Blog
Shopify checkout hijack: our apps are not affected, and why the attack pattern does not reach them
October 23, 2026
Between 10 and 14 October 2026 shoppers on a number of Shopify stores were redirected to fake checkout pages through scripts injected into the storefront code of three well-known apps. None of our apps was involved. Here is how we checked each one against the pattern, and what to look for in any app that adds something to your theme.
PHP2Shell (CVE-2026-109618, CVE-2026-109619): our apps are not affected, and how we keep it that way
October 22, 2026
On 21 October 2026 PHP shipped fixes for two critical remote code execution bugs, and merchants started asking every app vendor the same question. Here is our answer, and a new page that describes how the Workflow apps are built and protected.
Product cards, discount codes and invoices from metafields in your Shopify Flow emails, and all five apps in your language
September 28, 2026
Workflow Transactional Email 1.17 adds thirteen content blocks, unique discount codes, a live countdown and attachments from order metafields, on top of the marketing emails of 1.16. All five Workflow apps now follow your admin language, and Workflow Suite, our own automation platform, is live.
Send every customer the email in their language, and everything else new in September
September 18, 2026
Workflow Transactional Email now sends each customer the email in their own language, straight from Shopify Flow. Plus storefront triggers, scheduled webhooks, ERP-ready functions and a new admin look across all four Workflow apps.
App update, September 2026: custom triggers, synchronous webhooks and AI-written functions
September 2, 2026
Everything that shipped across the four Workflow apps since the start of August: synchronous webhook responses, custom triggers you write yourself, GitHub sync, scheduled functions, and a Developer API on all four.