Trust Center

Last updated: October 26, 2026 
Status: Remediated

What happened 
On October 20, 2026, the PHP Foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Together, they can let an unauthenticated attacker run code on a server that uses affected PHP software. The combined severity score is 9.2 out of 10 (CVSS v4.0). PHP released fixes on October 21, 2026. 

Stord’s assessment 
Stord's OMS, WMS, and Commerce platforms do not use PHP and are not affected. While a limited number of separate Stord services do use PHP, we put protective controls in place on these services right away and have deployed updated PHP patches as of October 23, 2026. We will continue to assess systems, including third-party software in those environments.

What we are doing

• We put protective controls in place on the affected services after we identified them.
• We deployed updated PHP software to those services by October 23, 2026.
• We have reviewed system logs for any signs of misuse.
• We will update this page if our assessment changes.

Customer impact 
In line with our security standards, we swiftly deployed any necessary patches on relevant PHP systems. We have not identified an impact or material risk to customer data or service. If that changes, we will notify affected customers in accordance with our contractual commitments.

Questions

If you have questions, contact security@stord.com

Last updated: October 26, 2026

Status: Remediated

What happened On October 21, 2026, the Node.js project released fixes for CVE-2026-111497, a flaw in the widely used Brotli data-decompression library. The Bun runtime and the Python Brotli package released fixes on October 22 and 23. Applications that process specially crafted Brotli-compressed data from untrusted sources could experience a denial of service condition or, in some circumstances, remote code execution. At this time, there are no known reports of exploitation in the wild.

Stord's assessment Stord's Commerce platform included affected software components and was updated and redeployed on October 24, 2026. Stord's proprietary OMS and WMS services are not affected by this vulnerability. A limited number of additional services and internal tools were identified as using affected versions and were remediated as part of our response. We have not identified any evidence that this vulnerability was exploited in our environment.

What we are doing

• We reviewed every system using the affected software across our codebase on October 24, 2026.
• We updated and redeployed the affected production services the same day.
• We reviewed logs on the affected production services for signs of misuse and did not identify any.

Customer impact 
We have not identified an impact or material risk to customer data or service. If that changes, we will notify affected customers in accordance with our contractual commitments. 

Questions If you have questions, contact security@stord.com

Last updated: October 26, 2026 
Status: Remediated

What happened 
On October 20, 2026, researchers publicly disclosed that eight intermediate certificate authority certificates issued by eMudhra use weak keys. Browsers, operating systems, and software use certificates like these to decide which websites and services to trust. An attacker who could abuse a weak key could impersonate a trusted service, but only if the attacker could also intercept the network traffic of the target.

Stord’s assessment 
We have reviewed the disclosure against the software and services we operate. We currently assess the risk to Stord and to customer data as low. An attacker would need to both exploit the weak certificates and be in a position to intercept communications between a user and Stord services, which significantly limits practical exploitation. Software vendors and open source projects are releasing updates that remove trust in the affected certificates.

What we are doing

• We applied these vendor updates as part of our regular update cycle by October 24, 2026.
• If a vendor releases additional fixes, we will apply them once they are available or put other protective measures in place.
• We continue to monitor the situation and will update this page if our assessment changes.

Customer impact 
We have not identified an impact or material risk to customer data or service. If that changes, we will notify affected customers in accordance with our contractual commitments.

Questions

If you have questions, contact security@stord.com

As a Stord customer, nothing is more important to us than your success and the privacy of your data. This email is to notify you that Stord is making changes to our third-party sub-processors, effective June 8, 2026.

Sub-processors being removed:

Boomi
Celigo

Sub-processors being added:

Anthropic - AI language model inference powering Stord's AI product features (US)
Omni Analytics - Business intelligence and data analytics (US)
OpenAI - AI language model inference powering Stord's AI product features (US)

Stord has entered into data processing agreements with each of these providers that restrict processing of customer data solely to the provision of services to Stord, and prohibit the sale, sharing, or use of customer data outside of that direct business relationship.

What This Means for You: There will be no immediate impact on your services, and no action is required on your part.

If you have concerns about any of the new sub-processors listed above, please contact us at privacy@stord.com. To review our full list of sub-processors and the activities they perform for us, please visit our Sub-Processors List on our trust center.

Thank you for being a valued Stord customer.

Stord has updated its Privacy Policy effective April 1, 2026.

The updates reflect how we collect and use data through analytics features on merchant storefronts, including the Stord Web Pixel. These changes apply only to merchants who opt in to the Stord Web Pixel. Key changes include how we describe the collection of browsing behavior and pre-purchase events on merchant storefronts, how identity resolution works at checkout, and the retention period for merchant storefront data.

You can review the full updated policy at stord.com/legal/privacy-policy.