Security update: PHP "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Last updated:
In October 2026, critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), were disclosed and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Many merchants are reviewing the apps installed on their Shopify stores as a result. This page answers the questions we've been asked most often.
Short answer: Downpay does not use PHP anywhere in our stack, and we were not affected by these vulnerabilities in any manner.
FAQ
Does any part of Downpay run on PHP?
No. We do not use PHP anywhere in our stack, including the app, the admin, our API and our webhook handling.
Which PHP version do you run, and when was it patched?
Not applicable. Because we don't run PHP, there is nothing to patch.
Have you found any sign these vulnerabilities were exploited against your systems?
No. We were not affected by these vulnerabilities in any manner.
Have the access tokens you hold for my store been rotated?
Not applicable. We were not affected, so there was no reason to rotate access tokens.
What customer, order or payment data from my store do you keep, and were those systems affected?
We keep the order and payment-plan records needed to run installment payments: Shopify order identifiers, order totals and currency, payment status, the payment gateway used, and payment references and error codes returned by Shopify. We do not store card numbers; payment methods are held by Shopify. We do not keep customer names, addresses or email addresses in our database; when we need to send a buyer notification we retrieve the buyer's email from Shopify at that time. We also store your shop's contact email and the name and email of the staff users who sign in to Downpay. None of these systems were affected by these vulnerabilities.
Questions? Contact us at support@hypehound.io and we'll be glad to help.