StoreRocket was patched as soon as the fix was released, and there is nothing you need to do.
What PHP2Shell is
PHP2Shell is the name given to two critical vulnerabilities in PHP, published on 21 October 2026 as CVE-2026-109618 and CVE-2026-109619. PHP is a programming language used by a very large share of the web, so platforms everywhere were affected and many merchants are now asking their vendors to confirm their status.
Where StoreRocket stands
StoreRocket's servers do run PHP, so they were in scope. They were patched as soon as the fix was released, and we have found no evidence of compromise.
The locator on your own website is not affected either way. That part is JavaScript running in your visitor's browser, and it loads its data from StoreRocket.
What you need to do
Nothing. Specifically, you do not need to:
reinstall StoreRocket or re-add your embed code
reconnect your Shopify, WordPress or other integration
rotate your API key or change your password
change any setting in your dashboard
If you are completing a vendor security review
We publish our advisories at storerocket.io/security. Each one is dated and says what was affected, what we did, and whether anything is required from you. That page is the source to cite in a vendor file or questionnaire.
If your review needs something the page does not cover, message us on live chat and we will answer it directly.
Reporting a vulnerability
Email [email protected] with a reproducible proof of concept. We review every report that includes one.
We do not operate a bug bounty programme and do not offer monetary rewards, and automated scanner output is not reviewed.
Questions? Message us on live chat.