You may have heard about serious vulnerabilities related to a programming framework called PHP.
We do not code with PHP and we do not install the PHP framework on our servers.
If your solution comprises software previously written in PHP and you'd like us to take a look, please open a support case.
If you do have internet-facing apps using PHP you may wish to take them offline until security fixes have been issued.
This critical announcement is still ongoing. The patches should be released today at 3pm UK time.
If you use Shopify, the following may be useful to you. Note that the app called "DTM Synchroniser" if installed by us does not use PHP and does not need to be disabled:
Since your store is hosted directly on Shopify's official platform, the underlying infrastructure is managed entirely by Shopify, meaning you do not have to worry about server-level PHP vulnerabilities or patching the PHP runtime yourself.
However, third-party apps installed on your store can still introduce security risks if they process your data on external, vulnerable PHP servers.
Here is how to check your installed apps and secure your Shopify admin dashboard:
🔍 Step 1: Audit Your Installed Apps
To see exactly what tools, plugins, or integrations have access to your store:
1. Log in to your Shopify Admin dashboard.
2. In the left-hand navigation menu, click on Apps.
3. Select Apps and sales channel settings to view the complete list.
4. Review every item. If you see any app that you do not recognise, do not use, or that looks suspicious, click Uninstall immediately.
🛡️ Step 2: Check App Permissions
Even legitimate apps can become targets if their developers suffer a data breach.
• While viewing your installed apps list, click on individual apps to view their Permissions.
• Pay close attention to apps that have permission to Modify themes, Edit storefront layout, or Manage script tags.
• Malicious scripts or checkout hijacks usually target these specific areas to inject unauthorized code.
🔒 Step 3: Secure Your Staff Accounts
Because you are fully hosted on Shopify, your biggest vulnerability is unauthorized access to your admin account.
1. Go to Settings > Users and permissions.
2. Ensure Two-factor authentication (2FA) is strictly enforced for your account and all staff accounts.
3. Review the staff list and remove anyone who no longer requires access to the store.