MxM v7.5.0 — Security Notice: PHP2Shell, Patched
CVE-2026-109618 and CVE-2026-109619 On October 21 a critical vulnerability in PHP, known as PHP2Shell, was disclosed to the world. This CVE affected t…
CVE-2026-109618 and CVE-2026-109619
On October 21 a critical vulnerability in PHP, known as PHP2Shell, was disclosed to the world. This CVE affected the code MxM runs on, along with a huge part of the internet. Here's how things went.
WHAT WE DID
- Protected the site the same day, before any fix existed, using mitigations the PHP team recommended.
- Installed the fix on October 22, within hours of its release, and verified it is in effect.
- Added an automatic lockdown to our comprehensive security layer. Going forward - if MxM ever detects signs of tampering similar to this vulnerability, the system locks itself within seconds and alerts us.
WHAT WE FOUND
- No break-in occurred, and no data was accessed. We checked thoroughly, before and after the fix.
WHAT YOU NEED TO DO
- Nothing. Your account and password are fine as they are, and your data is safe.
- If anything on your account looks wrong, open a Support ticket from the Menu > Wiki & Guide and we will look right away.
MxM is a private space, and member security is our priority. When something like this happens, you will hear it from us.
Thanks for being a member.
