Matrix Version: 5.5.5.1
I’m sure everyone has seen the recent NCSC security alert regarding two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
These vulnerabilities involve memory corruption and use-after-free conditions that, under certain circumstances, could allow an unauthenticated attacker to execute arbitrary code remotely on affected web servers. The issue potentially affects all PHP versions, with older, unsupported versions presenting an additional challenge due to the lack of official security updates.
I still have a few sites running really old versions of Squiz Matrix (Debian 9, Apache and PHP 7.3), and I’m currently stuck, unable to upgrade to Matrix 6 now that Squiz is no longer open source.
What are my options? Are there any practical ways to mitigate these vulnerabilities and keep the sites running securely, or is it finally time to say goodbye to my beloved CMS for good?
Thanks.