Posted 2 days agoOctober 21, 2026 at 9:53 PMUTC
On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, sometimes called “PHP2Shell.”
DemandBridge applied the updated PHP release to all affected EQ Commerce servers the same day. These systems are fully patched. Our review has found no indication that the vulnerabilities were exploited against DemandBridge systems.
DB Commerce, DB Distributor, and FlowPoint do not run on PHP and were not affected.
No action is needed from customers. If you have questions or need documentation for your own security or compliance review, please contact DemandBridge Support.