On 21 October 2026 the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. They allow unauthenticated remote code execution on servers running PHP, and many merchants are reviewing the apps connected to their stores. Here is where Progus Store Locator stands.
Does Progus Store Locator use PHP?
No. Our backend and API services run on Node.js. The map script, widget and other files delivered to your shop are static files served through Cloudflare. No server in our platform runs PHP, and no service that processes your store data runs PHP.
Have you updated to a patched PHP version?
Not applicable. There is no PHP installation on our side, so the patched releases (PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12) do not apply to our platform.
Is there any indication of exploitation or data access?
No. These vulnerabilities affect only servers running PHP, so they cannot be exploited against our services. We have no indication that any store data was accessed or affected.
Do you need written confirmation?
You can use this article as our statement. If you need the confirmation by email for your records, contact us and we will send it.