【Notice】About GO SUB’s Security Measures

Regarding the PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) announced on October 21, 2026, "GO SUB" does not use PHP, so there is no impact. Regarding the impact on SUB, see“About the impact of PHP vulnerabilities on GO SUB”).

In addition, we would like to inform you about the security measures implemented at GO SUB.

Status of response to this vulnerability

• PHP is not used in the application itself or in the API link with Shopify. The latest security patches as of October 22nd have been applied to the
• base software.
• At this time, there are no signs of unauthorized access or information leaks exploiting this vulnerability.

Security measures implemented at GO SUB

• Implementation of vulnerability tests
  • We conduct vulnerability tests from time to time using the app security check provided by Shopify. Even after this PHP vulnerability was announced, we conducted tests and confirmed that there were no problems.
• Information Security Management
  • Our company has obtained Information Security Management System (ISMS) certification (JIS Q 27001:2023/ISO/IEC 27001:2022). The scope of certification registration is EC site production and operation, digital marketing, and application development (initial certification: January 27, 2023, re-certification: October 29, 2025, expiration date: November 28, 2028). For more information, please see"Information Security Policy".
• Access Management
  • Access to the GO SUB operational environment is limited to those who need it for business purposes. Access privileges are reviewed regularly. I have multi-factor authentication set up for my administrator account.
• Monitoring/Failure Response
  • When an error occurs in the system, we have a system in place to immediately notify the developer, and we promptly investigate the cause and make improvements. If a problem occurs that affects existing customers, we will contact you individually depending on the situation.
• Providing information about vulnerability
  • For information on vulnerabilities, please check"Vulnerability Disclosure Policy".

Development/Operation Structure

GO SUB development, operation, and monitoring are currently all performed by our internal members and are not outsourced to outside parties.

We will continue to monitor alerts from Shopify and others and prioritize security as our top priority. If the situation changes, we will notify you on this page.

If you have any questions, please contact us below.
app.support@goriderep.com