DALLAS, TX — Oct 26, 2026 —BBI is aware of PHP2Shell, the name given to two critical vulnerabilities in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) discovered late last week. Both flaws can allow an attacker to run code on a web server without logging in, and the issue has affected organizations across many industries, including the restaurant industry. 

When the vulnerabilities became public, BBI’s security team immediately assessed our environment. In that review, the team found that BBI’s exposure was very limited. Even with limited exposure, the BBI development team took corrective action right away, including applying the two patched PHP releases and adding additional protective measures such as edge filtering and enhanced monitoring.

At this time, we have found no evidence that customer data or services were impacted.

Because this is a fast-moving situation, BBI will keep monitoring PHP2Shell closely, including new guidance from the PHP project, security researchers and government cybersecurity agencies. BBI will take further action as needed to protect our platform and our customers, and will provide updates if anything changes.

Customers with any questions can contact support@blackboxintelligence.com or directly reach out to your Customer Success Manager.