These vulnerabilities affect PHP, the software that runs MODX and many other website platforms. Updating MODX alone will not fix them.

What you need to do

If your site is hosted in MODX Cloud: We have patched every PHP version across MODX Cloud. No immediate action is required for these vulnerabilities, though we strongly recommend updating to the latest PHP version available in your MODX Cloud Dashboard after testing your site for compatibility.

If your site is hosted elsewhere: Contact your hosting provider or server administrator immediately. Ask them to confirm that your server has received patches for CVE-2026-109618 and CVE-2026-109619, and that the updated PHP processes have been restarted.

PHP’s official fixed releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some hosting providers supply equivalent security patches through their operating system or long-term support vendor, so the displayed version number may differ. For example, MODX Cloud also includes patched versions for PHP 7.4, 8.0, and 8.1 from our long-term support partner.

Security services such as Cloudflare or Sucuri may reduce exposure, but they do not replace patching PHP.

Keep your site and servers current

As AI helps researchers and attackers discover vulnerabilities faster, ongoing maintenance matters more than ever. Regularly update MODX, Extras, PHP, and server software, and apply critical security patches promptly. Use supported versions and test compatibility when upgrading.

Unsure what to do for your site? Email support@modxcloud.com to open a support ticket. We can help you understand the next steps.

Read the official PHP security advisory.

1 post - 1 participant

Read full topic

Overview

• Project: AjaxUpload Extra
• CVE IDs: CVE-2026-95237 (pending publication); three further IDs to be assigned
• Affected Versions: 2.0.0 through 2.0.6
• Fixed Version: 2.1.0
• Release Date: 2026-10-05
• Severity: Critical
• Highest CVSS v3.1 Score: 9.8

Summary

Four security vulnerabilities have been fixed in AjaxUpload 2.1.0. Two allow a remote visitor to run code on the server without logging in. All four are fixed by the same update.

Vulnerability Details

Description

Insufficient validation of user-supplied input in AjaxUpload allows an unauthenticated remote visitor to upload executable files, cause the server to send requests to addresses of the visitor’s choosing, or delete files on the server. Depending on the site, these issues can lead to full compromise of the web server account.

Affected Systems

All MODX Revolution installations with AjaxUpload 2.0.6 or earlier installed. Not every issue applies to every configuration, but at least one applies to every installation. Treat every installation as affected until it is upgraded.

Mitigation

Update immediately: Upgrade AjaxUpload to version 2.1.0 or later using the MODX Extras Installer.

If you cannot upgrade right away, uninstall AjaxUpload until you can.

Upgrading does not remove files an attacker may already have placed on your server. After upgrading:

• Check for unexpected files, particularly PHP files, in AjaxUpload’s cache directory and in any directory your forms upload to.
• Review web server logs for unusual requests to the AjaxUpload component.
• If you find anything suspicious, treat the site as compromised and rotate your database credentials.

Credits

• Discovery: Sosecure; Grim The Ripper Team by SOSECURE Thailand; Mr. Warathap Ratsameekomon
• Resolution: Thomas Jakobi
• Coordination: MODX Security Team

Timeline

• Discovery Date: 2026-09-18
• Fix Development: 2026-10-01
• Public Disclosure: 2026-10-05

References

• MODX Security Team Contact: security@modx.com
• Fixed Version Download: AjaxUpload 2.1.0

Revision History

• 2026-10-05: Initial advisory publication

1 post - 1 participant

Read full topic

• Project: MODX Revolution (core)
• CVE ID: Pending
• Affected Versions: All versions
• Fixed Version: 3.2.3 and 2.8.9
• Release Date: 2026-07-21
• Severity: Pending—impact varies by site configuration. A formal CVSS score will be published with the full technical disclosure.

Vulnerability Details

Type

Improper Input Validation, with potential escalation to Remote Code Execution

Description

A vulnerability has been identified in MODX Revolution related to insufficient input validation. On its own, this can allow injection of arbitrary content into site templates. Depending on site-specific factors, impact can escalate further, up to and including remote code execution. The issue has been present for an extended period and was identified during an internal security review.

We are withholding further technical detail—including attack vector, affected configuration criteria, and proof-of-concept information—until patch adoption is broad enough for fuller disclosure to be responsible. A follow-up advisory with complete technical details will be published at that time.

Attack Vector

Not published in this preliminary advisory.

Affected Systems

Some installations are affected more directly than others depending on configuration. We are not publishing the specific criteria at this time. All MODX Revolution installations on the 2.8.x and 3.x branches should upgrade regardless of known configuration, since exposure can’t be reliably self-assessed without the full technical detail.

Mitigation

Upgrade required: Upgrade to 3.2.3 or 2.8.9 as soon as possible.

MODX Cloud customers: infrastructure-level mitigations have been applied. This reduces risk while you upgrade but doesn’t replace patching your site.

Credits

• Discovery: Elizabeth Southwell (Omeryl)
• Resolution: Jason Coward (opengeek)
• Coordination: MODX Security Team

Timeline

• Discovery Date: 2026-07-20
• Fix Development: 2026-07-21
• Preliminary Disclosure: 2026-07-21
• Full Technical Disclosure: To be announced

References

• MODX Security Team Contact: security@modx.com
• Fixed Version Downloads: Revolution 3.2.3, Revolution 2.8.9

Revision History

• 2026-07-21: Preliminary advisory published. Full technical disclosure to follow once patch adoption is sufficient.

1 post - 1 participant

Read full topic

• Project: Login Extra
• CVE ID: CVE-2024-55039 (pending)
• Affected Versions: 1.5.2 through 1.9.13
• Fixed Version: 1.9.14
• Release Date: 2024-11-22
• Severity: Critical
• CVSS v4.0 Score: 9.4
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Details

Type

Remote Code Execution (RCE) via PHP Object Injection

Description

A critical vulnerability has been identified in the MODX Login Extra that allows arbitrary PHP code execution through PHP Object Injection. The vulnerability stems from unsafe deserialization of user-supplied data using PHP’s unserialize() function without proper sanitization.

Attack Vector

An authenticated user, regardless of their permission level, can exploit this vulnerability by submitting specially crafted data through the Login form. The vulnerability can be triggered when:

1. The system processes user input through the Login form
2. The malicious payload is passed to the unsafe unserialize() function
3. The resulting PHP object injection leads to arbitrary code execution

Affected Systems

The vulnerability affects MODX Revolution installations that meet ALL of the following criteria:

1. Have the Login Extra installed (versions 1.5.2 to 1.9.13)
2. Have a web-accessible login form using the Login Extra
3. Allow user authentication

Note: Systems with Registration forms using the Login Extra may be particularly vulnerable if user validation is not required.

Mitigation

Immediate Update Required: Upgrade Login Extra to version 1.9.14 or later using the MODX Extras Installer in your MODX Revolution Projects.

Technical Details

The vulnerability exists due to:

• Unsafe usage of PHP’s unserialize() function
• Lack of input validation before deserialization
• Insufficient permission checking in the login process

Credits

• Discovery: Drew Webber
• Resolution: Thomas Jakobi and John Peca
• Coordination: MODX Security Team

Timeline

• Discovery Date: 2024-11-22
• Fix Development: 2024-11-22
• Public Disclosure: 2024-11-22

References

• MODX Security Team Contact: Security Team
• Fixed Version Download: Login 1.9.14

Revision History

• 2024-11-22: Initial advisory publication

1 post - 1 participant

Read full topic

Issue
There is currently an active exploit of sites with an intact MODX Revolution setup/ directory. This can give anyone on the internet complete access to your site and possibly your server with trivial effort. This directory should never be left in place once a site is installed.

Check Your Site
You can check if your site is vulnerable by entering your site URL with a /setup/ added at the end, for example:
https://www.example.com/setup/

What to Do
If you see a MODX installation utility, you should log into your server via FTP or SSH immediately, and remove this directory. If your site is working as expected, your site may be safe, but please review the additional information below.

Why it Matters
Using the MODX installation script above, a malicious individual can re-install MODX and point to any database they wish including remote databases. Once a site is “re-installed” they can then use the Manager’s file manager to upload other back door files to your server. This can potentially lead to more severe issues such as having the entire server rootkitted, setting up spam mailers, or uploading crypto miners to take advantage of computing resources on your server.

If Your Site Has Been Compromised
If your site has been compromised or is not working correctly, and the setup folder per the above was in place, you must first re-connect your site to the correct database and server. Ask your web host or sysadmin to reset your database password and give you the new database credentials. Once you have those, update the MODX config file—by default located at core/config/config.inc.php—with the correct settings.

Keep Up with Updates
You should also upgrade your MODX version to the latest production release (currently 2.7.1) and upgrade all Extras if they are not current. Keeping up with updates is critical to maintaining a secure site, as it plays a key role in helping prevent sites from compromise.

Malware Scanning
Finally, you should run a malware scanner to make sure other exploits haven’t already been uploaded to your site as described above. We have a series of articles that walks you through recovering from a site compromise, which hopefully will help in this effort:

• Recovering from a Hacked Site: Part 1
• Recovering from a Hacked Site: Part 2
• Recovering from a Hacked Site: Part 3

Need Help?
If your web host, developer or sysadmin is not able to help, you can open a commercial support ticket directly with MODX by visiting https://support.modx.com and clicking the blue “Submit a request” link in the header (please mention this post and provide your site URL). In order to assist we will need access to your server, most likely via your cPanel login.

1 post - 1 participant

Read full topic

1 post - 1 participant

Read full topic