> For the complete documentation index, see [llms.txt](https://docs.intelligems.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intelligems.io/developer-resources/intelligems-and-the-october-2026-shopify-checkout-security-incident-customer-faq.md).
# Intelligems and the October 2026 Shopify Checkout Security Incident: Customer FAQ
Last updated: October 22, 2026. We will update this page as we learn more.
### Summary
Intelligems has concluded its investigation and was not affected by the recent Shopify checkout hijacking security incident. We reviewed our systems for evidence of unauthorized access and found no evidence of any exploit that was used in this attack.
This page explains what happened across the Shopify app ecosystem, what we checked, and what you can do to protect your store.
### What happened
Beginning around October 10, 2026, merchants and security researchers reported that shoppers on a number of Shopify stores were being redirected away from the real checkout to a fake checkout page.
* The malicious JavaScript was not part of the apps' installed code. It was delivered through the app developers' own systems and ran in shoppers' browsers on affected stores.
* Several third-party Shopify apps were involved, including HulkApps (Hulk Product Options), Selleasy and Swym Wishlist Plus. Reports of additional apps are still being investigated. As of October 22, the affected apps have been fixed or removed from the Shopify App Store.
* How the malicious code first reached these apps has not been publicly determined.
* On October 20, Shopify announced a new protection: online stores now ask customers to confirm before sending them to a website outside the store.
### Was Intelligems affected?
No, as far as we know. Here is what we did:
* We checked our access logs and found no suspicious activity.
* We reviewed all Javascript injections on our platform for patterns like those documented in the attack and found none.
* We are using the security tooling Shopify released in response to this incident to monitor for vulnerabilities.
Because Intelligems operates across many stores, we treat attacks like this as a real risk, and we continue to monitor closely.
### Frequently asked questions
#### Has Intelligems changed our theme, script tags or checkout?
Our platform only makes changes to your storefront as a direct result of actions you take within Intelligems, or at your direct request.
#### Have you seen any signs of compromise?
No. Our audits have not revealed any unauthorized entry or activity on our platform.
#### Are our Shopify access tokens stored securely?
Yes. Shopify access tokens are encrypted at rest using AES-256 encryption.
#### Will you tell us if we are affected?
Yes. If we find anything consequential, we will notify you if you have been impacted.
#### Does Intelligems use PHP? What about the recent PHP vulnerabilities?
Some customers have also asked about the recently disclosed PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). This is a separate matter from the checkout incident described above. Intelligems does not use PHP.
### What you can do to protect your store
1. Test your checkout. Open a private or incognito browser window, add an item to your cart and click Checkout. Confirm you land on your real Shopify checkout. If you see anything unfamiliar, contact Shopify right away.
2. Review your installed apps. Disable apps you do not need, especially the ones named above, and check which tools (including AI tools) have access to your Shopify account.
3. Update your credentials. Change your Shopify password and the passwords for your app accounts, such as HulkApps, Swym and Selleasy, and turn on two-factor authentication wherever it is offered.
4. Report suspicious domains. If you find a phishing page, report it to [Google Safe Browsing](https://www.google.com/safebrowsing/report_phish/).
#### How to spot a fake checkout
* The web address is not your store's domain or a Shopify checkout address. Domains reported in this attack include biliing\[.]top, checkout-confirm\[.]top, order-confirm\[.]top, account-confirm\[.]top and billing-confirm\[.]top. This list is not exhaustive.
* Your browser or password manager offers saved card details when you click the first name field.
* The logo or branding does not match your store.
### Questions or concerns
If you have questions about this incident or see anything suspicious in your store or in Intelligems, please contact our Support team right away.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.intelligems.io/developer-resources/intelligems-and-the-october-2026-shopify-checkout-security-incident-customer-faq.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.