Blackline incident
BlackLine Security Update: PHP Core Vulnerabilities (CVE-2026-109618 & CVE-2026-109619)
Ongoing since 10:28 PM UTC, affecting Account Reconciliations and Cash Application and 1 more.
As of October 21, 2026, BlackLine Information Security has assessed the recently disclosed PHP core vulnerabilities, also known as “PHP2Shell.” Financial Close & Intercompany: Not impacted, as these platforms do not use PHP. Invoice-to-Cash: PHP components are internally accessible only and protected by BlackLine’s WAF, with exploit-blocking rules confirmed active. No indicators of compromise were identified. Patching of internal, non-exposed EIP resources is targeted for completion by October 23, 2026. Customer Action Required: None. BlackLine is managing all necessary mitigations and ongoing monitoring.
Affected components
Update timeline
- monitoring Oct 21, 2026, 10:28 PM UTC
As of October 21, 2026, BlackLine Information Security has assessed the recently disclosed PHP core vulnerabilities, also known as “PHP2Shell.” Financial Close & Intercompany: Not impacted, as these platforms do not use PHP. Invoice-to-Cash: PHP components are internally accessible only and protected by BlackLine’s WAF, with exploit-blocking rules confirmed active. No indicators of compromise were identified. Patching of internal, non-exposed EIP resources is targeted for completion by October 23, 2026. Customer Action Required: None. BlackLine is managing all necessary mitigations and ongoing monitoring.
Your product runs on more than Blackline
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services