Security

SuiteCRM says PHP fixes for critical flaws are out

By WeekCRM editorial team · Published 2026-10-26 · Editorial policy & disclosures

weekcrm news desk · 26 October 2026, 11:10 UTC · Source: community.suitecrm.com

SuiteCRM says the PHP project released fixes on 21 October 2026 for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 and can allow unauthenticated remote code execution. SuiteCRM says no SuiteCRM release applies the fix, because the flaw is in PHP, which the server administrator updates.

Fixed versions are PHP 8.4.27, 8.3.36, 8.2.35 and 8.5.12. PHP 8.2 reaches end of life on 31 December 2026 and gets no security fixes after that.

On 23 October, PHP published a lower-risk issue, CVE-2026-115560, that the 21 October releases do not fix. Until PHP ships that fix, PHP recommends setting session.upload_progress.enabled=0. SuiteCRM says it does not rely on that setting.

What it means

If you use SuiteCRM. Any SuiteCRM 7 or 8 install on an unpatched PHP version is exposed to unauthenticated remote code execution.
What to do. Check your PHP version in Admin > Diagnostic Tool, then update PHP to a fixed version.
Watch for. PHP 8.2 support ends 31 December 2026; the CVE-2026-115560 fix arrives in PHP's next regular release.

How to cite this story

weekcrm. (26 October 2026). SuiteCRM says PHP fixes for critical flaws are out. https://www.weekcrm.com/news/2026-10-26-suitecrm-says-php-fixes-for-critical-flaws-are-out

weekcrm Sunday issue HighLevel adds six filters to Conversations inboxHighLevel has added six filters to the Conversations inbox.HighLevel adds Social Planner Posts trigger to WorkflowsHighLevel adds a Social Planner Posts trigger to Workflows.HighLevel adds Social Intelligence in limited beta for selected usersHighLevel has launched Social Intelligence in limited beta for selected users.HighLevel lets agencies set Reviews AI mode in bulk for sub-accountsHighLevel now lets agencies manage Reviews AI for all sub-accounts from the Agency view.