bLoyal platform not affected by PHP2Shell vulnerability (CVE-2026-109618 / CVE-2026-109619)

Last updated: October 22, 2026

Summary

On October 21, 2026, the PHP project disclosed two critical vulnerabilities known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). On a server running an unpatched version of PHP, an attacker can take control of a web application remotely without logging in. Attacks were seen before fixes were released, and the industry is treating this as a high priority.

The bLoyal platform is not affected.

bLoyal’s core services don’t use PHP. This includes Director, Loyalty Engine, Engagement Engine, Grid and our other platform services. They are hosted on Microsoft Azure (Azure Kubernetes Service and Azure App Services), and the PHP runtime is not used anywhere in them. We also reviewed our source code to confirm this.

Do I need to do anything?

If you use bLoyal for POS, loyalty or engagement only, you don’t need to do anything.

If you use a bLoyal eCommerce integration such as our WooCommerce or Shopify plugins, please read PHP2Shell: Steps for bLoyal eCommerce Clients.

Questions?

Contact bLoyal Support if you have any questions.