**Shopify checkout attack**. Since October 10, several third-party Shopify apps have had malicious code added to their storefront settings. The code redirected shoppers to fake checkout pages that captured their payment details.
**Cleverific was not affected**. Even so, we took every precaution our security and engineering policies require.
- Cleverific doesn’t load code onto your storefront through theme app extensions or app embeds. - Our app has no setting that runs custom code on your storefront. - We audited our systems and access controls. All internal access requires hardware security keys and two-factor authentication.
*PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619)*. Cleverific doesn’t run PHP, so these vulnerabilities don’t affect our systems. We also audited our vendors to confirm that each one either doesn’t use PHP or has taken appropriate steps to mitigate these vulnerabilities.
*Compromised certificate authority intermediates (eMudhra/emSign)*. On October 17, eight intermediate certificates from the certificate authority eMudhra were found to have weak private keys. Browsers and operating systems are revoking trust in them. Cleverific doesn’t use certificates from the affected certificate authority. As a precaution, we updated our base images and language runtimes so our systems no longer trust the affected certificates.
*What we recommend for your store*:
1. In your theme editor, open App embeds and review every embed that’s switched on. 2. Check any app that has a “custom JavaScript” or “custom HTML” setting, and make sure you recognize everything in it. 3. Remove apps you don’t use. 4. Test checkout in a fresh private window and confirm the address stays on your store’s domain.
If you have questions about this incident or our security practices, contact us at support@cleverific.com