PHP Vulnerability Responses by Company

Salesforce

Global cloud / infrastructure
Aliases / services
セールスフォース / Heroku / ヘロク / Salesforce
Official website
https://www.salesforce.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Heroku — PHP 8.2 / 8.3 / 8.4 / 8.5

Response status
Fix available; application required
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Heroku provides PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Scope: This does not establish the response status of Salesforce CRM as a whole.

What users should do

Redeploy applications and verify that running dynos use patched PHP.

Official service URL

Source URLs

  1. Heroku: PHP security releaseshttps://devcenter.heroku.com/changelog-items/3845Response evidence
  2. https://devcenter.heroku.com/changeloghttps://devcenter.heroku.com/changelogService and operation documentation

Heroku-22 — PHP 8.1.34 backport

Response status
Mitigation guidance available
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

A limited backported mitigation is available for PHP 8.1.34.

Scope: This is not a supported upstream release.

What users should do

Redeploy to verify application of the mitigation and migrate to supported PHP, as strongly recommended by Heroku.

Official service URL

Source URLs

  1. Heroku: PHP security releaseshttps://devcenter.heroku.com/changelog-items/3845Response evidence
  2. https://devcenter.heroku.com/changeloghttps://devcenter.heroku.com/changelogService and operation documentation
Related official sources
  1. Heroku: PHP security releasesOfficial notice

Comments