Critical PHP vulnerabilities: what Bitrix24 clients need to do

Author: Emily Walker

Last update: October 21, 2026.

PHP developers reported two critical vulnerabilities. They plan to release fixes today, October 21, at 2:00 PM UTC (5:00 PM UTC+3). The fixes may be released earlier if details of the vulnerabilities become public.

The vulnerabilities were found not in the Bitrix24 code, but in an external component — PHP. This server technology is used by many sites and services worldwide, making these vulnerabilities especially dangerous.

If you use Bitrix24 Cloud, you don't need to update PHP yourself. If you use Bitrix24 On-Premise, assign this task to a specialist immediately.

If you use Bitrix24 Cloud

You don't need to update PHP for your Bitrix24 yourself — our team maintains the servers.

We're temporarily limiting some Bitrix24 features until the fixes are installed and the required security checks are complete. This is one of the urgent measures we're already taking to protect our cloud clients' data. We understand that this may affect your regular work, but the security of your data is our top priority.

Once the fixes are released, our team will need time to install and test them. We'll announce separately when normal operation resumes.

If you use Bitrix24 On-Premise

The specialist who maintains your server should install the PHP update.

PHP is updated separately from Bitrix24 at the server level. You don't need to manage the technical settings yourself: assign this task to a specialist.

Forward the link to this article to your system administrator, Bitrix24 Partner, or hosting provider immediately. Ask them to:

Check the PHP version in use and prepare the update.
Install the required fixes promptly once they're released.
Verify that your site or Bitrix24 works correctly after the update.

Go to Bitrix24

Don't have an account? Create for free

Bitrix24 Helpdesk

Critical PHP vulnerabilities: what Bitrix24 clients need to do

If you use Bitrix24 Cloud

If you use Bitrix24 On-Premise