Last updated: 22 October 2026
On 21 October 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Security researchers call these issues “PHP2Shell”. They can let an attacker run code on a server that uses PHP to serve web pages, without a login. For full details, see the PHP security advisory and the CISA alert.
Instant is not affected. Instant does not use PHP in its code base, so these vulnerabilities do not apply to the Instant platform or the Instant scripts on your store.
What we did
Our engineering team reviewed the PHP2Shell reports in detail. We confirmed that no part of the Instant platform runs on PHP.
We also added stronger security controls and a deeper review process for our code and the third-party software we use.
Our team continues to monitor this issue and any new information about it. If anything changes, we will update this article.
Note: This article is about Instant’s own code and scripts. If your store or other tools run on PHP, speak to your platform provider or developer about those systems.
FAQ
Does PHP2Shell affect the Instant script on my store? No. The Instant script does not use PHP, so PHP vulnerabilities do not apply to it.
Do I need to update or reinstall anything in Instant? No. You do not need to do anything in your Instant AI dashboard or on your store.
Does this mean my whole store is safe from PHP vulnerabilities? This article covers Instant only. Your store platform, theme, apps and hosting are separate systems. Check with each provider if they use PHP.
Who do I contact if I have questions? Contact our support team through the support form. We can help with any questions about this issue or the security of Instant.
How do I report a security concern to Instant? Follow the steps in our Responsible Disclosure Policy.
For how we handle security reports, see Responsible Disclosure Policy.