Cloudmon Security Advisory: PHP2Shell (CVE-2026-109618, CVE-2026-109619)

Cloudmon Security Advisory

PHP2Shell (CVE-2026-109618, CVE-2026-109619)

SECURITY ADVISORY

Cloudmon PHP2Shell Status: Not affected

Published: 23 October 2026 · Status: Not affected

Summary

A critical zero-day vulnerability known as PHP2Shell has put organisations around the world at risk. Cloudmon is not affected, and customers, partners and MSPs don't need to do anything to their Cloudmon deployments.

What is PHP2Shell?

PHP2Shell is a pair of serious flaws in PHP, a technology that many websites and web applications run on. On an affected server, attackers can use these flaws to take control remotely, without needing a password.

"Zero-day" means attackers began exploiting the flaws before a fix was available. The flaws were publicly disclosed on 21 October 2026.

What this means for Cloudmon

Cloudmon is not affected by PHP2Shell.
No action is required for any Cloudmon deployment.

What we recommend

If your organisation uses PHP on other systems, such as websites, portals or internal applications, ask your IT team to install the latest PHP security update right away. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Reference

Vulnerability

PHP2Shell

CVE IDs

CVE-2026-109618, CVE-2026-109619

Severity

Critical

Disclosed

21 October 2026

Cloudmon status

Not affected

Action required