On this page
On October 21, 2026, three security issues were made public. Each one affects many web apps. You may have seen the news and asked if your store is safe.
Your bookings and customer data are safe. Here is how each issue affects Easy Appointment Booking.
Summary
| Issue | Does it affect us? | What we did |
|---|---|---|
| PHP "PHP2Shell" flaws | No | Nothing needed. We do not use PHP. |
| Node.js security release | We run Node.js | We installed the fixed version the same day. |
| Railway platform breach | No | Nothing needed. We do not host on Railway. |
PHP: not affected
PHP released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Together they are called "PHP2Shell". They let an attacker run code on a web server that uses PHP.
Easy Appointment Booking does not use PHP. No part of the app runs on it, so these flaws cannot reach your data.
Node.js: patched the same day
The Node.js team released fixes for 10 issues in Node.js 22, 24, and 26. The most serious one, CVE-2026-111497, is a flaw in how Node.js decodes compressed data.
Easy Appointment Booking runs on Node.js 24. On October 21, the day the fixes came out, we upgraded the app to Node.js 24.22.1, the fixed version. We know of no attempt to use these flaws against our app.
Railway: not affected
Railway, a hosting company, reported a breach of the systems that store its customers' secret keys.
We do not host Easy Appointment Booking on Railway, and we do not keep any keys or data there. The breach did not expose any of our keys or your data. You can see every service we use on our subprocessors list.
How we protect your data every day
Security is not a one-time task. We check our systems all the time:
- We watch for security news. When a new issue affects a tool we use, we check it the same day and fix it fast.
- We keep our software up to date. Automated tools tell us when a package we use has a new release or a known flaw. We review and install those updates.
- We review our code and setup. We audit our app, our servers, and our access rules on a regular basis, and we fix what we find.
- We encrypt your data. Data is encrypted when it moves and when it is stored.
- We limit access. Production systems need multi-factor sign-in, and each store's data is kept apart from every other store's.
- We use only services we list. Our subprocessors list names every service that handles your data.
For more detail, see our Trust Center.
Questions?
If you have a question about your store's security, contact us through the chat in the app. We are happy to help.
