Security Update: BYOB’s Review of PHP2Shell and Node.js Vulnerabilities

Following the October 21 security releases from Node.js and PHP, we reviewed BYOB’s development environment and project configuration.

BYOB uses Node.js for frontend builds, theme widget development, testing, and deployment tools. We updated our Node.js 22 and 24 installations to their latest security releases and updated the project configuration to use the patched version by default. The frontend production build and targeted tests passed after the upgrade.

We found no PHP runtime or PHP application code in the environment and project reviewed, so no PHP upgrade was required there.

Merchants do not need to change their Shopify themes or BYOB settings for this update. This maintenance does not introduce changes to bundle features or configuration. No action is required from merchants.