Monta is not affected by PHP security vulnerabilities (CVE-2026-109618 / CVE-2026-109619)

Incident Report for Monta

Monitoring

We are aware of the two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, also known as “php2shell”) that the PHP project disclosed and patched today, 21 October 2026.

Our engineering and security teams have investigated, and we have confirmed that the Monta platform is not exposed to these vulnerabilities. Protective measures are already in place, and as a further precaution we are applying the latest security updates. The hosting provider for our public website, monta.com, has also confirmed that its systems are fully patched.

No action is needed from customers or partners, and all Monta services are working normally.

We will update this page once the precautionary updates are complete. If you have questions, contact us at security@monta.com.

Posted Oct 21, 2026 - 14:15 UTC

This incident affects: General availability.