PHP2Shell and SuiteCRM, Mautic and Matomo

As of 23 October 2026, SuiteCRM, Mautic and Matomo have each published a PHP2Shell notice, and all three say the same thing: the flaw is in PHP, so updating the app does not fix it. SuiteCRM says its hosted customers are already on patched PHP, and Matomo says Matomo Cloud customers need to take no action. None of the three was named by the research teams Calif or Wiz, which means they were not publicly tested, not that they are safe.

The direct answer: if you run SuiteCRM, Mautic or Matomo on your own server, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package), restart every PHP process, including cron jobs and queue workers, and confirm the new build is the one in use. If the vendor hosts it for you, read its notice and keep a copy for your records.

These three apps hold customer records, contact lists and visitor data, which is why they deserve attention this week. For the background on the flaws, read what PHP2Shell is and who it affects.

What Each Vendor Said

SuiteCRM adds a point that applies to all three: "As the issue is in PHP rather than SuiteCRM, any measures should cover the whole server, including any other websites or applications running on it." If your CRM shares a server with your website or a WordPress install, patching PHP protects both.

The Dutch national cyber security centre's software inventory lists SuiteCRM, Mautic and Matomo On-Premise as Vulnerable. That label is a generic one: the note says each app is "Affected when deployed on an affected web-serving PHP runtime." It reflects that the app runs on PHP, not a separate flaw in the app.

PHP Versions Each App Supports

Patch within the PHP branch you already run. Mautic's advice applies to all three: "Stay on the branch you already run (so 8.3.x moves to 8.3.36, for example)."

SuiteCRM versions come from its compatibility matrix. SuiteCRM also notes that PHP 8.5 is not yet officially supported; if you are already on it, "update to 8.5.12." PHP 8.2 reaches end of life on 31 December 2026, so plan the next move now. Our fixed versions list has the patched number for every branch and distribution.

Who Patches: Cloud vs Self-Hosted

• SuiteCRM Hosted. SuiteCRM says it "applied the patch to all our hosting clients shortly after it came out" and that the 23 October follow-up advisory "has been addressed."
• Matomo Cloud. Matomo says its "Cloud infrastructure is already protected against these vulnerabilities."
• Self-hosted SuiteCRM, Mautic or Matomo. Whoever looks after the server patches PHP. That is you, your IT team, your agency or your host. SuiteCRM: "PHP is updated by whoever looks after that server, usually your hosting provider or IT team."
• Matomo inside WordPress. The Matomo Analytics for WordPress plugin runs on your WordPress site's PHP, so it is patched when that server is. See PHP2Shell and WordPress.

If you are unsure who owns the server, our shared responsibility guide helps you work it out.

Where to See the PHP Version

• SuiteCRM: "go to Admin > Diagnostic Tool and check the output from phpinfo() , or run php -v on the server."
• Mautic: "under Settings (the cog), then System info." Mautic adds a warning about php -v: "make sure it's the same PHP your web server and cron jobs use – it's easy to have more than one installed."
• Matomo: we did not find an admin menu path in Matomo's notice. Ask whoever runs the server, or use the methods in our guide to checking your PHP version.

A lower number does not always mean you are exposed. Linux distributions often backport the fix without changing the version string, so check the package changelog for CVE-2026-109618 and CVE-2026-109619.

Steps for Self-Hosted Installs

Commands are examples; replace 8.3 with your version and use your distribution's package names.

1. Back up first. SuiteCRM: "take a fresh backup of your SuiteCRM files and database, and make sure you can restore it." The same applies to Mautic and Matomo. Our backup and recovery guide covers what to keep.
2. Update PHP in your current branch. On Debian or Ubuntu that is typically sudo apt update then sudo apt upgrade. On a control panel, use its PHP update.
3. Restart everything that runs PHP. Example: sudo systemctl restart php8.3-fpm, or restart Apache for mod_php. Then restart queue workers and any long-running PHP processes. A worker that started before the update still runs the old code.
4. Docker installs: pull and redeploy. For Mautic, pull the rebuilt image for your major version and recreate the container. Restarting the old container is not enough.
5. Turn off session upload progress. Set session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart. PHP's 23 October informational advisory (CVE-2026-115560) suggests it "until the next regular bugfix release," and SuiteCRM says "switching it off won't affect how it works."
6. Verify. Check the app's system info page again. Mautic's final check: "A quick look at your cron jobs and a test email." For Matomo, confirm reports are still being processed.

If the update will be delayed, SuiteCRM suggests your IT team "consider limiting access to the server from the public internet until it's done." For PHP's partial interim settings, see our interim mitigations guide.

Installs Still on PHP 8.1 or Older

The PHP project publishes no releases for 8.1 and older. It did publish minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors ship backported packages. SuiteCRM's advice: "there is no official update from the PHP project, so plan an upgrade . Some Linux distributions provide their own fixes, so check with your vendor."

The practical order is the same for all three apps:

1. Install your distribution's or panel's patched 8.1 (or older) package today, if one exists.
2. Pick a supported branch your app version allows: 8.3 for Mautic 5.2 and 6, 8.2 or 8.3 for SuiteCRM 8.8 and later.
3. Test the move on a staging copy. SuiteCRM notes that "Moving to a newer PHP version may also mean upgrading SuiteCRM."

The Data These Apps Hold

A CRM holds customer records and sales notes. Mautic holds contact lists and email-sending settings. Matomo holds visitor data. All three store API keys and passwords for the services they connect to.

Wiz says one PHP2Shell path can leak process memory that "may contain passwords, authentication tokens, API keys and certificates." Beazley advises treating "secrets held by an affected PHP process as potentially exposed." If you find signs of compromise, rotate mail-provider credentials, API keys and integration tokens, reset admin passwords, and work through our was my site hacked checklist. Breach notification rules depend on your location and the data involved; this is general information, not legal advice.

What Not to Rely On

• An app update. TYPO3, WooCommerce, PrestaShop, SuiteCRM and Matomo have all said it plainly: updating the app does not fix this.
• memory_limit=-1 as a long-term setting. Mautic lists it as a stopgap and warns that "one runaway process can eat all the memory on a busy Mautic server." PHP itself says its interim measures "do not make an installation safe."
• ini_set() or .user.ini. PHP says not to rely on them for the upload progress setting. Use php.ini, the FPM pool or server configuration.
• A php -v check alone. The command-line PHP can differ from the one serving the app.

Conclusion

SuiteCRM, Mautic and Matomo agree: PHP2Shell is fixed in PHP, not in the app. Hosted customers of SuiteCRM and Matomo Cloud are covered by their vendors. Self-hosters need a patched PHP build, a restart of every PHP process including workers and cron, upload progress switched off and a quick functional check. If you would rather hand the server work to someone else, see our emergency PHP patching service. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions