SuiteCRM and PHP2Shell

The statement

Read the statement on community.suitecrm.com, dated 21 October 2026, 09:45 (follow-ups 21 October 2026, 13:24 and 16:01). Source type: official page.

Notes

Post Upcoming Critical PHP Security Release by the suitecrm_team account on SuiteCRM's own community forum (staff label not printed on the page). It is server software, not part of SuiteCRM, so updating SuiteCRM will not apply this fix. and Your PHP version is changed by whoever manages your server. quoted from the statement URL. Users told to find out who manages PHP, check the version, back up files and database, stay on a supported PHP branch (unsupported branches should not expect a fix) and watch php.net. SuiteCRM's own post names no CVE or version; its 16:01 follow-up reposts the PHP advisory naming CVE-2026-109618, CVE-2026-109619 and PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. No mention of SalesAgility hosted services.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

The badge for SuiteCRM reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.

SuiteCRM's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about SuiteCRM and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.