Altera is not affected by the PHP2Shell vulnerabilities. Your store data is not at risk from this issue, and you don’t need to take any action.
On October 21, the PHP project released fixes for two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Some of you have asked whether this affects Altera, so we wanted to explain why your data is safe.
Altera does not use PHP. The servers that handle your imports, exports, and data are therefore not exposed to these vulnerabilities.
We do have one PHP server for testing WooCommerce migrations, but it contains no customer data:
- It runs with a different hosting provider and shares no login credentials with the rest of our infrastructure.
- We took it offline on October 21 as a precaution and will keep it offline until it is safe to bring back.
You don’t need to make any changes to your Shopify store or Altera account. If you have any questions, reach out through the chat in the app. We’re happy to help.