Last updated: October 22, 2026, 5:00 PM ET.
Summary
We have seen no indication that Blue Triangle customer data, credentials, or systems have been compromised by the PHP2Shell vulnerabilities. All affected services were remediated by 5:00 PM ET on October 22, 2026, and our investigation is continuing.
On October 20, 2026, the PHP project gave advance notice of two critical vulnerabilities in the PHP language runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and widely referred to as "PHP2Shell." Either one could allow an unauthenticated attacker to run code on a vulnerable web server. PHP released patched versions on October 21.
Blue Triangle uses PHP in a limited number of platform components, so we treated this as an urgent priority.
What we did
We mitigated swiftly, and all affected services were remediated by 5:00 PM ET on October 22.
|
Date |
Action |
|---|---|
|
Oct 22 |
Patched images were deployed to production, and all affected services are now remediated. |
|
Oct 21 |
Once patched PHP releases were available, we built updated container images for every affected component. They were scanned with cloud container scanning tools and passed automated and manual end-to-end testing. |
|
Oct 20 |
We learned of the vulnerabilities through industry notifications and security vendor alerts. Our CTO authorized emergency changes the same day, and firewall rules supplied by our security providers were applied at our CDN/web application firewall at approximately 11:00 PM ET, before a patch existed. We also added logging and alerting to identify scanning or attack attempts quickly. |
Our infrastructure is immutable and image-based. Each deployment replaces the previously running systems entirely, so nothing is patched in place.
Our security review
To date, our review has found no evidence of exploitation. We continue to watch closely, and will notify customers quickly if this changes.
-
Log review: we reviewed WAF logs from 12:00 AM ET on October 16, 2026 onward, which predates PHP's advance notice. We saw a limited number of scans. Our WAF has blocked matching signatures since approximately 11:00 PM ET on October 20, and our server logs show early scanning activity but no exploit attempts.
-
Compromise check: we scanned affected systems for new logins, unexpected files, and unexpected processes and found none.
-
Credentials: as a precaution, we are replacing secrets and keys used by both public-facing and internal applications.
What customers need to know
No customer action is required at this time.
-
The Blue Triangle tag is not PHP-based and is not affected.
-
We have seen no indication that service or data collection was affected by the mitigations or the deployments.
Questions
We take the security of our platform and our customers' data seriously. We took swift action to mitigate and remediate this critical vulnerability, and we continue to monitor our systems.
Questions? Contact support@bluetriangle.com or security@bluetriangle.com. We will update this page as our review concludes.