Ongoing since 04:22 PM UTC.
The patches are in, our scans are clean, and testing has passed. We are continuing to monitor as the incident recovers. This was an out-of-band update, so please let us know if anything doesn’t work as it should. This applies especially if you have custom development work, as that is where we would expect any unusual behaviour to show up first. You can raise a ticket or call us on 01748 473000 [option 2 for support]. We will post a final update once we are satisfied the incident is fully resolved. _A note for the technical team: thank you for bearing with us during this challenging time, and to those who sent encouraging messages of support, we really appreciated them._
Update timeline
- investigating Oct 21, 2026, 04:22 PM UTC
Today two critical security vulnerabilities, known as "PHP2Shell", were disclosed in PHP, the programming language used by a large proportion of websites and web applications worldwide, including our platform. We want to let you know what we have done in response. What we have done - Applied protective measures across our hosting platform, following the guidance published by the PHP security team. - Introduced additional filtering of incoming requests to block the known methods of attack. - Put enhanced security monitoring in place to detect and respond quickly to any suspicious activity. What happens next We are preparing and testing an updated version of PHP containing the official security fix, and will roll it out across the platform once testing is complete. We do not expect this to cause any disruption to your service. Your data We have seen no indication that customer data has been accessed or affected. Our review is continuing, and we will contact you directly if that changes. Do I need to do anything? No action is required from you. If you use our API, web forms or other integrations notice anything not working as expected, please contact our support team at [email protected] or via our live chat so we can help straight away. We will send a further update once the updated PHP has been fully rolled out.
- investigating Oct 21, 2026, 05:24 PM UTC
Our telephones remain open in case anyone needs to speak with us, normal number press 2 for support. We will be available until 19:30 UK time.
- investigating Oct 21, 2026, 07:22 PM UTC
We continue working on this issue. Our technical team is testing the fix and will deploy it once testing is complete. In the meantime, mitigating rules remain in place on our servers. We will post a further update when the situation changes materially.
- investigating Oct 21, 2026, 10:09 PM UTC
We are still working on this issue. Our technical team is testing the fix and will deploy it once testing is complete. Mitigating rules remain in place on our servers, and our website, opencrm.co.uk, remains offline while patches are applied. We will post a further update when the situation moves on materially.
- investigating Oct 21, 2026, 11:17 PM UTC
The patches are in, our scans are clean, and testing has passed. We are continuing to monitor as the incident recovers. This was an out-of-band update, so please let us know if anything doesn’t work as it should. This applies especially if you have custom development work, as that is where we would expect any unusual behaviour to show up first. You can raise a ticket or call us on 01748 473000 [option 2 for support]. We will post a final update once we are satisfied the incident is fully resolved. _A note for the technical team: thank you for bearing with us during this challenging time, and to those who sent encouraging messages of support, we really appreciated them._
Your product runs on more than OpenCRM
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services