PHP Vulnerability Responses by Company

BlackLine

Global cloud / infrastructure
Aliases / services
BlackLine / Financial Close / Intercompany / Invoice-to-Cash / blackline.com
Official website
https://www.blackline.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

BlackLine Financial Close

Response status
No PHP; unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Financial close, intercompany and receivables software.

BlackLine says Financial Close does not use PHP. Its October 26 update confirms no customer exposure or impact.

Scope: Financial Close's PHP2Shell assessment; separate database incidents are unrelated.

What users should do

No customer action is required for this incident.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://trust.blackline.com/incidents/xqvg3mvc1plfResponse evidence
  2. https://trust.blackline.com/https://trust.blackline.com/Service and operation documentation

BlackLine Intercompany

Response status
No PHP; unaffected
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The official notice says Intercompany does not use PHP and is unaffected.

Scope: Intercompany only; Invoice-to-Cash's internal PHP remediation is separate.

What users should do

No customer action is required.

Source URLs

  1. PHP2Shell response and scopehttps://trust.blackline.com/incidents/xqvg3mvc1plfResponse evidence
  2. https://trust.blackline.com/https://trust.blackline.com/Service and operation documentation

BlackLine Invoice-to-Cash internal EIP

Response status
Internal EIP patched; no customer impact
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The October 26 update confirms patching of non-exposed EIP resources. Internal PHP was WAF-protected, with no customer exposure or impact reported.

Scope: Internal EIP associated with Invoice-to-Cash, not a general assessment of public PHP servers.

What users should do

No customer action is required; BlackLine manages remediation and monitoring.

Source URLs

  1. PHP2Shell response and scopehttps://trust.blackline.com/incidents/xqvg3mvc1plfResponse evidence
  2. https://trust.blackline.com/https://trust.blackline.com/Service and operation documentation
Related official sources
  1. PHP2Shell response and scopeOfficial notice

Comments