On October 21, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Security researchers have reported exploitation attempts against unpatched systems, and government agencies globaly, including CISA, have urged organizations to patch immediately.
Box’s security and engineering teams began preparing as soon as the PHP project announced the upcoming fixes, including identifying which of our systems would need patching. Once the PHP2Shell fixes were released, we applied them and added protective measures while we validated our work. Our monitoring and validation are ongoing, as they are for any critical security event.
Based on what we know today, there is no impact to the Box Service or customer content, and customers do not need to take any action.
Protecting our customers' content is at the core of what we do. For more on how Box protects customer content, visit Box Trust Center.
— Heather Ceylan, SVP & Chief Information Security Officer, Box