On October 21, 2026, PHP released security updates for two critical vulnerabilities, commonly called PHP2Shell. These could allow an attacker to run malicious code on an unpatched server without logging in.
These vulnerabilities affect PHP, the software that runs MODX and many other website platforms. Updating MODX alone will not fix them.
What you need to do
If your site is hosted in MODX Cloud: We have patched every PHP version across MODX Cloud. No immediate action is required for these vulnerabilities, though we strongly recommend updating to the latest PHP version available in your MODX Cloud Dashboard after testing your site for compatibility.
If your site is hosted elsewhere: Contact your hosting provider or server administrator immediately. Ask them to confirm that your server has received patches for CVE-2026-109618 and CVE-2026-109619, and that the updated PHP processes have been restarted.
PHP’s official fixed releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some hosting providers supply equivalent security patches through their operating system or long-term support vendor, so the displayed version number may differ. For example, MODX Cloud also includes patched versions for PHP 7.4, 8.0, and 8.1 from our long-term support partner.
Security services such as Cloudflare or Sucuri may reduce exposure, but they do not replace patching PHP.
Keep your site and servers current
As AI helps researchers and attackers discover vulnerabilities faster, ongoing maintenance matters more than ever. Regularly update MODX, Extras, PHP, and server software, and apply critical security patches promptly. Use supported versions and test compatibility when upgrading.
Unsure what to do for your site? Email [email protected] to open a support ticket. We can help you understand the next steps.
Read the official PHP security advisory.