Critical PHP Flaws CVE-2026-109618 and CVE-2026-109619: Shoply Is Not Affected

On October 21, 2026, the PHP project fixed two critical security flaws. The next day, a merchant emailed us a short question: does Shoply run PHP?

No. None of Shoply’s code is written in PHP, and none of our servers run it, so these two flaws don’t affect Shoply AI. This post explains what the flaws are, why Shoply is not affected, and what you may want to check on the other tools your store uses.

What happened

PHP is a programming language that runs a large share of the web, including WordPress, WooCommerce and Magento sites. On October 21, PHP released fixes for two flaws:

• CVE-2026-109618  (PHP advisory ). When a PHP website runs out of memory while it is reading an incoming request, it can stop halfway and leave part of its memory in a broken state. A request built on purpose to cause this can let an attacker run their own code on the server.
• CVE-2026-109619  (PHP advisory ). After one request finishes, PHP can keep a note that points to memory it has already freed. A later request can then read that leftover memory, which can also let an attacker run their own code.

“Run their own code on the server” is the most serious kind of flaw. It means an attacker could take over the website, read its data or change it. That is why both flaws are rated critical: 9.8 out of 10 from the US National Vulnerability Database, and 9.2 out of 10 from PHP’s own security team, which uses a newer scoring method.

Neither flaw is easy to use. PHP’s team rates both as hard to pull off, and on October 21 the US Cybersecurity and Infrastructure Security Agency (CISA) listed no known attacks using them. But the attacker needs no password or account, so any PHP website that is not updated is at risk.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any older version in those lines has both flaws, and PHP says updating is the only complete fix.

Why Shoply is not affected

Shoply  adds AI search and an AI shopping assistant to Shopify stores and other websites. We checked all of it on October 22:

• Our servers run Python, not PHP. The servers that answer chat, run search and read your store’s products are written in Python and run on Amazon Web Services (AWS).
• The Shoply app in your Shopify admin runs on Node.js, another programming language. PHP is not installed on it.
• The chat and search widget on your storefront is a JavaScript file. It runs in the shopper’s browser and is delivered by a content network. It doesn’t touch your server.
• There is no Shoply plugin for WordPress. To add Site Chat to a WordPress site, you paste one line of script into your theme. It adds no PHP code to your site.

The only place PHP shows up in our code is a filter in our error tracking. Bots scan the whole internet for weak PHP and WordPress pages, and they knock on our admin app too. Those pages don’t exist on Shoply, so the bots get a “not found” error, and the filter keeps that noise out of our error reports.

Where your data lives

A security alert often leads to a second question: where does my data go?

Shoply stores your data in the US. Our databases, file storage and the servers that run chat, search and store reading are in AWS’s US West regions, in Northern California and Oregon. Like most websites, we also use a worldwide delivery network, so a shopper in Europe or Asia gets a fast answer. Their request passes through a location near them on its way to our US servers.

AI models write the answers. To answer a shopper, Shoply sends the shopper’s question, the recent chat and the relevant product details to outside AI model providers. Some of them may process that data outside the US.

We never sell your data, and we don’t share it for advertising. We do pass it to the service providers that help run Shoply, such as AWS and the AI models that write answers. Our privacy policy has the full details.

What to check elsewhere

Shoply is one of many tools a store depends on, and these flaws can still matter for the others:

• Your Shopify storefront. Shopify runs and updates the servers behind your store, so you have nothing to patch there.
• Other apps. Many Shopify apps run on their own servers, outside Shopify. If an app reads or changes your store data, ask its developer whether they run PHP and, if they do, whether they have updated.
• WordPress and WooCommerce sites. If you run a blog, a second store or a landing page on WordPress, it runs on PHP. Ask your hosting company whether they have moved to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. In WordPress, you can see your current version under Tools, then Site Health, then the Info tab, under Server.

Need this in writing?

If your team is running a security review of your apps, reply to any Shoply email or write to support@shoplyai.ai. We’ll send a written confirmation that Shoply is not affected by CVE-2026-109618 and CVE-2026-109619.