Simple Bundles is not affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

Simple Bundles is not affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (also called PHP2Shell). Simple Bundles is built on Ruby on Rails and does not use PHP, so there is nothing to patch on our side and no action needed on yours.

Is any part of Simple Bundles built on PHP?

No. The Simple Bundles app, its servers, and its storefront components do not run PHP. These CVEs only affect servers running vulnerable versions of PHP.

Do I need to do anything in my Shopify store?

No changes are needed in Simple Bundles or your Simple Bundles settings. Your storefront and checkout are hosted by Shopify, and Simple Bundles connects to your store through Shopify's official APIs.

What if I use other tools that run on PHP?

If your business uses PHP-based software outside of Shopify, such as a WordPress site or a self-hosted server, check with that vendor or hosting provider about patching. Tenable's PHP2Shell FAQ lists the affected PHP versions.

A security scan flagged Simple Bundles. What should I do?

Contact our support team with the scan report, and our development team will review it.