Dear User,
Morningstar Investor has no publicly available PHP services which could be affected by the Php2shell exploit and is therefore safe.
More broadly, Morningstar is a global organization with dozens of products and services, some of which do use PHP. However, our dedicated Information Security team includes over forty seasoned security professionals who provide response capability, analysis, and broad intelligence on cybersecurity threats. They subscribe to many information security websites and are members of the Financial Services Information Sharing and Analysis Center (FS-ISAC), receiving critical security alerts, threat notifications, and XML data feeds used in threat analysis.
In this incident, we were aware of the exploit before it was released publicly. We immediately began the process of mitigating, patching, or shutting down all publicly available products and services which used PHP.
If you have any concerns or questions, please reach out to our friendly support team via the usual channels.
Thanks,
Morningstar Team