Regarding the PHP vulnerabilities disclosed on October 21, 2026 (CVE-2026-109618 and CVE-2026-109619), we have reviewed their impact on all of our Shopify apps: Japan Order CSV, Delete Me, Mockingbird, Mypage Blocks, and B2E, our employee sales app. None of these apps use PHP, so they are not affected by these vulnerabilities. Merchants using our apps do not need to take any action, such as updating or changing settings.

We continuously monitor published vulnerability information and will notify our users promptly if any impact is expected. If you have any questions about this matter, please contact the support desk for the app you use.

Back to Glossary

Theme App Extension (App Block)

Shopify

Definition

A mechanism for apps to inject functionality into Shopify themes as "blocks," without touching the theme's code. Available in OS 2.0 themes.

Background

App functionality survives theme updates, and merchants can place blocks by drag and drop. It is the key design pattern for keeping apps decoupled from client themes.

Flagship's Involvement

We implement reusable, multi-store functionality — such as employee discounts and my-page enhancements — as App Blocks.