Profily – Smart Profile is not affected by this week’s critical PHP vulnerabilities (php2shell)
Profily – Smart Profile does not run on PHP and is not affected by the php2shell advisories (CVE-2026-109618 / CVE-2026-109619).
Luke Tran
Blog Article
This week the PHP project and national CERTs published advisories for two critical vulnerabilities commonly referred to as php2shell — CVE-2026-109618 and CVE-2026-109619. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Merchants are rightly asking every installed app whether any part of the service runs on PHP.
Short answer: Profily – Smart Profile is not affected.
We reviewed our production service for Profily – Smart Profile — including the app itself, admin experience, APIs, and webhook handling. It does not run on PHP. The php2shell issues therefore do not apply to our stack. Profily remains in good condition with respect to this advisory.
Access tokens
We do not rely on long-lived store access tokens. Access is handled with tokens that are refreshed regularly as part of normal operation. No emergency token rotation is required solely because of this PHP advisory.
What merchants should still do
If other apps or themes on your store do use PHP (or embed PHP), follow the official guidance and patch those systems promptly. For background, see the CISA alert and the PHP Foundation note.
— Luke Tran / Ginner Tech
