Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Definition

River is the name of an AI agent used inside Shopify. Its existence has been made public through the company's engineering blog and posts from its leadership, and it embodies a way of working in which employees delegate parts of their daily work to an AI agent.

It is not a publicly available product but an internal system at Shopify. Detailed internals and architecture go beyond what has been published, so there is only so much that can be stated definitively from the outside.

Background

River stands out as a case where an ecommerce platform vendor itself has spoken publicly about weaving AI agents into its internal operations. It reflects a stance that treats AI not merely as a feature shipped inside a product, but as infrastructure that reshapes how an organization works.

That message carries weight for partners and agencies in the Shopify ecosystem. If the platform side moves toward development and operations that assume AI agents, the teams building and maintaining on top of it are likely to face the same shift.

Flagship's Involvement

We covered River in our three-part “AI-first” column series — how it relates to Shopify's company-wide monorepo “World,” how human feedback accumulates as codebase knowledge through “pebbles,” and the design of Aquifer, the agent infrastructure that runs it. Part 3, “From DX to AX (Agent Experience),” goes into the most depth.

Flagship, too, is building AI agents into its own development workflow — design, implementation, and review — and treats River, a case of the platform itself shifting to agent-first ways of working, as a reference point for how a partner team should be organized. River itself is an internal Shopify system; it is not something we use or deploy directly.

Related links