Is OpenCRM down?

We are taking our website, opencrm.co.uk, offline while we apply patches. This is a precaution as part of our response to the PHP issue. We will bring the site back as soon as the patching is complete and we are satisfied it is safe to do so. Our technical team continues to work on this. We will post a further update when the situation moves on materially.

Website update: opencrm.co.uk is back online. Thank you for your patience while we completed our security work. Your CRM is not affected by this, and if you have any questions, please contact our support team.

Today two critical security vulnerabilities, known as "PHP2Shell", were disclosed in PHP, the programming language used by a large proportion of websites and web applications worldwide, including our platform. We want to let you know what we have done in response. What we have done - Applied protective measures across our hosting platform, following the guidance published by the PHP security team. - Introduced additional filtering of incoming requests to block the known methods of attack. - Put enhanced security monitoring in place to detect and respond quickly to any suspicious activity. What happens next We are preparing and testing an updated version of PHP containing the official security fix, and will roll it out across the platform once testing is complete. We do not expect this to cause any disruption to your service. Your data We have seen no indication that customer data has been accessed or affected. Our review is continuing, and we will contact you directly if that changes. Do I need to do anything? No action is required from you. If you use our API, web forms or other integrations notice anything not working as expected, please contact our support team at [email protected] or via our live chat so we can help straight away. We will send a further update once the updated PHP has been fully rolled out.

Our telephones remain open in case anyone needs to speak with us, normal number press 2 for support. We will be available until 19:30 UK time.

We continue working on this issue. Our technical team is testing the fix and will deploy it once testing is complete. In the meantime, mitigating rules remain in place on our servers. We will post a further update when the situation changes materially.

We are still working on this issue. Our technical team is testing the fix and will deploy it once testing is complete. Mitigating rules remain in place on our servers, and our website, opencrm.co.uk, remains offline while patches are applied. We will post a further update when the situation moves on materially.

The patches are in, our scans are clean, and testing has passed. We are continuing to monitor as the incident recovers. This was an out-of-band update, so please let us know if anything doesn’t work as it should. This applies especially if you have custom development work, as that is where we would expect any unusual behaviour to show up first. You can raise a ticket or call us on 01748 473000 [option 2 for support]. We will post a final update once we are satisfied the incident is fully resolved. _A note for the technical team: thank you for bearing with us during this challenging time, and to those who sent encouraging messages of support, we really appreciated them._

PHP2Shell: resolved but monitoring. Customer systems patched; no signs of attack We applied temporary protective measures on 21 October. PHP made its fixes available yesterday afternoon, and our team worked through the night to build, test and roll out a patched version to all customer systems. We removed the temporary measures once each system was patched. Our review of activity since 20 October is complete and found no signs of attack. We continue to monitor closely. No action is needed from customers. Full technical detail: https://resources.opencrm.co.uk/files/Technical%20Debrief%20-%20PHP2Shell.pdf

Our Live Chat and Knowledgebase are temporarily unavailable but will be back soon. We're still here though and you can get in touch via email ([email protected]) or give us a call on 01748 473000.

This issue is now resolved and all services are operating normally. If you are continuing to experience any issues, or have any ongoing concerns or questions related to this incident, please contact us through the usual support channels. Thank you for your patience.

We are currently investigating an issue affecting access/functionality of some modules of OpenCRM on a subset of customers. This includes Quotes, Opportunities and Contracts. We will post updates here as soon as they are available.

The reported issues have been resolved on all affected customers. We are monitoring for any further issues.

This issue is now resolved.