Kiva Logic Blog

On October 21, 2026 the PHP project disclosed two critical security flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 and, under the right conditions, let an attacker run code on a server without logging in. This affects PHP itself, which powers a large share of the internet, so it's a broad, internet-wide event, not something specific to Kiva Logic. Here's where your store stands.

Your store is protected and there's nothing you need to do. We moved on this the day it was announced and we're watching the situation as it develops.

The exploit works by sending a specially malformed file upload (a "multipart" request) that confuses PHP's memory handling and its upload-progress feature. A patched version of PHP (8.3.36 and the matching releases on other branches) shipped the same day the flaw went public.

We're monitoring our hosting providers' patch rollout and our own traffic for any sign of exploit attempts. Once a server is confirmed running the patched PHP, the temporary upload block is removed from it so everything returns to normal. We'll update this post if anything changes.

Your gift boxes just picked up three new options for the holidays. Buyers have always been able to send one of your boxes as a gift. Now they can choose how many deliveries it runs for, how often they arrive, and add gift wrapping right at checkout.

Turn on multi-week gifts and a buyer can send a whole run of deliveries as one present, a 4-week produce box gift for example, instead of a single box. They pick the schedule, the recipient gets exactly that many boxes, then it ends on its own with nothing to cancel.

The gift-wrap upgrade is a paid add-on at checkout. You set the price and the label, something like "Wrap this gift in holiday twine & burlap + a handwritten card" for $4.99. The surcharge rides along on the order, and a GIFT WRAP note lands on the packing slip so the warehouse knows to dress it up.

It all lives on the new Gift Boxes Settings page under Customers. Flip on multi-week gifts and the packaging add-on, set your prices and delivery options, and launch the conversion emails.

Your products can now carry a video. Shoppers who watch a product video are up to 144% more likely to add the item to their cart (Invesp), so it's one of the easier wins for a product page.

Edit any product and you'll see a new Product Video field right under the description. Paste a YouTube link and save.

On the storefront the video shows up right in the product image gallery, as a thumbnail next to the photos.

Your store now has a privacy and data requests page. Customers can go to yourstore.com/delete and ask for a copy of their data, a correction to it, or full deletion of their account, without emailing you first and waiting around.

This is quickly becoming the law. California now requires covered businesses to offer an online request portal, not just an email address, starting January 1, 2027, and rules like the CCPA, CPRA, and GDPR already give customers the right to see, fix, or delete the data a store holds. Here is the California guidance.

When a customer submits a request, it lands in your store inbox with their account already looked up and linked, plus a reminder that privacy laws ask you to respond within 45 days. If they asked to be deleted, one click scrubs their name, email, phone, address, and payment details while keeping order totals and dates, so your history and reporting stay intact.

If you sell food that fits a specific diet, there is a new way for nearby shoppers to find you on Google.

Google now lets people filter local search and map results by dietary attributes like gluten-free, dairy-free, halal, and kosher. Someone searching for "gluten-free groceries near me" can narrow the results to only businesses that carry it, and your store can turn up there.

These attributes live on your Google Business Profile, the free listing that shows on Google Maps and in the business panel on search. If your store qualifies for any of them, adding them takes a few minutes and is worth doing, since a lot of businesses have not yet.

Google's own writeup has the details: read the full rundown.

Shoppers trust other shoppers. Before someone orders their first box or adds a new item to the cart, the first thing they look for is what everyone else thought. If your store can't show them, they go looking somewhere that can.

Your store now has a complete reviews and ratings system built in. Customers leave star ratings, written reviews, and photos and video of what actually showed up at their door. It runs on the products and boxes you already sell, moderates itself with AI, and is included. No Yotpo, no third-party widget, no extra bill.

Here is every part of it, and how to turn it on.

The moment a review is approved, its rating rolls into the averages that show on your storefront. Shoppers see the stars right where they are making up their mind:

Your storefront can now show Google's own store rating, review count, and store quality info in a small floating badge, right where shoppers decide whether to trust you. It's Google's new store widget, launched September 2025, and it's free.

Why bother? Google says businesses that added it saw up to 8% higher sales within 90 days compared to similar stores without it. For a subscription or CSA business, a familiar Google badge near checkout is exactly the kind of thing that turns first-time hesitation into an order.

Here's what shoppers see. A small "Store ratings by Google" pill sits in the corner, and when they click it, it opens a panel with your review summary plus how you score on shipping, returns, pricing, and payment options, all pulled straight from your Google Merchant Center account.

Your store now honors Global Privacy Control automatically. Some browsers send a built-in "do not sell or share my data" signal, and as of January 2026, honoring it is the law in more than a dozen US states. It has real teeth: California fined one retailer $1.35M for ignoring it (background here).

When a visitor's browser sends that signal, your store detects it and quietly switches off the advertising and data-sharing trackers for that visit, things like Facebook, TikTok, Pinterest, Google Ads, and Google Tag Manager. Your own first-party analytics keep running, so you don't lose your traffic numbers.

It's on by default and there's nothing to set up. If you ever want to see it or switch it off, it's the Global Privacy Control card on Apps & Integrations.

Your "Do Not Sell My Personal Information" page also shows a short line now letting shoppers know the signal is honored. That's added automatically below whatever you've written there, and only while honoring is switched on.

Hey friends,

Just launched today is a huge refresh of the referral program. We've taken the best modern practices from ecommerce giants and brought them to YOU. These are some pretty exciting changes, and I think what this allows you to do that is most exciting is now you have a good foundation to run 'promotions' for customers to refer new customers.

You also don't have to do anything.

If you'd like to learn more though, here is the list of changes:

The referral program just got a big refresh, live now. Set it up from Customers → Referrals.

Here's how it all looks on our live demo store. You can explore the referral page yourself here: View the referral page on the Harvest Lane demo →

One more thing: reward amounts are locked in at the moment a customer signs up. So you can change your amounts or run a bonus whenever you like without touching anyone's existing pending referrals.

Everything is built mobile-first, since most referrals get shared by text. Head to Customers → Referrals to set your amounts and turn it on.