Skip to main content
Published: 22 October 2026 · Status: Not affected Depict is not affected by the critical PHP vulnerabilities disclosed on 21 October 2026.

​
What happened

The PHP project released fixes for two vulnerabilities that let an attacker run code on a server running PHP without logging in. Shopify has asked app developers who run PHP to patch their servers and rotate their app secrets.

​
Why Depict is not affected

None of Depict’s apps, APIs, backend services or infrastructure use PHP. Our platform runs on TypeScript (Cloudflare Workers) and Python services. The Depict code on storefronts is browser-side JavaScript. After the advisory was published we reviewed our application code, container images and infrastructure configuration, and found no PHP anywhere in our environment.

​
What merchants need to do

Nothing for Depict. You don’t need to update the app, change any code or rotate credentials or access tokens because of this advisory. If you are reviewing other vendors, keep in mind that the advisory applies to the servers each vendor runs. If your e-commerce platform, storefront or other apps use PHP, check with those providers directly. If you need a written confirmation for your security records, contact support@depict.ai.