Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Definition

A third-party app for bulk importing and exporting Shopify data — products, orders, customers, inventory, metafields, and more — via CSV and Excel. It is hardly an exaggeration to say that almost anything the Shopify API can do, Matrixify can do through an Excel file.

Background

The de facto standard in day-to-day operations, covering what Shopify's native CSV features cannot: column-level control, differential updates, and handling large data volumes.

Flagship's Involvement

We use it daily for data migrations, emergency bulk metafield fixes, and inventory synchronization. Back when Matrixify was still called Excelify, Flagship served as its exclusive distributor in Japan, providing customer support in Japanese.