Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Contact us
Contact
Back to Glossary

Checkout Extensibility

ShopifyStorefront & UX

Definition

Shopify's checkout customization platform, replacing the legacy checkout.liquid. Customizations are built by combining Checkout UI Extensions, Shopify Functions, and Web Pixels.

Background

checkout.liquid was retired on August 28, 2025, making migration to the new platform mandatory for Plus merchants. It represents a major strategic shift by Shopify toward a checkout experience that is secure, upgrade-safe, and consistent across surfaces.

Flagship's Involvement

We have carried out checkout.liquid → Checkout Extensibility migrations for major Plus merchants. The know-how is consolidated by our internal Technology Platform Team and rolled out as shared components.

Back to Glossary Top