The advisory
In October 2026 the PHP project and national CERTs published advisories for two critical vulnerabilities commonly referred to as php2shell – CVE-2026-109618 and CVE-2026-109619. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Merchants are rightly asking every installed app whether any part of the service runs on PHP.
Our review
Short answer: AHA – Onboarding Tours is not affected.
We reviewed our production service for AHA – Onboarding Tours, including the app itself, admin experience, APIs, and webhook handling. It does not run on PHP. The php2shell issues therefore do not apply to our stack. AHA – Onboarding Tours remains in good condition with respect to this advisory.
What merchants should still do
If other apps or themes on your store do use PHP (or embed PHP), follow the official guidance and patch those systems promptly. For background, see the CISA alert and the PHP Foundation note.
Luke Tran / Ginner Tech
