On October 21, 2026, details of a serious PHP vulnerability rated 9.2 out of 10 and fixed versions of PHP were published. If you run a Shopify store, you may be wondering whether information from your store could be exposed and what you need to check now. The announcement did not report a data breach at Shopify stores.
This article explains how the PHP vulnerability and recent security incidents might relate to your store, and what store owners and staff should do now. App providers have recently reported attacks involving third-party apps that may have sent customers at some stores to fake checkout pages. We separate the areas Shopify manages from the questions to put to app providers and agencies, then show what you can check in your store today.
Where could the PHP vulnerability affect a Shopify store?
PHP is a programming language used to run web services. On a server affected by this vulnerability, an attacker who has not logged in can run programs if certain conditions are met. If that server handles orders or customer information, the attacker might be able to read the information or alter how it is processed. PHP issued an advance notice on October 20 and released fixed versions on October 21. PHP's official announcement
The impact on your store depends on whether a third-party app or custom system you use runs on a PHP server affected by this vulnerability, and whether that server has been updated. The server configuration and update status are not visible in the Shopify admin. Ask the app provider or the person responsible for maintaining the system.
Shopify, app providers, and merchants maintain different parts of a store
Shopify updates the standard platform it manages. The provider of a third-party app is responsible for fixing its app code and servers. Your own systems, or servers managed by an agency, must be updated by the people responsible for maintaining them. Updating Shopify's platform does not automatically update an external server. Make a list of the apps and custom systems your store uses, and identify whom to ask about updates to each one.
If a problem occurs on an app provider's server, the impact on your store also depends on the permissions you gave the app. For example, an order integration app might process data on its provider's server and keep credentials for connecting to Shopify there. If that server were compromised and the credentials misused, an attacker could potentially access orders or customer information within the permissions granted to that app. This would be a route through the app's permissions, rather than an intrusion into Shopify's platform itself. To reduce your exposure through external apps, review the permissions you have granted and ask providers how they protect their servers and connection credentials.
In an October 20 statement for developers, Shopify asked app providers to check authentication, permissions, logs, and related accounts. On October 22, Shopify also sent Popaz guidance to check updates and security for public and custom apps, and to help merchants review app permissions and whether installed apps are still needed.
For more on the protection Shopify provides and what merchants manage, see Is Shopify Secure? Platform Protections and Steps Merchants Should Take.
Cases in which an app redirected customers to a fake checkout page
Wishlist Plus is one example of an app issue reaching customers. Its provider, Swym, reported on October 16 that a third party had changed app settings without authorization on October 14, causing a malicious script to load on certain pages of some stores. According to Swym, customers who clicked a purchase button may have been sent to an external fake checkout page.
Swym said it restored the settings, removed the malicious code, and refreshed credentials. In an October 20 FAQ, the company also said it had paused the app for all stores as a precaution and revoked its access to Shopify. At the time, Swym said it had no evidence that its customer information database had been breached, although payment details entered on the fake page may have been collected.
Selleasy's provider, Logbase, said on October 16 that an October 13 attack had placed a malicious script in some stores and that customers appeared to have been redirected to an external phishing page. According to Logbase, it fixed the cause and removed the script within hours, then notified affected stores. It said its investigation was continuing as of October 16.
Both providers described customers being directed to external pages before reaching the genuine Shopify Checkout. Their accounts do not show an intrusion into Checkout itself. No link between these incidents and the PHP vulnerability has been confirmed. Rather than judging an app by the provider's size or reputation, read its official notices to find out whether your store is affected and whether you need to take any action.
Start with an inventory of installed apps and their permissions
To see what information an installed app can access, open Settings → Apps in the Shopify admin. Select a third-party app to open its details. Under Activity and permissions, the View and Edit columns show which areas the app can read or change. Recent activity appears on this page too. Privacy shows the types of personal information the app can access. Labels vary with the admin language, and activity for Shopify-built apps cannot be tracked on this page. Shopify's guide to managing apps
A permission shown here does not mean the app actually retrieved that information. An app with no obvious recent use might still perform an inventory or shipping sync in the background, or support a task done only a few times a year. Before removing it, ask the person responsible for that work what the app does and whether its permissions match that purpose.
Recording each app's purpose and what would happen if it stopped helps you decide whether to keep it and what to ask its provider. Also record where it stores information and who maintains it, using the provider's guidance or answers for details the admin does not show.
| What to record | Details to capture |
|---|---|
| App and purpose | Which task it supports and who knows how it is used |
| Impact of stopping it | Whether inventory sync, shipping, sales pages, or other processes would stop |
| Granted access | Whether it can view or edit orders, customers, products, or other information |
| Personal information and storage | Types of information shown under Privacy; check the storage location separately with the provider |
| Maintenance and response | Provider contact, update notices, answers received, and next steps |
For example, an inventory integration app that you rarely open may have permission to edit products and orders but still sync data every day. Do not remove it immediately: ask your inventory team where the sync starts and ask the provider whether those permissions are necessary. On the other hand, you can consider removing a trial app if the trial is over, no one can explain its current purpose, and you have checked the effect of stopping it.
For apps you still use, check the provider's announcements, release notes, status page, and emails. Look for whether your store uses an affected configuration, when the provider completed its response, and whether merchants need to do anything. Add what you learn to your app inventory so you can decide on the next step. Even for widely used apps, rely on the provider's notice or answer for its response status.
If you cannot find a notice, or it does not tell you whether your store is affected, contact the provider. For a public app, use the support contact on its details page. For an integration or custom app built in-house, ask your development or maintenance team. For one built by an agency, ask the agency or your contracted maintenance provider. Ask three things: Is it affected by this vulnerability? Has it been fixed? Does the store need to take any action? If you do not know where the app stores data, ask that too. A lack of a public notice alone does not establish that the provider has failed to respond.
Uninstalling an unused app stops it from accessing store data in the future. If you also want data that the provider previously obtained and stored to be deleted, check separately. Review the provider's privacy policy for what can be deleted and how to request it. Shopify's explanation of apps and data access
For agency-built custom apps, find out who maintains them
When the people who worked on an agency-built custom app leave, you may no longer know whom to ask for updates. But the absence of a monthly maintenance fee does not, by itself, mean the app is unsafe. Some apps use only extensions that run on Shopify and have no external server. Shopify's guide to extension-only apps
Ask the agency what the app does, whether it uses an external server, what Shopify information it can access, and which business processes would be affected if it stopped. If it has an external server, ask which programming language it uses and who manages updates and the operating environment. Find out who controls the source code, server environment, and account used to register the app. That will help you identify who can make future fixes.
If you cannot reach the original agency, ask another developer to investigate how the app works, whether it uses an external server, and what permissions it has. Removing an app used for orders or inventory without warning could interrupt operations. Once you understand its setup and impact, decide whether to continue using it with a new maintenance provider, fix what is needed, move to another solution, or stop using it. If your company does not own the app or its source code and cannot change it, work out the replacement and migration order first.
Review who can access the Shopify admin and from which devices
Alongside app permissions, review the people who can sign in to the admin. Even an account with legitimate permissions can be misused if someone else takes it over. The attacker could then see information or change settings available to that account.
Does everyone with access still need it?
Open Settings → Users and review your staff and collaborators. Remove access for former employees and agencies whose work has ended. Give each person who still works on the store their own account. If people share the owner's login, it is difficult to tell who took an action or to remove access for only one person. Shopify's account security guide
Does each person have only the permissions their work requires?
Review the permissions of everyone who retains access. A customer support worker, for example, may need to view orders without needing to export all customer records or manage apps. Limiting permissions reduces the information and settings someone could view or change if an account is taken over, or if a mistake or insider misuse occurs.
Shopify already requires two-step authentication for collaborator logins. What you need to check is whether each collaborator still needs access and whether the permissions you granted are too broad. How to manage collaborators
Would a stolen password be enough to sign in?
Owners and staff should turn on two-step authentication under Security in their individual profiles. On a compatible device, they can also use a passkey instead of a password. Two-step authentication makes it harder to enter an account with a stolen password alone. It cannot prevent misuse of a stolen signed-in session or misconduct by someone who legitimately has access. Shopify's two-step authentication and account security guidance and passkey guidance
Are email accounts and work devices protected too?
If you receive an email demanding an urgent login for a "security update," do not enter credentials through its link. It could lead to a fake login page designed to steal them. Open the admin through your usual bookmark and check the notice there. Shopify's phishing guidance
An infected device could expose a signed-in session as well as a password. Keep work devices updated and use screen locks. Turn on two-step authentication for the email account used to sign in to Shopify or recover access, and check that no suspicious forwarding rules have been added.
If you have already noticed suspicious behavior
If customers are sent to an unfamiliar purchase page before reaching the genuine Checkout, act without waiting to finish your app inventory. Record which page they were on, what they clicked, and which site opened; save a screenshot and contact Shopify Support. If you can identify a related app, contact its provider too. Work with the people responsible to decide how to stop the redirect and respond to customers. Such behavior can have causes other than this PHP vulnerability, so start by describing what you have observed.
Ask Popaz for help with unclear apps or maintenance handoffs
Start in the admin by checking the purpose and permissions of installed apps and the access held by staff and collaborators. If you cannot tell whether an app's permissions are appropriate, or you cannot reach the agency and do not know where a custom app's server or source code is, record what you do know: the app names and purposes, permissions shown in the admin, and whom you have been able to contact. That makes the remaining investigation easier to scope.
Popaz can help identify what an app does, review its permissions, and find out where a custom app runs and who can maintain it. From there, we can help you decide whether to keep using the current setup, fix it, move to another solution, or stop using it, and support the maintenance handoff. Please contact us with your store URL, the integration or app you are concerned about, and any known impact on your work.
