Security
Replo is not affected by PHP2Shell
Replo doesn't run PHP, so CVE-2026-109618 and CVE-2026-109619 don't apply. Details and answers to common questions.
On October 21, 2026, PHP released fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. They let an attacker run code on a server that uses PHP to handle web requests, without logging in.
Replo doesn't run PHP anywhere in its infrastructure. Replo customers don't need to do anything about PHP2Shell for their Replo account, sites, or Shopify connection.
What was checked
After the disclosure, the Replo team reviewed its codebase and every service it deploys. There are no PHP files in the codebase, and no PHP runtime is installed on any Replo server.
That covers the dashboard, the agent, the APIs, the Shopify app, and the servers that publish and host your sites.
Why this page exists
Several customers have asked whether Replo is affected, often with a vendor review due that day. Most of the Shopify app ecosystem has been getting the same question this week. This page is a link you can drop into that review instead of waiting on a reply.
This post covers PHP2Shell only. For questions about other advisories, email support@replo.app.
Frequently asked questions
- Does any part of Replo run PHP?
- No. Replo doesn't run PHP anywhere in its infrastructure. That covers the dashboard, the agent, the APIs, the Shopify app, and the servers that publish and host your sites, so there is no PHP runtime on Replo's side to patch.
- Do I need to rotate credentials because of PHP2Shell?
- Not because of Replo. Replo doesn't run PHP, so there's nothing to rotate, reinstall, or re-authorize on the Replo side. If other systems you use run PHP and were exposed, follow those vendors' guidance, which may include rotating credentials.
- What about my Shopify store?
- Your storefront, theme, and checkout run on Shopify's own infrastructure, not Replo's. Replo can't speak for Shopify's systems, so check Shopify's status page or contact Shopify support for their answer.
- Is there a statement I can share with my compliance or security team?
- Yes, this page. Link to it directly in your vendor review. If your team needs written confirmation or has a security questionnaire, email support@replo.app and the Replo team will reply.
- Who do I contact with a security question?
- Email support@replo.app. Mention that it's a security question in the subject line and it will be routed straight to an engineer, including vendor questionnaires and vulnerability reports.