Is Power My Analytics Affected by PHP Vulnerabilities Like PHP2Shell?

Is Power My Analytics Affected by PHP Vulnerabilities Like PHP2Shell?

Info
In October 2026, a set of serious security flaws in PHP (nicknamed "PHP2Shell") put many websites and web applications at risk, so you may be reviewing every tool your business or your clients rely on. Here's the short answer: your Power My Analytics data is not affected. Our platform doesn't use the PHP programming language, so PHP2Shell and other PHP vulnerabilities don't affect your hub, your data, or your reports.
The questions below explain what PHP2Shell is, why Power My Analytics isn't affected, and what it means for the platforms you connect, such as Shopify. We keep a close eye on security news like this so you don't have to, and we'll always let you know directly when something matters for your data.

What is PHP2Shell?

PHP is a programming language that powers roughly 70% of websites, including sites built on WordPress, Drupal, and Joomla. PHP2Shell is the name researchers gave to two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). On a server running an unpatched version of PHP, an attacker could use them to run their own code or read sensitive information, such as passwords and API keys, without logging in.
  • PHP released fixes on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
  • Security researchers have since reported attacks against servers that haven't been updated.
  • PHP has also announced a further flaw (CVE-2026-115560). Like PHP2Shell, it only affects systems that run PHP.

Does Power My Analytics use PHP?

No. Our data platform is built on Node.js and TypeScript and runs on Google Cloud (Firebase). It doesn't use PHP or PHP frameworks such as Laravel, so the systems that connect, store, and deliver your data (your hub, our data connectors, API, and MCP server) aren't exposed to PHP2Shell or any other PHP vulnerability, and there's no PHP patch for us to apply.

Do I need to do anything in Power My Analytics?

No. There's nothing you need to do. Your connections and reports are running as usual, and you don't need to reconnect data sources, change settings, or update anything in your hub.

Could a platform I connect, like Shopify, be affected?

PHP vulnerabilities affect systems that run PHP, so it helps to separate Power My Analytics from the platforms you connect as data sources:
  • Power My Analytics: not affected, as described above.
  • Your connected platforms: each platform (for example, Shopify, Google, or Meta) runs and secures its own systems. Whether a platform is affected, and what you should do about it, comes from that platform. Power My Analytics connects to platforms through their official APIs and doesn't run code on their systems.
  • Your own websites: if you or your clients run websites on PHP (for example, WordPress or WooCommerce stores), check with your web host or developer that PHP has been updated to a fixed version.
  • Shopify: Shopify hosts your store and manages its own server security. Our Shopify connector has read-only access to your store's orders, products, customers, inventory, and locations, and it doesn't add any code or scripts to your storefront or checkout. That also means it can't be used to insert the kind of fake checkout scripts reported with some Shopify apps in October 2026.
Notes
Tip: If you change a password, API key, or app permission on a connected platform as a precaution, you may need to reconnect that data source in your hub afterward.

How does Power My Analytics keep my data secure?

Our security practices are independently audited and certified:
  • SOC 2 Type II certified, covering security, availability, processing integrity, confidentiality, and privacy.
  • ISO 27001 certified. You can download our certificate from Where Can I Obtain a Copy of Power My Analytics' ISO 27001 Certification?
  • GDPR compliance, including breach notification within 72 hours and Data Processing Agreements on request.
  • Encryption of your data at rest (256-bit AES) and in transit (TLS).
  • Annual third-party penetration testing and a formal vulnerability management policy for finding and fixing security issues.
To learn more, see How Does PMA Secure My Data? and Is Power My Analytics GDPR Compliant?