BlackLine Security Update: PHP Core Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Incident
Report for BlackLine
Subscribe to Updates
Update
Updated Response (as of 10/26/2026):
BlackLine is aware of the critical PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”). BlackLine Information Security has reviewed all BlackLine products and hosting environments and confirmed there is no customer exposure or impact.
Patching non-exposed EIP resources was successfully completed
No action is needed from customers. We’ll keep monitoring and will let you know if anything changes.
BlackLine is aware of the critical PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619 (“PHP2Shell”). BlackLine Information Security has reviewed all BlackLine products and hosting environments and confirmed there is no customer exposure or impact.
Patching non-exposed EIP resources was successfully completed
No action is needed from customers. We’ll keep monitoring and will let you know if anything changes.
Monitoring
As of October 21, 2026, BlackLine Information Security has assessed the recently disclosed PHP core vulnerabilities, also known as “PHP2Shell.”
Financial Close & Intercompany: Not impacted, as these platforms do not use PHP.
Invoice-to-Cash: PHP components are internally accessible only and protected by BlackLine’s WAF, with exploit-blocking rules confirmed active. No indicators of compromise were identified. Patching of internal, non-exposed EIP resources is targeted for completion by October 23, 2026.
Customer Action Required: None. BlackLine is managing all necessary mitigations and ongoing monitoring.
Financial Close & Intercompany: Not impacted, as these platforms do not use PHP.
Invoice-to-Cash: PHP components are internally accessible only and protected by BlackLine’s WAF, with exploit-blocking rules confirmed active. No indicators of compromise were identified. Patching of internal, non-exposed EIP resources is targeted for completion by October 23, 2026.
Customer Action Required: None. BlackLine is managing all necessary mitigations and ongoing monitoring.
This incident affects: Production - US - Financial Close & Consolidation (Account Reconciliations), Production - US - Invoice-to-Cash (Cash Application, eInvoicing & Payments), Production - EU - Financial Close & Consolidation (Account Reconciliations), Production - APAC - Financial Close & Consolidation (Account Reconciliations), Production - APAC - Invoice-to-Cash (Cash Application, eInvoicing & Payments), Sandbox - US - Financial Close & Consolidation (Account Reconciliations), Sandbox - US - Invoice-to-Cash (Cash Application, eInvoicing & Payments), Sandbox - EU - Financial Close & Consolidation (Account Reconciliations), Sandbox - EU - Invoice-to-Cash (Cash Application, eInvoicing & Payments), Sandbox - APAC - Financial Close & Consolidation (Account Reconciliations), and Sandbox - APAC - Invoice-to-Cash (Cash Application, eInvoicing & Payments).