PHP Vulnerability Responses by Company

Shopify Inc.

Global cloud / infrastructure
Aliases / services
Shopify / Shopify Inc.
Official website
https://www.shopify.com/
Sources identifying the operating company

Contracting parties vary by region and service: Shopify Commerce Singapore Pte. Ltd. for Asia-Pacific including Japan, Shopify Inc. and other entities specified in the terms for US/Canada, and Shopify International Limited elsewhere. Payment services have additional terms.

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Shopify App PHP / legacy Admin API client

Response status
Not listed
Response information checked
2026-10-28

Current re-audit: Official sources searched; no response found · Research date: 2026-10-28

The former shopify-api-php repository is archived and its notice ends maintenance, including future security fixes. Shopify identifies shopify-app-php as its successor.

Scope: These sources establish a customer-side PHP integration. Provider infrastructure impact or remediation for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) remains unverified. SDK availability or minimum PHP requirements are not proof of remediation.

What users should do

Identify legacy dependencies and follow the successor setup, testing OAuth, Admin API calls and webhook verification. Retirement does not establish PHP2Shell remediation.

Official service URL

Source URLs

  1. Shopify: official PHP integration documentationhttps://github.com/Shopify/shopify-api-phpService and operation documentation
  2. Shopify: official operator and legal/company informationhttps://www.shopify.com/legal/termsService and operation documentation
  3. Shopify: official SDK migration or supplementary documentationhttps://raw.githubusercontent.com/Shopify/shopify-app-php/HEAD/README.mdService and operation documentation
Related official sources
  1. Shopify: official PHP integration documentationOfficial information directory
  2. Shopify: official operator and legal/company informationOfficial information directory
  3. Shopify: official SDK migration or supplementary documentationOfficial information directory

Comments