Cloudmon Security Advisory

Security updates for Cloudmon and the steps to stay protected.

SECURITY ADVISORY

Cloudmon PHP2Shell Status: Not affected

Published: 23 October 2026 · Status: Not affected

Summary

A critical zero-day vulnerability known as PHP2Shell has put organisations around the world at risk. Cloudmon is not affected, and customers, partners and MSPs don't need to do anything to their Cloudmon deployments.

What is PHP2Shell?

PHP2Shell is a pair of serious flaws in PHP, a technology that many websites and web applications run on. On an affected server, attackers can use these flaws to take control remotely, without needing a password.

"Zero-day" means attackers began exploiting the flaws before a fix was available. The flaws were publicly disclosed on 21 October 2026.

What this means for Cloudmon

Cloudmon is not affected by PHP2Shell.
No action is required for any Cloudmon deployment.

What we recommend

If your organisation uses PHP on other systems, such as websites, portals or internal applications, ask your IT team to install the latest PHP security update right away. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Reference

Vulnerability

PHP2Shell

CVE IDs

CVE-2026-109618, CVE-2026-109619

Severity

Critical

Disclosed

21 October 2026

Cloudmon status

Not affected

Action required

None

Questions?

Linux Kernel TCP/IP Vulnerability (CVE-2026-98432)

Published: 9 November2026 Status: Mitigation available. Vendor kernel patchespending for some releases.

Summary

Cloudmon is tracking a recently disclosed vulnerability in the Linux kernel network stack, CVE-2026-98432. It affects most Ubuntu releases, including 22.04, 24.04 and 26.04. Ubuntu has not yet released a fixed kernel for every version.

⚠️ If you run a self-hosted Cloudmon server or probes on Linux, we recommend applying the mitigation below now.

Who is affected

Deployment

Action required

Cloudmon-managed infrastructure

None. We are applying the mitigation on your behalf.

Self-hosted Cloudmon servers on Linux

Apply the mitigation below.

Cloudmon probes on Linux

Apply the mitigation below.

What is the issue?

The flaw is a memory error (use-after-free) in the kernel’s core TCP/IP handling. By sending specially crafted network traffic, a remote attacker could crash the server (kernel panic / denial of service) and, in some setups, take control of it. Ubuntu rates it High priority, with a CVSS score of 9.8.

Why disable MPTCP?

Multipath TCP (MPTCP) lets a single connection use several network paths at once. Most servers don’t need it, but it is enabled by default and is the main known way to exploit this flaw. Turning it off closes that path until the patched kernel is installed.

Our mitigation plan

We are applying this workaround across the Cloudmon infrastructure we manage. Once vendors release stable kernel patches, we will install them and coordinate with you if any maintenance reboots are needed.

How to apply it on your systems

If you manage a self-hosted Cloudmon server or probe, run these commands on each Linux server:

1. Apply the permanent configuration change

echo "net.mptcp.enabled=0" | sudo tee -a /etc/sysctl.d/99-disable-mptcp.conf

2. Reload the system settings immediately

sudo sysctl --system

Note: This applies the new setting straight away. It does not restart the server.

3. Verify the change

sysctl net.mptcp.enabled

Expected output: net.mptcp.enabled = 0

✔ Will this impact your services?
No. Disabling MPTCP does not affect internet connectivity, website performance or standard network protocols such as ping, traceroute and regular TCP. Applications simply fall back to standard single-path TCP connections, and Cloudmon monitoring continues as normal.

This is a temporary workaround. Please still update the kernel and reboot once Ubuntu releases the fix for your version.

View Ubuntu’s advisory →

Need help?

Contact our support team at support@cloudmon.ai.

Request a Demo