Last updated: October 28, 2026
Is Rebuy safe?
Yes. Rebuy patched every affected system on October 21, 2026, found no evidence that anyone exploited the vulnerabilities, and continues to monitor the platform.
- The vulnerabilities were in PHP (including "PHP2Shell"), Node.js, Go, and several Certificate Authorities, technologies that run a large share of the internet.
- Rebuy merchants don't need to change anything.
- Multi-factor authentication (MFA) is now on for every Rebuy account.
What vulnerabilities did Rebuy patch?
On October 21, 2026, the teams behind PHP, Node.js, Go, and several Certificate Authorities (CAs) announced new security vulnerabilities. This was an industry-wide event. These technologies run a large share of the internet, including parts of the Rebuy platform, and many Shopify merchants have since reviewed the apps on their stores. Rebuy patched each vulnerability the same day it was announced.
- PHP: Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (known as "PHP2Shell"), that targeted a PHP feature called session upload progress
- Node.js: A vulnerability fixed in a newly released version of Node.js
- Go: Vulnerabilities fixed in newly released versions of Go
- Certificate Authorities: Some CAs, the organizations that issue the certificates behind secure web connections, were found to be compromised
Was merchant data affected?
Rebuy found no evidence that these vulnerabilities were exploited on its platform. After patching, Rebuy's engineering team reviewed logs and monitoring data and confirmed that its servers run the fixed versions and settings. Rebuy continues to monitor the platform to keep merchant and shopper data safe.
What did Rebuy do to fix the vulnerabilities?
Rebuy's engineering team worked in three stages: contain the risk, patch the software, and verify the fix.
1. Rebuy put firewall protections in place right away
- Turned on Cloudflare's emergency firewall rules to block known attack patterns
- Monitored inbound Cloudflare traffic for suspicious activity during the fix
- Disabled the PHP feature the vulnerabilities targeted (session upload progress)
2. Rebuy patched every affected system
- Patched both PHP vulnerabilities (PHP2Shell) within hours
- Removed the compromised Certificate Authorities
- Upgraded to the patched version of Node.js
- Upgraded to the patched versions of Go
3. Rebuy verified the fix
- Confirmed Rebuy's servers run the fixed versions and settings
- Reviewed logs and monitoring data and found no evidence of exploitation
Do Rebuy merchants need to take action?
No. Rebuy merchants don't need to change their store, their Rebuy settings, or their shopper data. Rebuy made every fix on its own systems. The only change merchants will see is an MFA challenge when they log in to Rebuy or save custom code.
What is changing when merchants log in to Rebuy?
On October 21, 2026, Rebuy turned on multi-factor authentication (MFA) for all customers. The next time a merchant logs in to Rebuy, Rebuy will ask for an MFA code. MFA adds a second check at login, so a stolen password alone can't open a Rebuy account.
Since October 23, 2026, saving any custom code in Rebuy that will be deployed to a merchant's online store requires an MFA challenge. This covers Smart Cart code, widget callbacks and templates, theme CSS, landing page templates, and A/B test code. Only a verified team member can change code that runs on a merchant's storefront. See how custom code verification works.
How does Rebuy protect carts and checkouts during BFCM?
Rebuy scans custom code, such as scripts, CSS, and templates, for anything unusual and flags it for manual review by Rebuy's security team. Since October 23, 2026, every change to custom code also requires an MFA challenge before Rebuy saves it. As with any app that runs on a storefront, a quick test checkout before Black Friday Cyber Monday (BFCM) or any big sales period is good practice.
How does Rebuy approach security?
Fast patching is one part of Rebuy's standing security program. Rebuy continuously scans vulnerability registries and security news sources for newly announced vulnerabilities. Rebuy runs annual penetration tests with an independent firm, continuous application security testing, and cloud security analysis on Google Cloud. Rebuy also uses frontier AI models to proactively scan its application for weaknesses. Rebuy's security policies and documentation are in the Rebuy Trust Center.
What security updates are next for Rebuy?
Rebuy will keep releasing security updates across the platform, including:
- More MFA methods
- Single sign-on (SSO) through identity providers (IdP), so teams can log in to Rebuy through the provider they already use
Where can merchants find Rebuy security documentation or ask a question?
Rebuy's security policies and practices are covered in the Rebuy Trust Center, the Data Processing Addendum, and the Security & Privacy page. For anything else, merchants can contact Rebuy Support or their Customer Success Manager.
Contact Rebuy Support →
.png)