Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Definition

The Storefront API is a GraphQL API for buyer-facing, publicly available commerce data. It lets you fetch products, variants, and collections, create and update carts, and read store content such as articles and blogs. It's device-agnostic by design, serving as the foundation for headless storefronts, mobile apps, IoT, and voice commerce — built with Hydrogen or any framework such as Next.js, Remix, Vue, or Nuxt. Unlike the Admin API, it's an unauthenticated API: anything it exposes is visible to any visitor by design. It isn't used for administrative work such as changing product records, managing inventory, or fulfilling orders.

Background

For years, the Storefront API also provided customer-related mutations — creating accounts, logging in — alongside cart and checkout. As part of a broader push to tighten protection around customer data, Shopify introduced the dedicated Customer Account API (see separate entry) for self-service customer data management, and that responsibility has shifted there for the new customer accounts. As a result, the standard mental model for a headless build today is: Storefront API for products, cart, and checkout; Customer Account API for the authenticated customer's own data.

Flagship's Involvement

Flagship's own corporate site — this Hydrogen storefront — runs on the Storefront API in production. The product listing, product detail, and collection pages under /store fetch their data via GraphQL queries against the Storefront API, and the cart (adding items, updating quantities, applying discount codes and gift cards) is built on Hydrogen's cart helper, which itself uses the Storefront API's cart mutations.