Critical Vulnerabilities in PHP

Hi,

We now consider this incident resolved.

We've now run all of our deployment tests up against our US setup and everything is working as expected - while everything not deployed is still hot fixed, we will start rolling out deploys on all servers now - we don't expect this to cause any noteworthy downtime for you.

We thank you for your patience during these past days, and I would like to personally thank our amazing development and support team who has been working night and day to have this solved.

Starting next week we will be creating a Post Mortem which will be shared with those of you who wish to receive it - your partner development manager will contact you when it's ready.

Christopher Lassen
CTO, Mono Solutions

We've now hotfixed our servers removing at least the following issues you may experience:

Form Uploads should now work on all sites
File Manager within the editor should now work on all sites


Allow me to clarify the wording "hotfix".

We are currently releasing stable versions of our servers with all the fixes that our team has been working on - as this takes some time we've made the changes directly on the servers to enable functionality you've been without the last two days immediately. You should not experience any problems with this, but if you do please reach out to our support team who we in development are in close contact with.

You may still experience some trouble with interacting directly with our API's this will be addressed after this initial release.

Christopher Lassen
CTO, Mono Solutions

We've successfully patched relevant services on our site servers (the ones responsible for rendering and running your clients sites) - we are right now in the process of testing this thoroughly and in not too long we should be able to turn back on Form functionality on all websites - we'll be sure to post here as soon as this is live.

We are aware there may be some limitations to some of our API's, these should also be fixed as we start rolling out this change to all other servers.

Again we thank you for your patience.

Christopher Lassen
CTO @ Mono Solutions

We are continuing our work across our platform and want to give you an update on our progress.

Like many providers, we are seeing increased automated scanning activity targeting the recently disclosed PHP vulnerabilities. We have found no evidence of unauthorised access to our systems.

Since our last update, we have introduced additional security measures at the edge of our network, and added further monitoring and automated protections on our servers.

We are rolling out the remaining fixes in stages and verifying each step carefully, to keep our services stable while doing so. We will keep this incident open until that work is complete, and we will post another update as we make progress.

Thank you for your patience.

Christopher Lassen
CTO, Mono Solutions

We are continuing to investigate this issue.

For the sake of security our updates here will be deliberately vague.

We have completed all of the recommended mitigations for both vulnerabilities across our hosting platform, and all affected services have been restarted.

We will now look at the patch rollout for the remaining PHP versions on our platform, where publicly available.

Specific tools working with our PHP applications, makes our system an unlikely candidate for an attack with the current information we have.

We have no evidence that these vulnerabilities have been exploited on our platform. No action is needed from customers at this time.

Expect further updates here as we continue the investigation.

Christopher Lassen
CTO, Mono Solutions

Security advisory: critical vulnerabilities CVE-2026-109618 and CVE-2026-109619

To all our clients,

A few hours ago, we became aware of two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both have a CVSS score of 9.2, which is rated Critical, and may allow unauthenticated remote code execution.

We have moved all available resources from other projects to address this risk. They will stay on this work until we are confident the risk has been mitigated.

The details of the vulnerabilities have not been published yet. The PHP Foundation has said it will release a fix at or before 16:00 CEST (UTC+2) today.

When the fix is released, the details of the vulnerabilities will become public too. We are following the situation closely so we can close any remaining gaps as soon as those details are known.

We are already putting additional protective measures in place.

We do not currently think it is necessary to shut down all services. As a precaution, however, we are making the following change:

- Customers Application, which handles form uploads on websites, will be temporarily shut down. While it is offline, you may have problems with:
  - retrieving files that were uploaded through forms
  - submitting forms
  - accessing password-protected pages

We will post updates here as soon as we know more.

Christopher Lassen
CTO, Mono Solutions

We are currently investigating and following the updated on the critical exploits exposed today. More info to come.