Our assessment is unchanged: the Monta platform is not exposed to CVE-2026-109618 or CVE-2026-109619. We have found no impact on Monta services or customer data, and no action is needed from customers or partners.
We have applied additional protective measures and will keep applying security updates as part of our normal patching process, including any further fixes the PHP project releases. We are closing this notice. If you have questions, contact us at security@monta.com.
Posted Oct 22, 2026 - 13:01 UTC
Monitoring
We are aware of the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, also known as “php2shell”) that the PHP project disclosed and patched today, 21 October 2026.
Our engineering and security teams have investigated, and we have confirmed that the Monta platform is not exposed to these vulnerabilities. Protective measures are already in place, and as a further precaution we are applying the latest security updates. The hosting provider for our public website, monta.com, has also confirmed that its systems are fully patched.
No action is needed from customers or partners, and all Monta services are working normally.
We will update this page once the precautionary updates are complete. If you have questions, contact us at security@monta.com.