# Security Notices

**URL:** https://community.modx.com/c/announcements/security-notices/26.md

[Latest](https://community.modx.com/latest.md) · [Categories](https://community.modx.com/categories.md) · [Tags](https://community.modx.com/tags.md)

---

## [Critical PHP Vulnerabilities: Upgrade Immediately](https://community.modx.com/t/critical-php-vulnerabilities-upgrade-immediately/9312)

<div class="topic-metadata">

**Author:** [@rthrash](https://community.modx.com/u/rthrash)\
**Replies:** 0\
**Last updated:** [October 21, 2026, 9:23pm UTC](https://community.modx.com/t/critical-php-vulnerabilities-upgrade-immediately/9312 "2026-10-21T21:23:36Z")

</div>

On October 21, 2026, PHP released security updates for two critical vulnerabilities, commonly called PHP2Shell. These could allow an attacker to run malicious code on an unpatched server without logging in. These vulner…

---

## [MODX AjaxUpload Extra Remote Execution and Others](https://community.modx.com/t/modx-ajaxupload-extra-remote-execution-and-others/9287)

<div class="topic-metadata">

**Author:** [@smashingred](https://community.modx.com/u/smashingred)\
**Replies:** 0\
**Last updated:** [October 5, 2026, 2:36pm UTC](https://community.modx.com/t/modx-ajaxupload-extra-remote-execution-and-others/9287 "2026-10-05T14:36:22Z")

</div>

Security Advisory: AjaxUpload Extra Overview Project: AjaxUpload Extra CVE IDs: CVE-2026-95237 (pending publication); three further IDs to be assigned Affected Versions: 2.0.0 through 2.0.6 Fixed Version: 2.1.0 Release …

---

## [MODX Revolution Input Validation Vulnerability](https://community.modx.com/t/modx-revolution-input-validation-vulnerability/9199)

<div class="topic-metadata">

**Author:** [@smashingred](https://community.modx.com/u/smashingred)\
**Replies:** 0\
**Last updated:** [July 21, 2026, 10:32pm UTC](https://community.modx.com/t/modx-revolution-input-validation-vulnerability/9199 "2026-07-21T22:32:11Z")

</div>

Overview Project: MODX Revolution (core) CVE ID: Pending Affected Versions: All versions Fixed Version: 3.2.3 and 2.8.9 Release Date: 2026-07-21 Severity: Pending—impact varies by site configuration. A formal CVSS score…

---

## [MODX Login Extra PHP Object Injection Vulnerability](https://community.modx.com/t/modx-login-extra-php-object-injection-vulnerability/8174)

<div class="topic-metadata">

**Author:** [@smashingred](https://community.modx.com/u/smashingred)\
**Replies:** 0\
**Last updated:** [November 22, 2024, 9:57pm UTC](https://community.modx.com/t/modx-login-extra-php-object-injection-vulnerability/8174 "2024-11-22T21:57:00Z")

</div>

Overview Project: Login Extra CVE ID: CVE-2024-55039 (pending) Affected Versions: 1.5.2 through 1.9.13 Fixed Version: 1.9.14 Release Date: 2024-11-22 Severity: Critical CVSS v4.0 Score: 9.4 CVSS v4.0 Vector: CVSS:4.0/AV…

---

## [About the Security Notices category](https://community.modx.com/t/about-the-security-notices-category/2264)

<div class="topic-metadata">

**Author:** [@smashingred](https://community.modx.com/u/smashingred)\
**Replies:** 0\
**Last updated:** [January 1, 2013, 5:00am UTC](https://community.modx.com/t/about-the-security-notices-category/2264 "2013-01-01T05:00:00Z")

</div>

This is a subcategory of Announcements for Security Notices. Older security notices can be found in the archived MODX Forums.

---

## [MODX setup/ Directory Site Exploit](https://community.modx.com/t/modx-setup-directory-site-exploit/648)

<div class="topic-metadata">

**Author:** [@rthrash](https://community.modx.com/u/rthrash)\
**Replies:** 0\
**Last updated:** [April 24, 2019, 3:36pm UTC](https://community.modx.com/t/modx-setup-directory-site-exploit/648 "2019-04-24T15:36:05Z")

</div>

Product: MODX Revolution Severity: Critical Versions: \<=2.7.0 Vulnerability type(s): Site Exploit Date Published: 2019-04-01 Issue There is currently an active exploit of sites with an intact MODX Revolution setup/ …