look: apps built on PHP, custom or private apps your own developer built, and any WordPress blog or landing page you run outside Shopify. Start by asking each app's developer whether it uses PHP and whether the October 21 update is in. If they can't tell you, or you've stopped using the app, uninstalling it is a reasonable precaution. It removes the app's access to your store.

Why Report Pundit is not affected

Report Pundit is a Ruby on Rails application, and no PHP interpreter runs anywhere in the product. That's why CVE-2026-109618, CVE-2026-109619, and CVE-2026-115560 have nothing to attack. This applies to these flaws only. Every stack gets its own advisories, so the better question for any vendor is how quickly they patch.

The Node.js flaw sits in the Brotli decoder. Singapore's Cyber Security Agency alert says it can let an attacker run code remotely or read memory, but only when an app decompresses attacker-controlled Brotli data.

Why did Shopify delist so many apps in October 2026?

Shopify hasn't said. It removed 478 apps between October 14 and 22, and its stated policy is not to share details of an investigation unless the law requires it, according to Revenue Shield's delisting tracker and Cybersecify's roundup of published delisting reasons. The removals came in bursts: 81 on October 15, 305 on October 20, and 44 on October 21.

Well-reviewed apps were hit too. Sixteen of the delisted apps had more than 1,000 reviews, including 17TRACK Order Tracking (4,448), Privy (4,230), and ReConvert (3,134). Most haven't been linked to any attack.

The checkout hijack behind the alarm

Malicious JavaScript reached stores through the back-end systems of at least three app vendors, delivered via each app's custom-code settings. The script sent shoppers to a fake checkout on a look-alike .top domain, grabbed their card details, then passed them on to the real checkout so the order looked normal. In Swym's first wave, the fake page even copied the shopper's real cart. In the Hulk case, theme files looked clean because the code lived on the vendor's servers. LetsMetrix's timeline of the attacks and Ethercycle's technical breakdown cover the details.

So far, the reporting points to app code, not Shopify's own checkout. Two earlier cases, Qikify's Sticky Add to Cart and Mega Menu (July 22) and Orichi's OC Quantity Breaks & Limit (September 11), were also confirmed by their developers, and both apps have since been relisted.

Source: LetsMetrix's attack timeline and Revenue Shield's delisting list.

Delisting is not proof of a breach

Apps leave the App Store for plenty of ordinary reasons. LetsMetrix counted 512 unlisted apps from September 22 to October 21, about 17 a day, with 31 on its busiest day, October 16. The only cause Shopify states as automatic is an app still using an unsupported API version after the deadline. Other published causes of delisting include policy violations, failed quality checks, protected customer data problems, and security incidents. Some apps have already come back: Revenue Shield counts 27.

So treat a delisting as a reason to look closer, not as a verdict. A delisted app can't be newly installed, but it keeps running on stores that already have it until the merchant uninstalls it.

Which Shopify apps were delisted in October 2026?

The table covers the nine apps named most often. Only the first three have vendor-confirmed unauthorized code. Status is as reported on October 22, 2026 by Revenue Shield's list of delisted apps and LetsMetrix's affected-app summary.

Dates come from Revenue Shield's archive. LetsMetrix reports that Shopify removed Hulk Product Options about 70 minutes after the developer's first report on October 10, so archive dates can lag. Both Revenue Shield and LetsMetrix sell monitoring or analytics tools, so check an app's own status page before you act on any list.

Reporting and analytics apps on the list

Reporting and analytics apps weren't spared. Besides Mipler, Revenue Shield's full list of 478 delisted apps includes seven small profit and analytics apps, each with 4 or fewer reviews: LTV Analytics (ScaleX AI), ProfitHelm, Profit Panel, Profit Pulse AI, ProfitOps, Social Click Insights, and VenceMetrics Calculator. None is named in the checkout attacks, and none has a published reason for leaving.

What do Shopify's app security checks test?

Shopify's shopify app security check command scans an app's source code for 37 named issues: 25 high severity, 10 medium, and 2 low. Shopify announced the command on October 15, 2026, right in the middle of the checkout hijack.

It works in two ways. A deterministic scan answers exact questions, like whether an API version has reached end-of-life. An agent review handles questions that code inspection alone can't settle, like whether every database query is limited to one shop. Without a coding agent, you only get the scan.

High-severity checks that matter most for store data

Shopify's check names read like code, so here's what each one means for your store. The original names are in the last column if you want to look them up.

Source: Shopify's list of app security checks.

Medium-severity checks flag smaller weak spots. One example is an app that switches off expiring access tokens.

What the security check does not prove

Shopify itself says the command is limited to source code and should be one layer in a broader security approach. A clean result doesn't prove an app is safe, because the check doesn't test the app while it's running. App review covers other ground: protection against the OWASP Top 10, a valid TLS certificate, no unnecessary public services, 128-bit token entropy, and a correct frame-ancestors policy.

Two deadlines are coming up. On January 1, 2027, the GraphQL Admin API will start rejecting non-expiring offline access tokens. On March 1, 2027, script tags stop running on storefronts.

How does Report Pundit protect your store data?

Report Pundit reads store data through Shopify's Admin API and builds reports inside your admin. That design keeps it well away from the attack path used in October. Here's how our controls line up with Shopify's own checks.

No storefront or checkout code

The confirmed hijacks ran through app code on the storefront. Report Pundit adds no script tags, theme app embeds, or custom JavaScript fields to your storefront or checkout. With none of our code on your storefront, there's nothing for an attacker to swap in for a fake checkout.

Built on Ruby on Rails, not PHP

No PHP runs anywhere in the product, so the October PHP advisories don't touch Report Pundit and you don't need to act.

Read-only, minimum-scope access

Report Pundit asks for read-only API scopes for orders, products, customers, and inventory, and no write access. That speaks directly to Shopify's check for apps that request more access than they need. An app that can't write to your store can't change your checkout.

Each store's data is kept apart

Every database query is limited to a single shop. Shopify calls this tenant isolation, and it's one of the 25 high-severity checks.

Encryption and protected customer data

Shopify's Level 1 protected customer data rules require encryption at rest and in transit. Level 2 applies to apps that touch names, addresses, phone numbers, or emails, and it adds encrypted backups, limited staff access, access logs, and a security incident response policy.

Ready for Shopify's 2027 deadlines

Report Pundit already uses expiring offline access tokens, ahead of the January 1, 2027 cutoff, and it uses no script tags, so the March 1, 2027 change doesn't affect it. We also run shopify app security checks on every release.

How can you check if a Shopify app is safe?

Run these checks on every app you've installed. They pull together LetsMetrix's merchant checklist, Ethercycle's read-only checks, and Qikify's advice on the PHP flaws.

• List every app that accepts custom code. Look for settings fields that take JavaScript, code, or HTML. The confirmed cases mostly ran through fields like these. Screenshot them instead of editing them.
• Check each app's App Store page. A delisted app shows as unavailable, but it keeps running on your store until you uninstall it.
• Review your app embeds. Go to Online Store > Themes > Customize > App embeds and switch off anything you don't recognize.
• Test checkout in a fresh private window. The malicious script fired once per browser session, so a second test in the same session can look normal. Open a new window each time.
• Watch the Network tab. Filter for .top. Every script domain should be yours, Shopify's CDN, or an app you run. Also confirm checkout stays on your domain or Shopify's.
• Look for the attack's fingerprints. Check session storage for keys that start with __ctf_. If you use Swym, search your theme code for checkout-guard.
• Review requested permissions. A reporting app shouldn't need write access to your theme or checkout.
• Ask each vendor about PHP. Does the app run PHP, and has the developer applied the October 21 update? If you can't get a clear answer, or you've stopped using the app, uninstall it.
• Patch what you own. Ask your developer to update PHP on custom apps, WordPress blogs, and landing pages. If a custom app ran unpatched PHP, rotate its access tokens.
• Read each vendor's security page. Look for encryption, data retention, and incident response details.
• Uninstall apps you no longer use. Then check your theme code for leftovers.

Frequently asked questions

Is Report Pundit affected by the October 2026 PHP vulnerabilities?

No. Report Pundit is built on Ruby on Rails and doesn't run PHP, so CVE-2026-109618 and CVE-2026-109619 don't apply. You don't need to do anything.

Was Report Pundit delisted from the Shopify App Store?

No. Report Pundit isn't on any published list of the 478 apps delisted between October 14 and 22, 2026, and it hasn't been linked to the checkout hijack. It's live and installable on the Shopify App Store.

Are the PHP vulnerabilities connected to the delisted apps?

Not as far as the published reporting shows. The checkout attacks ran through custom-code settings in a few apps, and none of the reports we reviewed mention PHP. Shopify hasn't said why most other apps were removed.

Does Shopify itself run on PHP?

No. Shopify's core platform runs on Ruby on Rails, and Shopify manages its own servers. The exposure sits with apps and custom integrations that run PHP on their developers' servers, and with any PHP site you run outside Shopify.

Should I uninstall Shopify apps that use PHP?

Not automatically, but don't leave it open-ended either. Ask the developer whether the app runs PHP and whether they applied the October 21 update. If they can't confirm, or you've stopped using the app, uninstalling it is a sensible precaution.

Why were top-reviewed Shopify apps delisted?

Shopify hasn't said for most of them. Three vendors, behind Hulk Product Options, Selleasy, and Swym Wishlist Plus, confirmed that malicious code reached stores through their apps. Other well-reviewed apps were removed with no public reason, and some have already returned.

Does a delisted app stop working on my store?

Usually not. Delisting stops new installs, but the app and any script it adds keep running on stores that already have it. You have to uninstall it yourself and check your theme for leftover code.

Can a reporting app hijack my checkout?

The October 2026 attacks needed app code running on the storefront. A reporting app that reads data through the Admin API and adds no storefront scripts gives an attacker no way to redirect checkout. Check what permissions and storefront embeds any app adds.

What customer data does Report Pundit access?

Report Pundit reads order, product, customer, and inventory data through read-only scopes, and uses it only to build the reports you request. Store data is deleted within 2 days of uninstalling the app.

How do I know if a Shopify app is secure?

Check its App Store status, the permissions it requests, whether it adds code to your storefront, and its published security practices. After installing any app that touches the storefront, test your checkout in a private window.

‍