This notification advises that the PHP vulnerability (CVE-2026-109618/CVE-2026-109619) identified on October 21, 2026 has been patched in all Blackline Safety systems.

On October 21, 2026, a critical remote code execution vulnerability in PHP, known as "php2shell" (CVE-2026-109618 and CVE-2026-109619), was disclosed publicly.

PHP is a widely used programming language that runs on web servers and powers many websites and web applications around the world. A vulnerability like this could allow an attacker to run unauthorized code on an affected server.

We have reviewed our environment and applied the official PHP patch across all affected Blackline Safety systems.

To date, we have found no evidence of exploitation within our environment. Our team is continuing to monitor closely for any related activity.

No action is required from you.

If you have any questions, please contact our Technical Support team.