PHP2Shell (CVE-2026-109618, CVE-2026-109619): our apps are not affected, and how we keep it that way

On 21 October 2026 the PHP project released fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. They sit in the PHP engine itself, so they affect every web server running PHP 5.4 or later, whatever application sits on top. Security researchers confirmed unauthenticated remote code execution against several PHP applications, a public exploit tool exists, and over the following days there were reports of services and apps being compromised through it.

Since then we have been asked the same question by several merchants, which is exactly the right thing to do: does any part of the apps I connected to my store run on PHP?

Our answer

No. None of our apps contain PHP, so these vulnerabilities do not apply to them and there was nothing for us to patch.

That covers Workflow Trigger Extensions, Workflow Webhooks, Workflow Transactional Email, Workflow Functions, Workflow Suite, Workflow Forms and Workflow Documents. Every one of them is written in TypeScript and runs on Node.js, with PostgreSQL and Redis behind it, on Google Cloud in the European Union. There is no PHP runtime in any of our services or container images. We also reviewed our access logs after the disclosure: the only PHP-related traffic was the usual background scanning for files like index.php that every public host receives, all of it answered with 404 because there is nothing there to run.

Why we wrote it down

A question like this deserves an answer you can file, not just a reply in a ticket. So we published a page that describes, for all our apps, what they are built on, where they run, how your data is encrypted and isolated, how we keep them patched, and how to report a security issue: Security at Code Creation Labs. Workflow Trigger Extensions, our most widely installed app, has its own version with the details specific to it.

The short version of what is on that page:

• One stack, kept current. TypeScript on Node.js, PostgreSQL, Redis, Google Cloud europe-west1. Container images are rebuilt with every release, so runtime and operating system patches ship continuously.
• Every change is scanned before it ships: static analysis, secret detection, dependency and container vulnerability scanning, with a release bar of zero known vulnerabilities.
• Encryption at rest and in transit, plus a second layer for the sensitive values: your Shopify access token, credentials you enter and protected customer data are encrypted per record under separate keys in Google Cloud KMS.
• Strict tenant isolation: every record belongs to one store and every query is scoped to the authenticated store.
• Regular security reviews of every route and data path, most recently this month.

If you have a security questionnaire to complete, or an advisory you would like us to check against our apps, write to support@codecreationlabs.com. We answer those with priority.