> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.omegatheme.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Is Blockify affected by the October 2026 checkout hijacking and PHP vulnerabilities?

**No.** Blockify is not among the apps affected by the checkout hijacking reported between 10 and 21 October 2026, and it is not affected by CVE-2026-109618 or CVE-2026-109619. We completed a security review on 21 October 2026 and found no unusual activity in our systems.
Merchants are reviewing their installed apps right now, and that is a reasonable thing to be doing. The rest of this page is the detail behind that answer: what Blockify does inside your store, what it has no ability to do, and how you can confirm each line yourself rather than taking our word for it.
We will not tell you that any app is risk-free. Nobody can promise that honestly. What we can do is make our side checkable.
This page is kept up to date and dated. Anything specific to the October 2026 incidents is in its own section near the bottom.
---
## What Blockify can and cannot do in your store
| Question | Blockify | How to verify |
| ---- | ---- | ---- |
| Can anyone paste custom JavaScript or HTML into this app? | No. The app has no field that accepts code. | Open any rule, then Settings. No field takes code. |
| Does the app inject scripts into your storefront? | Only its own UI: trust badges, discount banners, checkout messages. Content comes from your settings. | DevTools → Network → JS at checkout. See steps below. |
| Does it replace or redirect your checkout? | No. It runs inside Shopify's native checkout through official checkout extensions. | The address bar stays on your domain or Shopify's throughout. |
| Does it read or store payment card data? | No. It receives country, address, order total, and the selected payment method. | Settings → Apps and sales channels → Blockify → review granted scopes. |
| Does the app or its infrastructure run PHP? | No. CVE-2026-109618 and CVE-2026-109619 do not apply. | See the October 2026 section. |
| Independent audit | SOC 2 Type II, held since before the October 2026 incidents. | Report available under NDA on request. |
| Last security review | 21 October 2026 | See the log below. |
| These rows are not a marketing summary. They are the questions merchants actually sent us in October 2026, one row each. They are worth asking of any app you have installed, including ours, and an app that cannot answer a row is telling you something. |  |  |
---
## Check it yourself in two minutes
These checks work on any store, whichever apps you run.
**Step 1:** Open your store in a new private or incognito window, add an item to the cart, and go to checkout.
**Step 2:** Watch the address bar at every stage. It should stay on your own domain or on a Shopify domain. Anything else, in particular a domain ending in `.top`, is a problem.
**Step 3:** Open DevTools, go to the Network tab and filter to JS. Every request should be on your domain, a Shopify domain, or blockifyapp.com.
**Step 4:** Repeat Step 1 in a fresh private window. A malicious script of the kind seen in October 2026 runs once per browser session, so a second test in the same tab can look clean when it is not.
**Step 5:** In your Shopify admin, go to **Online Store → Themes → Customize → App embeds** and turn off anything you do not recognise.
**Step 6:** Go through your installed apps and note which ones have a field for custom JavaScript or HTML. Open those fields and read what is in them.
---
## October 2026: the checkout hijacking and the PHP vulnerabilities
Two separate things happened in the same week, and merchants are asking about both at once.
**The checkout hijacking.** From 10 October 2026, shoppers on a number of Shopify stores were redirected from the Checkout button to a fake payment page on a look-alike domain. The page captured card and billing details, showed an error, then forwarded the shopper to the real checkout, so merchants saw normal orders. The code did not come from Shopify or from themes. It came through third-party apps that offer a field for custom JavaScript or HTML, after an attacker reached the developer's systems. Shopify confirmed its core checkout was not compromised, released a security check command for developers on 15 October, and posted new requirements for app partners on 20 October.
Blockify is not among the affected apps, and we found no unusual activity in our systems. The first row of the table above is the reason this technique has nowhere to land in our app.
We are not naming the apps involved. Where a developer has confirmed an incident, their own announcement is the accurate source, and an independent timeline is linked at the end.
**The PHP vulnerabilities.** CVE-2026-109618 and CVE-2026-109619, known together as php2shell, were disclosed on 20 October 2026 and patched on 21 October 2026. They allow remote code execution on servers running affected PHP versions and are being exploited. They have nothing to do with the hijacking above beyond timing. Blockify is not affected, because neither the app nor its supporting infrastructure runs PHP.
**What we did.** On 21 October we ran Shopify's `shopify app security check`, reviewed every access scope we request and removed what we no longer use, audited how we store and rotate API tokens, and confirmed our logging covers every call the app makes to your store.
---
## For your security team
If you are running a vendor review and need an answer in writing, this is ours:
> Blockify Checkout is not affected by CVE-2026-109618 or CVE-2026-109619. Neither our application nor its supporting infrastructure runs PHP, so no remediation is outstanding on our side.
> Blockify is not among the apps affected by the October 2026 Shopify checkout hijacking. The app has no field that accepts custom JavaScript or HTML, renders only its own configured UI on the storefront, does not replace or redirect checkout, and does not process or store payment card data.
> Blockify holds SOC 2 Type II certification, obtained before these incidents. The full report is available under NDA on request.
Send us your questionnaire in the app chat and we will complete it within one business day rather than pointing you back at this page.
---
## If you find a redirect on your store
This applies whichever app turns out to be the cause, including if it is ours.
**Step 1:** Put your store behind password protection in **Online Store → Preferences** so no further shoppers reach checkout.
**Step 2:** Disable the app embed you suspect. Do not uninstall the app yet.
**Step 3:** Save evidence before anything changes: screenshots, the full URL of the fake page, and the time you saw it.
**Step 4:** Contact Shopify Support and the app developer, and ask that developer for removal instructions. Uninstalling an app does not always remove every change it made to your theme.
**Step 5:** Tell affected customers to contact their card issuer, and check whether you have a breach notification obligation in your market.
If you want a hand working out which permissions your installed apps hold, ask us. We will help with that, including with ours.
---
## Security log
Newest first. We review this every quarter and add at least one entry.
**21 October 2026** — Ran Shopify's app security check. Reviewed all access scopes and removed unused ones. Audited API token storage and rotation. Verified logging coverage. Confirmed Blockify is not affected by the checkout hijacking or by CVE-2026-109618 and CVE-2026-109619.
---
## What we do not claim
We do not say Blockify is one hundred percent safe, and we would treat any app that says so about itself with caution. Security is a set of specific properties, not a promise, which is why this page is a list of properties you can check rather than a statement of intent.
We also do not comment on other developers' systems. We have no visibility into them, and anything we said would be guesswork.
---
## Contact
Message us in the Blockify app with any security question and we will reply the same working day. If you are reporting a vulnerability, send it the same way and we will confirm receipt within one working day and keep you updated until it is closed.
---
## Related
* Omega Trust Center: https://www\.omegatheme.com/trust-center
* Independent timeline of the October 2026 incident: https://letsmetrix.com/blogs/shopify-checkout-hijacking-october-2026
---
*Updated 23 October 2026.*