Mono Solutions is currently experiencing a minor incident affecting Website and HAL and 1 more component, which began 6h ago. The vendor's full update timeline is below.
Affected components
Update timeline
- investigating Oct 21, 2026, 12:42 PM UTC
We are currently investigating and following the updated on the critical exploits exposed today. More info to come.
- investigating Oct 21, 2026, 01:18 PM UTC
Security advisory: critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 To all our clients, A few hours ago, we became aware of two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both have a CVSS score of 9.2, which is rated Critical, and may allow unauthenticated remote code execution. We have moved all available resources from other projects to address this risk. They will stay on this work until we are confident the risk has been mitigated. The details of the vulnerabilities have not been published yet. The PHP Foundation has said it will release a fix at or before 16:00 CEST (UTC+2) today. When the fix is released, the details of the vulnerabilities will become public too. We are following the situation closely so we can close any remaining gaps as soon as those details are known. We are already putting additional protective measures in place. We do not currently think it is necessary to shut down all services. As a precaution, however, we are making the following change: - Customers Application, which handles form uploads on websites, will be temporarily shut down. While it is offline, you may have problems with: - retrieving files that were uploaded through forms - submitting forms that include file uploads - accessing password-protected pages We will post updates here as soon as we know more. Christopher Lassen CTO, Mono Solutions
- investigating Oct 21, 2026, 03:35 PM UTC
For the sake of security our updates here will be deliberately vague. We have completed all of the recommended mitigations for both vulnerabilities across our hosting platform, and all affected services have been restarted. We will now look at the patch rollout for the remaining PHP versions on our platform, where publicly available. Specific tools working with our PHP applications, makes our system an unlikely candidate for an attack with the current information we have. We have no evidence that these vulnerabilities have been exploited on our platform. No action is needed from customers at this time. Expect further updates here as we continue the investigation. Christopher Lassen CTO, Mono Solutions
- investigating Oct 21, 2026, 03:41 PM UTC
We are continuing to investigate this issue.