Security

Bitrix24 patches cloud accounts for two PHP vulnerabilities

By WeekCRM editorial team · Published 2026-10-23 · Editorial policy & disclosures

weekcrm news desk · 23 October 2026, 10:23 UTC · Source: bitrix24.com

Bitrix24 says PHP developers reported two critical vulnerabilities in PHP, the server-side technology that Bitrix24 runs on. The fixes were scheduled for release on October 21, 2026. As of October 22, Bitrix24 says all PHP security updates are applied to cloud accounts and temporarily restricted features are restored.

Cloud customers do not need to update PHP themselves. While the fixes were being installed, Bitrix24 temporarily disabled some features to reduce risk, with file uploads as the first priority.

On-premise customers must have their system administrator, servicing partner or hosting provider install the PHP update. Bitrix24 asks them to check the PHP version, install the fixes once released, and confirm the site works afterward.

What it means

If you use Bitrix24. Cloud accounts are patched and restored as of October 22. On-premise installs depend on the PHP version on their own server.
What to do. On-premise admins should forward the notice to their server administrator, partner or host and check the PHP version now.
Watch for. Bitrix24 gave no date for on-premise fixes beyond the October 21 release. Confirm the update is installed and the site works afterward.

How to cite this story

weekcrm. (23 October 2026). Bitrix24 patches cloud accounts for two PHP vulnerabilities. https://www.weekcrm.com/news/2026-10-23-bitrix24-patches-cloud-accounts-for-two-php-vulnerabilities

weekcrm Sunday issue Method CRM adds App Builder deselect and fixes nine bugsMethod CRM adds a way to deselect a component in App Builder.Method CRM redesigns Activities screen and fixes QuickBooks Desktop syncMethod CRM redesigned the Activities screen with an updated layout and List and Calendar tabs.Vendasta joins EU-U.S. Data Privacy Framework for EU and UK dataVendasta now participates in the EU-U.S.Vendasta opens Snapshot Report and account creation to public APIVendasta now lets partners call Create Account for Company and Snapshot Report through its public API gateway.