Announcements - MODX Community https://community.modx.com/c/announcements/5 Topics in the 'Announcements' category Important announcements by the MODX core team. Tue, 27 Oct 2026 16:53:55 +0000 MODXpo 2027 is April 22–23 in Leeuwarden. Come join us Announcements Hi everyone,

MODXpo is back after five years. It takes place April 22–23, 2027 in Leeuwarden, the Netherlands. Mark Hamstra of modmore is hosting and organizing it.

I’d like to see as many of you there as possible, in person or online. Whether you build sites, maintain Extras, contribute to core or are still finding your way with MODX, there’s a place for you.

  • Thursday, April 22. Conference day with talks and lightning talks about real projects and practical AI. modmore will also release ContentBlocks 2.0.
  • Friday, April 23. Hackathon day. Work side by side on core, the manager UI, Extras and the future of MODX.

Tickets go on sale December 1 for in-person and online attendance.

Ways to take part:

  • Attend in person or online
  • Speak, with a talk or a lightning talk
  • Sponsor, which helps bring ticket prices down
  • Volunteer to help on the day

For speaking, sponsoring or volunteering, email mark@modmore.com.

Venue, schedule, lodging and sponsor information are here:

If you’re planning to go, or have an idea for a talk or a hackathon topic, reply below.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/modxpo-2027-is-april-22-23-in-leeuwarden-come-join-us/9315 Tue, 27 Oct 2026 16:53:55 +0000 No No No community.modx.com-topic-9315 MODXpo 2027 is April 22–23 in Leeuwarden. Come join us Critical PHP Vulnerabilities: Upgrade Immediately Security Notices On October 21, 2026, PHP released security updates for two critical vulnerabilities, commonly called PHP2Shell. These could allow an attacker to run malicious code on an unpatched server without logging in.

These vulnerabilities affect PHP, the software that runs MODX and many other website platforms. Updating MODX alone will not fix them.

What you need to do

If your site is hosted in MODX Cloud: We have patched every PHP version across MODX Cloud. No immediate action is required for these vulnerabilities, though we strongly recommend updating to the latest PHP version available in your MODX Cloud Dashboard after testing your site for compatibility.

If your site is hosted elsewhere: Contact your hosting provider or server administrator immediately. Ask them to confirm that your server has received patches for CVE-2026-109618 and CVE-2026-109619, and that the updated PHP processes have been restarted.

PHP’s official fixed releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Some hosting providers supply equivalent security patches through their operating system or long-term support vendor, so the displayed version number may differ. For example, MODX Cloud also includes patched versions for PHP 7.4, 8.0, and 8.1 from our long-term support partner.

Security services such as Cloudflare or Sucuri may reduce exposure, but they do not replace patching PHP.

Keep your site and servers current

As AI helps researchers and attackers discover vulnerabilities faster, ongoing maintenance matters more than ever. Regularly update MODX, Extras, PHP, and server software, and apply critical security patches promptly. Use supported versions and test compatibility when upgrading.

Unsure what to do for your site? Email support@modxcloud.com to open a support ticket. We can help you understand the next steps.

Read the official PHP security advisory.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/critical-php-vulnerabilities-upgrade-immediately/9312 Wed, 21 Oct 2026 21:23:36 +0000 No No No community.modx.com-topic-9312 Critical PHP Vulnerabilities: Upgrade Immediately Maintenance: PHP security vulnerabilities (PHP2Shell)—MODX Cloud Status MODX Cloud Status Updates Last updated: October 21, 2026

This is a companion discussion topic for the original entry at https://status.modxcloud.com/maintenance/1097512

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/maintenance-php-security-vulnerabilities-php2shell-modx-cloud-status/9310 Wed, 21 Oct 2026 15:48:37 +0000 No No No community.modx.com-topic-9310 Maintenance: PHP security vulnerabilities (PHP2Shell)—MODX Cloud Status Maintenance: Dashboard PHP Upgrades MODX Cloud Status Updates Dashboard is currently unavailable pending critical PHP upgrades.

This is a companion discussion topic for the original entry at https://status.modxcloud.com/maintenance/1096481

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/maintenance-dashboard-php-upgrades/9308 Wed, 21 Oct 2026 04:26:50 +0000 No No No community.modx.com-topic-9308 Maintenance: Dashboard PHP Upgrades Precautionary security shutdown of the MODX Cloud Dashboard MODX Cloud Status Updates We are temporarily pausing access to the MODX Cloud Dashboard and API in response to PHP’s announcement of two critical security vulnerabilities.

This is a companion discussion topic for the original entry at https://status.modxcloud.com/incident/1096445

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/precautionary-security-shutdown-of-the-modx-cloud-dashboard/9307 Wed, 21 Oct 2026 03:22:11 +0000 No No No community.modx.com-topic-9307 Precautionary security shutdown of the MODX Cloud Dashboard MODX AjaxUpload Extra Remote Execution and Others Security Notices Security Advisory: AjaxUpload Extra

Overview

  • Project: AjaxUpload Extra
  • CVE IDs: CVE-2026-95237 (pending publication); three further IDs to be assigned
  • Affected Versions: 2.0.0 through 2.0.6
  • Fixed Version: 2.1.0
  • Release Date: 2026-10-05
  • Severity: Critical
  • Highest CVSS v3.1 Score: 9.8

Summary

Four security vulnerabilities have been fixed in AjaxUpload 2.1.0. Two allow a remote visitor to run code on the server without logging in. All four are fixed by the same update.

Vulnerability Details

# Type Severity CVSS v3.1 Vector CVE ID
1 Remote Code Execution (unrestricted file upload) Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-95237 (pending)
2 Remote Code Execution (insufficient input validation) Critical 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H To be assigned
3 Server-Side Request Forgery (SSRF) High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N To be assigned
4 Arbitrary file deletion (path traversal) High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H To be assigned

Description

Insufficient validation of user-supplied input in AjaxUpload allows an unauthenticated remote visitor to upload executable files, cause the server to send requests to addresses of the visitor’s choosing, or delete files on the server. Depending on the site, these issues can lead to full compromise of the web server account.

Affected Systems

All MODX Revolution installations with AjaxUpload 2.0.6 or earlier installed. Not every issue applies to every configuration, but at least one applies to every installation. Treat every installation as affected until it is upgraded.

Mitigation

Update immediately: Upgrade AjaxUpload to version 2.1.0 or later using the MODX Extras Installer.

If you cannot upgrade right away, uninstall AjaxUpload until you can.

Upgrading does not remove files an attacker may already have placed on your server. After upgrading:

  • Check for unexpected files, particularly PHP files, in AjaxUpload’s cache directory and in any directory your forms upload to.
  • Review web server logs for unusual requests to the AjaxUpload component.
  • If you find anything suspicious, treat the site as compromised and rotate your database credentials.

Credits

  • Discovery: Sosecure; Grim The Ripper Team by SOSECURE Thailand; Mr. Warathap Ratsameekomon
  • Resolution: Thomas Jakobi
  • Coordination: MODX Security Team

Timeline

  • Discovery Date: 2026-09-18
  • Fix Development: 2026-10-01
  • Public Disclosure: 2026-10-05

References

Revision History

  • 2026-10-05: Initial advisory publication

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/modx-ajaxupload-extra-remote-execution-and-others/9287 Mon, 05 Oct 2026 14:36:22 +0000 No No No community.modx.com-topic-9287 MODX AjaxUpload Extra Remote Execution and Others Maintenance: Scheduled Infrastructure Maintenance—Frankfurt Datacenter MODX Cloud Status Updates To continue improving the reliability of our infrastructure, we’ll be performing planned maintenance on one of our European hosting platforms during the following maintenance window:

This is a companion discussion topic for the original entry at https://status.modxcloud.com/maintenance/986030

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/maintenance-scheduled-infrastructure-maintenance-frankfurt-datacenter/9269 Tue, 15 Sep 2026 13:51:33 +0000 No No No community.modx.com-topic-9269 Maintenance: Scheduled Infrastructure Maintenance—Frankfurt Datacenter Revolution 3.2.4 Released Releases MODX Revolution 3.2.4 is out now. This is a security patch addressing three issues affecting versions 3.0.0 through 3.2.3—setup configuration handling, access control on an administrative endpoint, and token generation for an authentication flow. While each depends on specific site conditions, we consider this upgrade mandatory.

An Upgrade Note

Current versions of MODX Revolution 3.x ship with GuzzleHttp in the core as a dependency. Some Extras have historically packaged or included GuzzleHttp, however, sites using such Extras will experience errors after upgrade due to the two incompatible versions of GuzzleHttp.

To Resolve

The easiest way to resolve this is to access your server via SSH and remove the vendor/guzzlehttp directories found on the file system that live in any of the installed Extras. This may also be done by manually looking under the core directory for guzzlehttp. To search the server from the command line, please use the following to find the files:

find . -type d -name guzzlehttp

This should identify any location of that directory. You can ignore the core/package directories. Delete any that aren’t in the core/vendor directory.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-2-4-released/9237 Wed, 26 Aug 2026 19:53:25 +0000 No Yes No community.modx.com-topic-9237 Revolution 3.2.4 Released Scheduled Infrastructure Maintenance—Frankfurt Datacenter MODX Cloud Status Updates To continue improving the reliability of our infrastructure, we’ll be performing planned maintenance on one of our European hosting platforms during the following maintenance window:

This is a companion discussion topic for the original entry at https://status.modxcloud.com/incident/986030

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/scheduled-infrastructure-maintenance-frankfurt-datacenter/9214 Wed, 29 Jul 2026 22:52:49 +0000 No No No community.modx.com-topic-9214 Scheduled Infrastructure Maintenance—Frankfurt Datacenter Save Issues for MODX Sites MODX Cloud Status Updates We have been made aware that some customers are experiencing issues with saving Resources (documents) and Elements (Snippets, Plugins, Templates, etc.) in MODX sites in MODX Cloud.

This issue is likely related to an important configuration change to our platorms. We are working to restore normal functionality.

We’ll let you know when we’ve resolved the issue.

This is a companion discussion topic for the original entry at https://status.modxcloud.com/incident/973525

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/save-issues-for-modx-sites/9205 Wed, 22 Jul 2026 12:39:24 +0000 No No No community.modx.com-topic-9205 Save Issues for MODX Sites MODX Revolution Input Validation Vulnerability Security Notices Overview
  • Project: MODX Revolution (core)
  • CVE ID: Pending
  • Affected Versions: All versions
  • Fixed Version: 3.2.3 and 2.8.9
  • Release Date: 2026-07-21
  • Severity: Pending—impact varies by site configuration. A formal CVSS score will be published with the full technical disclosure.

Vulnerability Details

Type

Improper Input Validation, with potential escalation to Remote Code Execution

Description

A vulnerability has been identified in MODX Revolution related to insufficient input validation. On its own, this can allow injection of arbitrary content into site templates. Depending on site-specific factors, impact can escalate further, up to and including remote code execution. The issue has been present for an extended period and was identified during an internal security review.

We are withholding further technical detail—including attack vector, affected configuration criteria, and proof-of-concept information—until patch adoption is broad enough for fuller disclosure to be responsible. A follow-up advisory with complete technical details will be published at that time.

Attack Vector

Not published in this preliminary advisory.

Affected Systems

Some installations are affected more directly than others depending on configuration. We are not publishing the specific criteria at this time. All MODX Revolution installations on the 2.8.x and 3.x branches should upgrade regardless of known configuration, since exposure can’t be reliably self-assessed without the full technical detail.

Mitigation

Upgrade required: Upgrade to 3.2.3 or 2.8.9 as soon as possible.

MODX Cloud customers: infrastructure-level mitigations have been applied. This reduces risk while you upgrade but doesn’t replace patching your site.

Credits

Timeline

  • Discovery Date: 2026-07-20
  • Fix Development: 2026-07-21
  • Preliminary Disclosure: 2026-07-21
  • Full Technical Disclosure: To be announced

References

Revision History

  • 2026-07-21: Preliminary advisory published. Full technical disclosure to follow once patch adoption is sufficient.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/modx-revolution-input-validation-vulnerability/9199 Tue, 21 Jul 2026 22:32:11 +0000 No Yes No community.modx.com-topic-9199 MODX Revolution Input Validation Vulnerability Revolution 3.2.3 and 2.8.9 Released Announcements We’ve published MODX Revolution 3.2.3 and 2.8.9 to address a security vulnerability present in all currently supported versions. We’ve applied mitigations at the infrastructure level for MODX Cloud customers, but you should still upgrade your site—you may not know whether your own configuration is affected.
Important: Treat this as a priority upgrade regardless of your site’s setup.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-2-3-and-2-8-9-released/9198 Tue, 21 Jul 2026 22:08:11 +0000 No Yes No community.modx.com-topic-9198 Revolution 3.2.3 and 2.8.9 Released Connectivity Issues For Some Users MODX Cloud Status Updates We have been alerted that some customer sites are not reachable from certain locations around the world. We’re investigating and have engaged our upstream provider for assistance. It appears to be network connectivity or routing.

This is a companion discussion topic for the original entry at https://status.modxcloud.com/incident/962931

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/connectivity-issues-for-some-users/9190 Mon, 13 Jul 2026 20:40:40 +0000 No No No community.modx.com-topic-9190 Connectivity Issues For Some Users Revolution 3.2.2. Released Releases MODX Revolution 3.2.2 is out now. This one touches a wider range of areas than the last patch—resource handling, the Package Manager, the manager email template, and a pass at modernizing the JS behind the tree, elements, and resources panels.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-2-2-released/9197 Tue, 07 Jul 2026 03:00:00 +0000 No Yes No community.modx.com-topic-9197 Revolution 3.2.2. Released MODX Community Forums went down MODX.com Status Updates This is a companion discussion topic for the original entry at https://status.modx.com/

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/modx-community-forums-went-down/9146 Sun, 17 May 2026 04:00:32 +0000 No No No community.modx.com-topic-9146 MODX Community Forums went down Revolution 3.2.1 Released Releases We’re happy to announce MODX Revolution 3.2.1, a patch release cleaning up a batch of bugs and warnings reported since 3.2.0. Package Manager fixes, cleanup of PHP deprecation warnings, and some housekeeping on the documentation and build tooling side round out the release.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-2-1-released/9196 Wed, 13 May 2026 03:00:00 +0000 No Yes No community.modx.com-topic-9196 Revolution 3.2.1 Released Revolution 3.2.0 Released Releases We’re thrilled to announce the latest release of MODX Revolution, 3.2.

This release brings stability improvements and refinements that enhance your content management workflow. From mobile-friendly manager updates to enhanced Template Variable rendering, improved security features to PHP 8.5 compatibility, version 3.2 represents our ongoing commitment to refining and polishing the MODX platform.

Important: This release requires PHP 8.1 or higher. Please verify your server meets this requirement before upgrading.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-2-0-released/8983 Wed, 18 Feb 2026 15:10:51 +0000 No Yes No community.modx.com-topic-8983 Revolution 3.2.0 Released Revolution 3.1.1 and modAI Released Announcements Happy February, MODXers! Today we’re announcing two important releases: the latest patch release of MODX Revolution, 3.1.1. and the first comprehensive generative AI Extra for MODX Revolution 3.

Revo 3.1.1 brings a fresh collection of improvements to enhance system stability and user experience, and represents our ongoing commitment to refining and polishing the MODX platform.

modAi also debuted this week, representing MODX’s foray into the brave new world of generative AI. What began as a simple proof of concept rapidly went through a “bit” of feature creep and turned into something truly powerful, useful, and—in the long history of all things MODX—highly configurable: modAI 0.9.0-beta | MODX

TL;DR: modAI supports mixing and matching models (Claude, ChatGPT, Gemini, and custom AI gateways like Open WebUI), attaches to any text/textarea/image field in the Manager, and can have canned or freeform prompts to help you generate text, images, and alt tags faster than ever before. It also works with Image+ and SEO Suite, so you can finally nail crucial SEO content faster than ever before. All you need is an API key and a few good prompts.

If you have yet to explore MODX Revolution 3.x, then these two releases are an awesome place to start.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-1-1-and-modai-released/8345 Fri, 21 Feb 2025 00:10:26 +0000 No Yes No community.modx.com-topic-8345 Revolution 3.1.1 and modAI Released Revolution 3.0.6 Released Releases Happy December, folks! Today we’re announcing the latest patch release of MODX Revolution, 3.0.6.

It brings a fresh collection of improvements to enhance system stability and user experience. From resolving the upgrade version display in the Manager to fixing thumbnail challenges with complex filenames, PHP 8.4 compatibility to updated Lexicons, version 3.0.6 represents our ongoing commitment to refining and polishing the MODX platform.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-0-6-released/8210 Mon, 09 Dec 2024 20:48:27 +0000 No Yes No community.modx.com-topic-8210 Revolution 3.0.6 Released MODX Login Extra PHP Object Injection Vulnerability Security Notices Overview
  • Project: Login Extra
  • CVE ID: CVE-2024-55039 (pending)
  • Affected Versions: 1.5.2 through 1.9.13
  • Fixed Version: 1.9.14
  • Release Date: 2024-11-22
  • Severity: Critical
  • CVSS v4.0 Score: 9.4
  • CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Details

Type

Remote Code Execution (RCE) via PHP Object Injection

Description

A critical vulnerability has been identified in the MODX Login Extra that allows arbitrary PHP code execution through PHP Object Injection. The vulnerability stems from unsafe deserialization of user-supplied data using PHP’s unserialize() function without proper sanitization.

Attack Vector

An authenticated user, regardless of their permission level, can exploit this vulnerability by submitting specially crafted data through the Login form. The vulnerability can be triggered when:

  1. The system processes user input through the Login form
  2. The malicious payload is passed to the unsafe unserialize() function
  3. The resulting PHP object injection leads to arbitrary code execution

Affected Systems

The vulnerability affects MODX Revolution installations that meet ALL of the following criteria:

  1. Have the Login Extra installed (versions 1.5.2 to 1.9.13)
  2. Have a web-accessible login form using the Login Extra
  3. Allow user authentication

Note: Systems with Registration forms using the Login Extra may be particularly vulnerable if user validation is not required.

Mitigation

Immediate Update Required: Upgrade Login Extra to version 1.9.14 or later using the MODX Extras Installer in your MODX Revolution Projects.

Technical Details

The vulnerability exists due to:

  • Unsafe usage of PHP’s unserialize() function
  • Lack of input validation before deserialization
  • Insufficient permission checking in the login process

Credits

Timeline

  • Discovery Date: 2024-11-22
  • Fix Development: 2024-11-22
  • Public Disclosure: 2024-11-22

References

Revision History

  • 2024-11-22: Initial advisory publication

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/modx-login-extra-php-object-injection-vulnerability/8174 Fri, 22 Nov 2024 21:57:00 +0000 No Yes No community.modx.com-topic-8174 MODX Login Extra PHP Object Injection Vulnerability Revolution 2.8.8 Released Releases On Thursday, Nov 21, 2024, we released MODX Revolution 2.8.8. This patch release addresses critical compatibility and functionality challenges, including resolving issues with rendering user-entered values in editable listbox-multiple Template Variables and updating the search processor for content-based search.

If your site is running the 2.x version of of MODX Revolution, this should be considered a must-upgrade release—especially to ensure your site remains compatible with recent PHP releases.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-2-8-8-released/8170 Thu, 21 Nov 2024 20:53:26 +0000 No Yes No community.modx.com-topic-8170 Revolution 2.8.8 Released Revolution 3.0.5 Released Releases Happy April, folks. We’d like to announce the latest patch release of MODX Revolution, 3.0.5.

This release includes some quality of life and user interface improvements for site managers and developers including a fix for the datepicker on Resources created in Revo 2.x, the addition of the displaying the username on the confirmation screen of a password change, as well as many more under-the-hood performance and operational improvements and fixes.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-0-5-released/7700 Tue, 16 Apr 2024 20:47:23 +0000 No No No community.modx.com-topic-7700 Revolution 3.0.5 Released Revolution 2.8.7 Released Releases On April 9, 2024, we released MODX Revolution 2.8.7. This patch release of Revo 2, addresses PHP compatibility—especially with image previews across PHP 7.4 and 8.x. In addition to the PHP-related updates, a few other good old fashioned bugs were purged. The end result is a lot smaller error log and a much improved UX that content editors can enjoy.

If your site is running the 2.x version of of MODX Revolution, this should be considered a must-upgrade release—especially to ensure your site remains compatible with recent PHP releases.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-2-8-7-released/7699 Tue, 16 Apr 2024 20:41:20 +0000 No Yes No community.modx.com-topic-7699 Revolution 2.8.7 Released Revolution 3.0.4 Released Releases Today we released MODX Revolution 3.0.4. All users of 3.0.3 and earlier are encouraged to upgrade to this release.

This release improves user and developer experience, augments security, cleans up many legacy code issues, updates key dependencies used in MODX Revolution, and resolves numerous minor bugs.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-3-0-4-released/7108 Tue, 03 Oct 2023 22:25:43 +0000 No Yes No community.modx.com-topic-7108 Revolution 3.0.4 Released Revolution 2.8.6 Released Releases On September 28, 2023, we released MODX Revolution 2.8.6. All users of 2.8.5 and earlier are encouraged to upgrade to this release.

If you’re a fan of safer websites, and fewer PHP errors and warnings with modern PHP, then this is a great release for you. It improves security, improves PHP 8.x compatibility, updates phpThumb and Smarty (key libraries used in MODX Revolution), and addresses various minor bug fixes.

1 post - 1 participant

Read full topic

]]> https://community.modx.com/t/revolution-2-8-6-released/7105 Mon, 02 Oct 2023 19:37:41 +0000 No Yes No community.modx.com-topic-7105 Revolution 2.8.6 Released