Important PHP Security Update: What Cloud and On-Premise Bitrix24 Users Need to Know
Update as of October 22, 2026: All PHP security updates have been applied to Bitrix24 cloud accounts, and all temporarily restricted features have been restored.
The vulnerabilities were found not in the Bitrix24 code, but in an external component — PHP. This is a server-side technology used by many websites and services, including Bitrix24.
The PHP developers have reported two critical vulnerabilities. The fixes are scheduled for release today, October 21.
If you use cloud Bitrix24
You do not need to update PHP for your account yourself — our team maintains the servers.
We will take the necessary measures to keep our cloud customers secure. If necessary, we will temporarily disable certain Bitrix24 features until the fixes are installed and the required security checks are completed.
We understand that such restrictions may affect your usual workflow. But if they are required, we will introduce them to reduce the risk to your data while the threat is being addressed. File uploads are the first priority. We will restore the features once their safe operation has been verified.
The security of your data is our number one priority!
If you use on-premise Bitrix24
The PHP update on your server must be installed by the specialist who maintains it.
Forward this message right now to your system administrator, your servicing partner, or your hosting provider. Ask them to:
- check the PHP version in use and prepare the update;
- promptly install the required fixes once they are released;
- verify that the website or account works properly after the update.
PHP is updated separately from the Bitrix24 product itself — at the server level. You do not need to deal with the technical settings yourself: hand the task over to a specialist.
This information is current as of October 21, 2026.
