Security

SuiteCRM flags critical PHP security release due 21 October 2026

By WeekCRM editorial team · Published 2026-10-23 · Editorial policy & disclosures

weekcrm news desk · 23 October 2026, 13:23 UTC · Source: community.suitecrm.com

SuiteCRM says the PHP project will ship a critical security release on Wednesday 21 October 2026 at 14:00 UTC. It fixes two vulnerabilities, each rated CVSS v4.0 9.2 (Critical). PHP may release earlier if details become public or attacks are seen.

PHP is server software, not part of SuiteCRM. Updating SuiteCRM will not apply the fix, so the server's PHP version must be updated. SuiteCRM has not yet published the affected PHP versions, fixed versions or CVE IDs, so exposure is unknown.

Teams should find out who manages PHP on their server and check their version in Admin > Diagnostic Tool or with php -v. Hosted customers should ask their provider when the patch will be applied.

What it means

If you use SuiteCRM. If you run SuiteCRM, the PHP on your server needs this patch, not SuiteCRM itself.
What to do. Check your PHP version in Admin > Diagnostic Tool or with php -v, and back up files and database now.
Watch for. PHP release on 21 October 2026 at 14:00 UTC, which may come earlier. Affected versions and CVE IDs are not yet published.

How to cite this story

weekcrm. (23 October 2026). SuiteCRM flags critical PHP security release due 21 October 2026. https://www.weekcrm.com/news/2026-10-23-suitecrm-flags-critical-php-security-release-due-21-october-

weekcrm Sunday issue Daylite adds iPad-style layout to iPhone DuoDaylite now brings its iPad layout to the foldable iPhone Duo.Salesforce adds collapsible groups to Flow BuilderSalesforce now lets Flow Builder users group related elements into named, collapsible groups.Salesforce adds Donor Engagement Agent for Major Gift OfficersSalesforce says its Donor Engagement Agent, new in the Winter '27 release, turns voice memos, photos and text notes into structured CRM updates.Salesforce agrees to acquire Braze for $5.66 billionSalesforce has signed a definitive agreement to acquire Braze, a customer engagement platform, for about $5.66 billion in enterprise value.