We have updated PHP 7.4 with the patch. If you're site is on PHP 7.4 or above already, it is now fully protected by the updates. At this time, all PHP versions are now patched for the vulnerabilities.

For sites on 3.x with all their Extras kept up to date, we recommend you update your sites to PHP 8.2+ by switching inside the Cloud Edit view for each of the Clouds you have installed whenever it's convenient as, it is the latest officially supported version of PHP.

To confirm, the following versions of PHP are patched at this time:

• PHP 8.3
• PHP 8.2
• PHP 8.1
• PHP 8.0
• PHP 7.4

This concludes all PHP version updates related to this event. We will continue to monitor the situation and hope that no further action is required.

We have updated PHP 8.0 with the patch. If you're site is on PHP 8.0 or above already, it is now fully protected by the updates.

For sites on 3.x with all their Extras kept up to date, we recommend you update your sites to PHP 8.2+ by switching inside the Cloud Edit view for each of the Clouds you have installed whenever it's convenient as, it is the latest officially supported version of PHP.

To confirm, the following versions of PHP are patched at this time:

• PHP 8.3
• PHP 8.2
• PHP 8.1
• PHP 8.0

PHP 7.4 will be deployed soon. We'll post an update at that time. Other PHP versions will be posted thereafter.

We have updated PHP 8.1 with the patch. If you're site is on PHP 8.1 or above already, it is now fully protected by the updates.

For sites on 3.x with all their Extras kept up to date, we recommend you update your sites to PHP 8.2+ by switching inside the Cloud Edit view for each of the Clouds you have installed, whenever it's convenient, as it is the latest officially supported version of PHP.

To confirm, the following versions of PHP are patched at this time:

• PHP 8.3
• PHP 8.2
• PHP 8.1

We'll post further updates as they are deployed across our fleet.

We have updated PHP 8.2 with the patch. If you're site is on PHP 8.2 or above already, it is now fully protected by the updates.

For sites on 3.x with all their Extras kept up to date, you're welcome to update your sites to PHP 8.2+ by switching inside the Cloud Edit view for each of the Clouds you have installed.

To confirm, the following versions of PHP are patched at this time:

• PHP 8.3
• PHP 8.2

PHP 8.1 will be deployed soon. We'll post an update at that time. Other PHP versions will be posted thereafter.

We have updated PHP 8.3 with the patch. If you're site is on PHP 8.3 already, it is now fully protected by the updates.

For sites on 3.x with all their Extras kept up to date, you're welcome to update your sites to PHP 8.3 by switching inside the Cloud Edit view for each of the Clouds you have installed.

We will be deploying patched versions of PHP 8.2 through to PHP 7.4 in the coming hours. We are awaiting patches to be released by our vendor.

Last updated: October 21, 2026

Status: Mitigations in place. PHP updates in progress. No customer action required.

Summary

On October 20, 2026, the PHP project announced that it would release fixes for two critical security vulnerabilities in PHP. On October 21, it released the fixed versions. The vulnerabilities are being referred to in the security community as PHP2Shell.

We started work on protecting MODX Cloud as soon as the announcement was made. Mitigations are in place at the server level, and we are waiting on patches from our long-term support (LTS) vendor so we can update every PHP version in MODX Cloud. You do not need to take any action.

How serious are these vulnerabilities

• Both vulnerabilities are rated critical, each with a score of 9.2 out of 10 on the CVSS v4.0 scale.
• PHP states that either one can allow unauthenticated remote code execution. In plain terms, an attacker who has no login to a site could run their own code on a server that is running an unpatched version of PHP.
• PHP states that all PHP installations serving web requests are at risk, and that updating PHP is the only complete fix.

The two vulnerabilities are tracked as:

• CVE-2026-109618. When PHP runs out of memory part-way through starting a request, it can be left in a damaged state that an attacker may be able to take advantage of.
• CVE-2026-109619. Leftover data from one web request can be reused by a later request in a way that an attacker may be able to take advantage of.

What we are doing

• We began responding as soon as PHP made its announcement on October 20.
• We have applied mitigations at the server level to reduce exposure while patched PHP builds are prepared.
• We will update PHP for every version currently installed in MODX Cloud, for all customers. This includes versions the PHP project no longer updates.
• We are waiting for our LTS vendor to release its patches. We will begin updating as soon as they are available and will post progress on this page.

PHP states that mitigations reduce exposure but do not make an installation safe, which is why we are updating every version.

Protection by site setup

• Sites behind Cloudflare have mitigations in place. These sites will still receive the PHP update.
• Sites behind Sucuri may have partial protection. Sucuri can confirm what applies to your site.
• All other sites are covered by our server-level mitigations until the PHP update reaches them.

What you need to do

Nothing. The PHP updates will be applied across MODX Cloud by us. You do not need to change your site, restart anything, or open a ticket.

Something to note. This is a good time to check which PHP version your site is set to run. We recommend running PHP 8.2 or higher.

• PHP 8.1 and older no longer receive updates from the PHP project, so moving to a supported version is the better long-term choice.
• PHP 8.2 receives security fixes until December 31, 2026. PHP 8.3 or higher gives you more time before your next upgrade. See the PHP project's supported versions page for the full schedule.
• Before changing versions, test your site on the newer version.

Update progress

We will add status updates as PHP updates are completed across MODX Cloud.

• October 21, 2026. PHP released fixed versions. Server-level mitigations are in place. Waiting on LTS vendor patches before updating PHP in MODX Cloud.

References from php.net

• Upcoming Critical PHP Security Release (October 20, 2026)
• Security advisory: Critical remote code execution vulnerabilities, update now (October 21, 2026)
• Release announcements for the fixed versions: PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35
• PHP supported versions
• PHP security advisories on GitHub, linked from php.net: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp

Questions

If you have questions about your site, open a ticket with MODX Cloud support.