Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Contact us
Contact
Back to Glossary

Technology Platform Team

Flagship

Definition

A dedicated team within Flagship conceived and operated to raise the company-wide engineering baseline across all projects.

Background

It was created to fix a structural problem: individual projects solving the same challenges — checkout.liquid migration, DMARC setup, load testing, AI adoption — in isolation, reinventing wheels and accruing technical debt. Independent of any single project, the team audits, supports, and educates across the product codebase.

Flagship's Involvement

Formalized as a team in February 2024, it carved out into an explicit role the cross-cutting work that senior engineers had previously covered organically. Its remit includes Checkout Extensibility migration support, DMARC rollout, publishing engineering guidelines, extending app boilerplates, introducing load testing and autonomous browser testing, collaboration with the AI Committee, and security testing. As an operating discipline — given that each Shopify API version is supported for roughly one year — the team consolidates API version upgrades for maintained apps into a single annual pass, scheduled in February to avoid the autumn launch season and the year-end and Golden Week rush.

Back to Glossary Top