The PHP project released security updates (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) fixing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution.
This affects every SupportPal installation. The vulnerabilities are in PHP itself, not in SupportPal, but any server running PHP and serving web requests is exposed. You should update your PHP version immediately, regardless of how you run SupportPal.
Our Docker Monolithic image bundles PHP, so we have released new SupportPal versions containing the patched PHP release. In accordance with our End of Life (EOL) Policy, these are:
Follow the Docker section of our Upgrade Guide. To update to 5.7.9, change the version in the upgrade script URL from 6.x to 5.x:
bash <(curl -LsS https://raw.githubusercontent.com/supportpal/helpdesk-install/5.x/templates/docker-monolithic/upgrade.sh)
If you run SupportPal on your own server, PHP is managed by you rather than by SupportPal.
There is no need to update SupportPal - there are no changes to the helpdesk itself. However, you must update PHP on your server to one of the patched versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35) as soon as possible. Most Linux distributions have already shipped the fixes, so check your operating system vendor or package repository for updated PHP packages. If a patched package isn't yet available for your distribution, follow the mitigation steps in the PHP security advisory.