CVE-2026-109618 & CVE-2026-109619

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Russ
    Senior Member
    • Feb 2022
    • 531

    #1

    CVE-2026-109618 & CVE-2026-109619

    Hey guys, once php updated, can we expect that espocrm will work as is or should we take the systems offline for now?
    As you may know it's a major problem everywhere right now.
  • yuri
    EspoCRM product developer
    • Mar 2014
    • 10081

    #2
    Hi,

    While you are still on a not updated PHP, I'd suggest either shutting it down or applying mitigations described here https://www.php.net/archive/2026.php.

    Docker images are being built. The official Dockerhub not yet updated. Hope they will do it soon.

    Comment

    • SailReal
      Member
      • Jun 2025
      • 52

      #3
      Hi,

      Seems to be fixed, thanks for the super fast reaction!

      Comment

      • partomas
        Active Community Member
        • Sep 2018
        • 387

        #4
        Could you clarify which EspoCRM Docker image tags now include the PHP security fixes? Have images for older EspoCRM versions also been rebuilt, or only those for the latest release?

        Comment


        • SailReal
          SailReal commented
          Editing a comment
          On docker hub a lot of espo tags where rebuild. You can verify if the issue is fixed on your tag by pulling it and executing something like `docker compose exec espocrm php -v`. Then you can check the version against the patched one of https://www.php.net/index.php#2026-10-20-1 (8.5.12, 8.4.27, 8.3.36 and 8.2.35)
      Working...