Skip to main content
Question

Request for statement on CVE-2026-109618 / CVE-2026-109619 (PHP RCE)

  • October 21, 2026
  • 4 replies
  • 806 views
  • Translate All

Hi, store regulated customer documents in Box and need a written statement from Box Security for our vendor risk file regarding today’s PHP remote code execution vulnerabilities ( CVE-2026-109618 and CVE-2026-109619 ). Specifically:

  1. Does any component in Box’s service delivery path (upload handling, API, web application) run the PHP runtime (php-src, as opposed to HHVM)?
     
  2. If so, has it been patched to the versions PHP released on October 21, and when was that completed?
     
  3. Has Box identified any indication of exploitation attempts against its infrastructure prior to patching?

A short written response would be appreciated. If Box has published or will publish a public advisory, a link to that is sufficient for questions 1 and 2.
 

References:

  • https://www.cve.org/CVERecord?id=CVE-2026-109618
  • https://www.cve.org/CVERecord?id=CVE-2026-109619
  • https://nvd.nist.gov/vuln/detail/CVE-2026-109618
  • https://nvd.nist.gov/vuln/detail/CVE-2026-109619
  • https://www.php.net/archive/2026.php#2026-10-20-1
  • https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

    4 replies

    Jey Bueno Box
    Forum|alt.badge.img

    Hi ​@Avery K, welcome to the Box Community!

     

    For any questions or the most up-to-date statements regarding this vulnerability, please open a Box support ticket so our team can assist you securely.


    You can submit your request directly through the Box Support Portal. If you are unable to open a case, click here to access the ticket form. Thank you!

    Translate

    I agree Box.com needs to release a public statement regarding this. Its widely known that box.com employs PHP and IT security teams are being asked by leadership across many orgs to provide an update about the Box.com risk. The reply I received from support was too vague. 

    Translate

      We are also looking for the same statement with the vulnerabilites

      Translate
        • jasblg
        • New Member
        • October 22, 2026

        For all the end users looking for information from Box and not finding any, here’s my support ticket text.  Feel free to submit your own, since apparently support tickets are Box’s only means of communication:

        “We are getting a lot of questions from our clients about PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. We owe them answers and Box has said nothing. An asker in the community was told to submit a support ticket if they want to know.
        So here is my support ticket. Has Box applied the PHP patches or not? Is it going to?
        A general announcement would have been helpful rather than have all of your customers submit individual support tickets and guess.”

         

        Translate
          Terms of ServiceAccessibility statement