Apps offline for a PHP security patch

Started October 21, 2026, 9:10 AM ET

Operational October 21, 2026, 11:42 AM ET

Custom Fields is back online with the security patch applied. Open it from your Shopify admin as usual. The login prompt is gone and no username or password is needed.

Arigato Automation and Customer Account Fields are still offline. Arigato events continue to queue and will process automatically once it is back online. We will post here as soon as they are.

Offline October 21, 2026, 9:10 AM ET

A severe security vulnerability was recently disclosed that affects all websites running PHP, including our apps. At 9:10 AM ET, we took Arigato Automation, Custom Fields and Customer Account Fields offline as a precaution. They will stay offline until the security patch is applied.

Arigato Automation: workflows are paused and the app admin will not load. No events will be lost. Everything that comes in while the app is offline is queued and will process automatically once we are back online.

Custom Fields: your storefront is not affected. Opening the app from Shopify shows a login prompt while it is offline. You do not need a username or password; close or cancel the prompt.

We will post an update here as soon as everything is back online.

Timeline (ET)

1. 12:07 PMWe are testing the security patch for Arigato Automation before bringing it back online. Arigato events are still queued and will process automatically once it is back.
2. 11:42 AMCustom Fields is back online with the security patch applied. Open it from your Shopify admin as usual; the login prompt is gone. Arigato Automation and Customer Account Fields remain offline.
3. 11:34 AMThe security patch for Custom Fields passed testing and is being deployed. We will post here as soon as Custom Fields is back online. Arigato Automation and Customer Account Fields remain offline.
4. 10:15 AMWe are testing the security patches before bringing the apps back online.
5. 9:42 AMArigato now shows an offline notice instead of an error page.
6. 9:32 AMOutage notice emailed to merchants subscribed to outage updates.
7. 9:17 AMArigato Automation and Customer Account Fields offline.
8. 9:15 AMCustom Fields offline. Opening the app shows a login prompt; no password is needed, close the prompt.
9. 9:11 AMArigato workflow processing and Custom Fields background processing paused. New events are queued, not lost.
10. 9:10 AMWe take all of our apps offline as a security precaution.