PHP2Shell: Is Avada PDF Invoice Affected?

Since PHP shipped emergency fixes on 21 October 2026, merchants have been asking our support team whether Avada PDF Invoice is exposed to PHP2Shell. It isn't. The app doesn't run PHP anywhere, so these two vulnerabilities have nothing to attack. Below is what PHP2Shell is, how we confirmed the app is clear, and what to ask the other apps on your store.

What is PHP2Shell?

PHP2Shell is the name researchers gave to two critical bugs in PHP, the language behind a large share of websites and web servers. Each carries a CVSS v4.0 score of 9.2.

Nothing patches itself here. Whoever runs PHP on their own servers has to upgrade, or pull the fixed package from their Linux distribution or hosting provider.

Is Avada PDF Invoice affected?

No. PHP2Shell can only hurt a system that runs PHP, and we checked three places to make sure ours doesn't.

• The app's code has no PHP files and no Composer packages (Composer is PHP's package manager).
• The backend that builds your PDFs, sends invoice emails and receives order updates from Shopify runs on Node.js 22 in Google Firebase Cloud Functions.
• The app pages inside Shopify admin are served by Firebase Hosting, with no PHP server behind them.

There's nothing for you to do in the app. No update, no reinstall, no settings to change.

Your store itself runs on Shopify's platform. Shopify operates it, so send questions about Shopify's own systems to them.

How to check the other apps on your store

Plenty of teams are going through every app connected to their store right now. Ask each developer the same short questions and the replies become easy to compare.

1. List the apps that can read store data. In Shopify admin, go to Settings, then Apps, and write down every installed app. Start with anything that can read orders or customer details.
2. Ask three questions. Does your app or its servers run PHP? If so, which versions? Were they patched to a fixed release, and when?
3. Push for specifics. A good reply says what was checked. A bare "we are not affected" is hard to stand behind in a security record.
4. Keep the replies. Save each one with its date. In a vendor review, that file is what auditors want to see.

PHP has since reserved a third CVE, CVE-2026-115560, for a related session-handling bug that the 21 October releases don't fix. Our answer stays the same. No PHP runs in Avada PDF Invoice.

Who to contact about security at Avada

Open the chat inside the app or email our support team, and put "security" in the message so it lands with the right people. Need a written confirmation for a vendor review? Send us the form's questions and we'll answer each one.

FAQ

Is Avada PDF Invoice affected by PHP2Shell? No. The app runs on Node.js 22 in Google Firebase Cloud Functions and contains no PHP code or PHP packages.

Do I need to do anything in the app? No.

What are CVE-2026-109618 and CVE-2026-109619? The two PHP vulnerabilities known together as PHP2Shell. On an unpatched server they let an attacker run code without logging in. PHP fixed both in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Is my Shopify store affected? Your storefront and admin run on Shopify's platform, which Shopify operates. For installed apps, ask each developer whether they run PHP and when they patched.

Sources

• Help Net Security: PHP2Shell, critical PHP vulnerabilities patched
• Qualys: PHP2Shell, find, mitigate and patch now
• Ubuntu: php2shell vulnerability fixes available
• Datadog Security Labs: PHP2Shell detection, analysis and remediation
• Cloudflare: protections against php2shell
• BleepingComputer: CISA confirms PHP2Shell vulnerabilities now exploited in attacks
• BleepingComputer: PHP shares mitigation for new and unpatched RCE vulnerability