Dear Customers,
On October 21, 2026, two critical security vulnerabilities were disclosed in the PHP language, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as “PHP2Shell.” Both have a CVSS v4.0 score of 9.2. They allow an unauthenticated attacker to remotely execute code on servers running vulnerable versions of PHP.
Regarding the impact of these vulnerabilities on Modyo’s platforms, we would like to inform you of the following:
- Modyo Cloud and Modyo Enterprise Cloud, in all their versions, are not affected. The vulnerabilities reside in the PHP engine, and this technology is not part of any of the platform’s components.
- Modyo Connect is not affected, as its components are developed exclusively in Java with Spring Boot, with no PHP-based elements.
Although none of Modyo’s platforms are affected, we recommend that customers operating their own PHP-based systems update immediately to the patched versions: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Versions 8.1 and earlier no longer receive official support and will not be patched, so we recommend migrating to a supported version.
For any further questions, our support team is available to assist you.
Best regards,
Eduardo Villavicencio
Head of Managed Services