Critical PHP security release

The latest PHP security release affects websites and applications that run on PHP, including SuiteCRM. If we host your SuiteCRM, it’s already running on the patched version of PHP and there’s nothing you need to do. If you host it yourself, ask your IT team or hosting provider to update PHP as soon as possible.

The steps below explain what to check.

What happened

On 21 October 2026, the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These updates fix two vulnerabilities (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10, which is critical. According to PHP, both could let someone run code on a server without logging in, which is why they are asking everyone to update (PHP security advisory).

On 23 October 2026, PHP published a follow-up advisory suggesting that session.upload_progress.enabled is switched off until its next regular release. It covers an unlikely combination of settings and code, so PHP is handling it in its normal release cycle.

Why a PHP fix affects SuiteCRM

PHP is the language SuiteCRM is built on. It runs on the server, separately from SuiteCRM, so a problem in PHP can affect any application running on it, even when the application itself isn’t at fault.

It also means that updating SuiteCRM won’t fix this. Updating PHP will.

If you host SuiteCRM with us

Your SuiteCRM instance is already running on the patched version of PHP, and the follow-up advisory from 23 October 2026 has been addressed. We put precautionary measures in place before the release, and applied the patch to all our hosting clients shortly after it came out.

Monitoring security advisories and applying updates like this one is part of the service we provide, so you don’t need to track them yourself. We’ll contact you if anything further is needed.

If you host SuiteCRM yourself

If you run SuiteCRM on your own server, PHP is updated by whoever looks after that server, usually your hosting provider or IT team. The fix is out now, so it’s best to plan the update as soon as you can.

Before updating PHP, take a fresh backup of your SuiteCRM files and database, and make sure you can restore it.

1. Check your PHP version. In SuiteCRM, go to Admin > Diagnostic Tool and check the output from phpinfo(), or run php -v on the server.
2. If you’re on PHP 8.4, 8.3 or 8.2, ask your IT team or hosting provider to update PHP to the latest patched release for your version (8.4.27, 8.3.36 or 8.2.35). PHP’s security advisory has update guidance they can follow, including for Linux distribution packages.
   • If you’re on PHP 8.2, note that it reaches end of life on 31 December 2026 and won’t receive security fixes after that, so it’s worth planning a move to PHP 8.3 or 8.4.
   • If you’re on PHP 8.5, which SuiteCRM does not yet officially support, update to 8.5.12.
3. If you’re on PHP 8.1 or older, there is no official update from the PHP project, so plan an upgrade. Some Linux distributions provide their own fixes, so check with your vendor. Check the compatibility matrix for SuiteCRM 8 or SuiteCRM 7 to pick a supported version, and test the upgrade on a staging copy first. Moving to a newer PHP version may also mean upgrading SuiteCRM. Our upgrade page explains your options and how we can help.
4. On any version, ask your IT team or hosting provider to switch off session.upload_progress.enabled, as PHP’s follow-up advisory suggests, even if PHP has already been updated. SuiteCRM doesn’t use this setting, so switching it off won’t affect how it works. PHP will fix this in its next regular release.

If PHP can’t be updated straight away

PHP’s advisory lists interim measures your IT team can apply, but PHP is clear that these reduce the risk rather than remove it. If the update is likely to be delayed, your IT team may also want to consider limiting access to the server from the public internet until it’s done. As the issue is in PHP rather than SuiteCRM, any measures should cover the whole server, including any other websites or applications running on it.