# Most Viewed Products by Luke is not affected by the October 2026 critical PHP vulnerabilities (php2shell)

> Most Viewed Products does not run on PHP, so the October 2026 php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) do not apply to it.

Source: https://ginner-tech.com/blog/php2shell-most-viewed-products-not-affected/  
Published: 2026-10-22  
Updated: 2026-10-28

[Company / security news](https://ginner-tech.com/blog/?topic=company-security-news)

22 October 2026 · Luke Tran · 1 min read

## The advisory

In October 2026 the PHP project and national CERTs published advisories for two critical vulnerabilities commonly referred to as **php2shell** – **CVE-2026-109618** and **CVE-2026-109619**. Fixed PHP releases include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Merchants are rightly asking every installed app whether any part of the service runs on PHP.

## Our review

**Short answer: Most Viewed Products by Luke is not affected.**

We reviewed our production service for Most Viewed Products by Luke – including the app itself, admin experience, APIs, and webhook handling. **It does not run on PHP.** The php2shell issues therefore do not apply to our stack. Most Viewed Products by Luke remains in good condition with respect to this advisory.

## What merchants should still do

If other apps or themes on your store *do* use PHP (or embed PHP), follow the official guidance and patch those systems promptly. For background, see the [CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) and the [PHP Foundation note](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/).

Luke Tran / Ginner Tech

**Tags**

- Most Viewed Products
- PHP
- Security

Luke Tran

Founder and senior full-stack developer

Luke has worked with Shopify and WordPress for more than 12 years and runs five apps on the Shopify App Store. [More about us](https://ginner-tech.com/about/)

**More posts**

[Previous post Image Mapper – Shoppable Image is not affected by the October 2026 critical PHP vulnerabilities (php2shell)](https://ginner-tech.com/blog/php2shell-image-mapper-not-affected/) [Next post AHA – Onboarding Tours is not affected by the October 2026 critical PHP vulnerabilities (php2shell)](https://ginner-tech.com/blog/php2shell-aha-onboarding-tours-not-affected/)

## Keep reading

[All insights](https://ginner-tech.com/blog/)

- Company / security news
  **[AHA – Onboarding Tours is not affected by the October 2026 critical PHP vulnerabilities (php2shell)](https://ginner-tech.com/blog/php2shell-aha-onboarding-tours-not-affected/)**
  AHA – Onboarding Tours does not run on PHP, so the October 2026 php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) do not apply to it.
  22 October 2026 · 1 min read
- Company / security news
  **[Image Mapper – Shoppable Image is not affected by the October 2026 critical PHP vulnerabilities (php2shell)](https://ginner-tech.com/blog/php2shell-image-mapper-not-affected/)**
  Image Mapper does not run on PHP, so the October 2026 php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) do not apply to it.
  22 October 2026 · 1 min read
- App blog: AHA - Onboarding Tours
  **[How to Launch a New Collection with a 4-Step Store Tour](https://ginner-tech.com/blog/launch-a-new-collection-with-a-4-step-store-tour/)**
  A new collection usually gets a banner and an email. A four-step store tour walks shoppers across the collection page and points at what matters. Here is how to build it.
  28 October 2026 · 4 min read

## Tell us what you are building

Tell us about your project in a short message.

[Start a project](https://ginner-tech.com/contact/) [Email us](mailto:lucdkny@gmail.com)