Two critical security vulnerabilities have been identified in PHP, a widely used server-side scripting language commonly used to develop websites, web portals and other web-based applications. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated attackers to execute malicious code remotely on affected servers.
Sage CRM does not use PHP as part of its standard product architecture and is not directly affected by these vulnerabilities.
However, Sage CRM can be integrated with third-party applications developed using PHP. This advisory explains the potential implications for these integrations and the steps that Sage CRM partners and customers should consider.
Advisory: Sage CRM – Critical PHP Security Vulnerabilities and Third-Party Integrations (CVE-2026-109618 / CVE-2026-109619)
