PHP2Shell (CVE-2026-109618 and CVE-2026-109619) - Bizora CRM Is Patched
Two critical vulnerabilities in PHP, known as PHP2Shell, were disclosed this week. Bizora CRM runs on a patched version. Here is what happened and what it means for you.
This week, the PHP project released emergency security updates for two critical vulnerabilities, known together as PHP2Shell. PHP is the programming language that runs a large share of the web, including Bizora.
The short version: Bizora’s servers have been updated to a patched version of PHP. You do not need to do anything. The rest of this post explains what happened and how we look after your data.
What is PHP2Shell?
PHP2Shell is the name given to two vulnerabilities in the core of PHP itself:
- CVE-2026-109618: a memory corruption flaw in how PHP handles running out of memory while it is setting up a request.
- CVE-2026-109619: a use-after-free flaw, where state left over from one request can affect the next.
Both are rated 9.2 out of 10 for severity. In the worst case, they could let an attacker run their own code on an unpatched web server without logging in. They affect a very wide range of PHP versions and common server set-ups.
Fixes were released on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security researchers have reported attempts to exploit the flaws, and the UK’s National Cyber Security Centre has issued an alert urging every organisation that uses PHP to update. You can read it on the NCSC website.
What we have done
- Our hosting provider updated our servers to a patched version of PHP as soon as the fixes were released.
- Bizora is now running a version of PHP that fixes both vulnerabilities.
- We are monitoring security advisories and will apply any further fixes as soon as they are available.
Does this affect my data?
We are not aware of any impact on Bizora or on customer data. You do not need to change your password or take any other action because of PHP2Shell.
As always, we recommend using a strong, unique password for Bizora that you do not use anywhere else.
How we protect your data every day
Keeping software up to date is one part of how we look after the information you store in Bizora:
- Encrypted connections: every connection to Bizora uses HTTPS.
- Hashed passwords: we never store your password in a readable form.
- Secure sessions: sign-in cookies are protected, and you are signed out automatically after a period of inactivity.
- Encrypted document storage: files you upload are stored with encryption, on servers in Europe.
- Payments handled by Stripe: your card details go directly to Stripe, not to our servers.
- Access controls: team permissions let you decide who in your team can do what.
Running your own PHP website?
If your business has its own website or web app built on PHP, such as a WordPress site, ask your web developer or hosting company to confirm it has been updated to one of the fixed versions above. Updating is the only complete fix. The NCSC also advises checking internet-facing systems for signs of compromise, and watching for updates from any supplier whose products include PHP. The official release notes are on php.net.
Questions?
If you have any questions about this update or about how Bizora protects your data, contact us at hello@bizora.co.uk and we will be happy to help.
Common questions
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, disclosed and patched in October 2026. On unpatched servers they could allow an attacker to run code without logging in.
Is Bizora affected by PHP2Shell?
Bizora’s servers have been updated to a patched version of PHP that fixes both vulnerabilities. We are not aware of any impact on Bizora or on customer data.
Do I need to change my Bizora password?
Not because of PHP2Shell. We always recommend a strong, unique password that you do not use for any other service.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026, or any later version.
