Downpay is not affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Does any part of Downpay run on PHP?

No. Downpay's app and APIs are built on Ruby on Rails. We do not use PHP anywhere in our stack, including the app, the admin, our API and our webhook handling.

Which PHP version do you run, and when was it patched?

Not applicable. Because we don't run PHP, there is nothing to patch.

Have you found any sign these vulnerabilities were exploited against your systems?

No. We were not affected by these vulnerabilities in any manner.

Have the access tokens you hold for my store been rotated?

Not applicable. We were not affected, so there was no reason to rotate access tokens.

What customer, order or payment data from my store do you keep, and were those systems affected?

We keep only what Downpay needs to work with your orders:

• Order records from Shopify: order identifiers, order totals and currency, payment status, the payment gateway used, and the payment references and error codes Shopify returns.
• Your shop's contact email, and the name and email of the staff users who sign in to Downpay.
• No card numbers. Payment methods are held by Shopify.
• No customer names, addresses or email addresses in our database. When we need to send a buyer a notification, we retrieve their email from Shopify at that time.

None of these systems were affected by these vulnerabilities.

Do I need to change anything on my Shopify store?

No. Nothing needs to change in Downpay or its settings. Shopify hosts your storefront and checkout, and Downpay connects to your store through Shopify's official APIs.

I run other software that uses PHP. Is it affected?

It may be. If you run PHP-based tools outside Shopify, such as a WordPress site or a self-hosted server, check with that software's vendor or your hosting provider whether you are on a fixed PHP version.