> ## Documentation Index
> Fetch the complete documentation index at: https://docs.depict.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619

> Depict is not affected by the critical PHP vulnerabilities disclosed on 21 October 2026.

**Published:** 22 October 2026 · **Status:** Not affected

Depict is not affected by the critical PHP vulnerabilities disclosed on 21 October 2026.

## What happened

The PHP project released fixes for two vulnerabilities that let an attacker run code on a server running PHP without logging in. Shopify has asked app developers who run PHP to patch their servers and rotate their app secrets.

## Why Depict is not affected

None of Depict's apps, APIs, backend services or infrastructure use PHP. Our platform runs on TypeScript (Cloudflare Workers) and Python services. The Depict code on storefronts is browser-side JavaScript. After the advisory was published we reviewed our application code, container images and infrastructure configuration, and found no PHP anywhere in our environment.

## What merchants need to do

Nothing for Depict. You don't need to update the app, change any code or rotate credentials or access tokens because of this advisory.

If you are reviewing other vendors, keep in mind that the advisory applies to the servers each vendor runs. If your e-commerce platform, storefront or other apps use PHP, check with those providers directly.

If you need a written confirmation for your security records, contact [support@depict.ai](mailto:support@depict.ai).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.