CVE-2026-109618 & CVE-2026-109619

[Russ]

Hey guys, once php updated, can we expect that espocrm will work as is or should we take the systems offline for now?
As you may know it's a major problem everywhere right now.

[yuri]

Hi,

While you are still on a not updated PHP, I'd suggest either shutting it down or applying mitigations described here https://www.php.net/archive/2026.php.

Docker images are being built. The official Dockerhub not yet updated. Hope they will do it soon.

[SailReal]

Hi,

Seems to be fixed, thanks for the super fast reaction!

[partomas]

Could you clarify which EspoCRM Docker image tags now include the PHP security fixes? Have images for older EspoCRM versions also been rebuilt, or only those for the latest release?

[SailReal]

On docker hub a lot of espo tags where rebuild. You can verify if the issue is fixed on your tag by pulling it and executing something like `docker compose exec espocrm php -v`. Then you can check the version against the patched one of https://www.php.net/index.php#2026-10-20-1 (8.5.12, 8.4.27, 8.3.36 and 8.2.35)

[TKopp]

Hey yuri, will there be an update for the older versions like 9.3.4? Unfortunately we are not able to upgrade to higher versions at the moment, which would mean for us we would have to shut espocrm down. Kind regards Til!

[yuri]

There will be 9.3 build too.

[TKopp]

Thank you for the quick response! Do you have a timeline? We are in evaluation, if for the time beeing we should take espocrm down.

[Dave B]

yuri Can you confirm that the SaaS platform that we use has been patched?

[yuri]

Was patched as soon as the patch was released.

[tarasm]

The PHP version used in our Docker images has been updated.
Patched images:

• espocrm (Docker Official Image): 10.0.10 (latest).
• espocrm/espocrm: 10.0.10 (latest) and 9.3.10.

If you use one of these images, pull the updated image and recreate your containers:

docker compose pull
docker compose up -d

If your setup uses older versions, it will not receive the fix. Switch to one of the patched versions listed above.

[yuri]

If one wants to stay on v9.3 and avoid upgrading to v10.0, make sure your docker-compose file uses the 9.3 tag (e.g. `espocrm/espocrm:9.3`) rather than `latest`.