Depict is not affected by the October PHP vulnerabilities
None of Depict's apps, APIs or infrastructure run on PHP, so the critical PHP vulnerabilities disclosed on October 21 don't affect Depict. You don't need to do anything.
On October 21, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell. They let an attacker run code on a server that runs PHP without logging in.
Depict doesn't use PHP anywhere in its stack. Our apps, APIs and backend services run on TypeScript and Python, and the Depict code on your storefront runs in the shopper's browser. After the disclosure, our engineering team reviewed our application code, container images and infrastructure and found no PHP anywhere.
You don't need to update the app, change any code, or rotate credentials or access tokens because of this. If your ecommerce platform, theme or other apps use PHP, check with those providers directly.
This update applies to Depict on every platform we support: Shopify, Centra, Salesforce Commerce Cloud and custom storefronts.
Published on October 23, 2026