If you’ve seen reports about PHP2Shell, here’s what you need to know: Monarch isn’t affected.
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in PHP, a programming language used by many websites. The vulnerabilities could allow someone to run code on an affected PHP system without signing in. The PHP project released security updates on October 21, 2026, and CISA urged organizations running PHP to update promptly. Read CISA’s alert about the vulnerabilities.
Why isn’t Monarch affected?
The Monarch app and our systems that store customer data do not run PHP, so these vulnerabilities do not affect your Monarch account.
Protecting your financial information is at the heart of everything we do. Our security team keeps a close eye on new threats as they emerge, and we'll let you know right away if anything changes.