PHP Vulnerability of October 21, 2026 : What You Need to Know — and What It Means for Your Dolibarr ERP

What Happened

On Wednesday, October 21, 2026, the web experienced one of the most significant security incidents in recent years. Two critical vulnerabilities, nicknamed « PHP2Shell » by experts (referenced as CVE-2026-109618 and CVE-2026-109619), had to be patched on an emergency basis in PHP, the programming language that powers roughly 70% of all websites worldwide : online shops, institutional sites, management tools… and your Dolibarr ERP.

What makes this event exceptional is first its scale : every PHP version from 5.4 to 8.5 was affected, meaning potentially millions of servers (22 million exposed platforms according to Palo Alto Networks). Then there is how the flaws were discovered : by artificial intelligence, during audits carried out by the cybersecurity firms Wiz (a Google subsidiary) and Calif, with the help of OpenAI’s AI models. The severity was rated 9.2 out of 10 on the international CVSS scale — a level classified as « critical. »

Following the announcement, a great many sites were voluntarily taken offline as a precaution until the patches could be applied : in France, the websites of every prefecture, several ministries (Culture, Ecology), the tax authority’s site, and even major media outlets and large companies such as Renault. Similar measures were taken in the United Kingdom, Germany, Belgium, the Netherlands, Denmark, and Finland. France’s cybersecurity agency (Anssi) and its alert center CERT-FR recommended disconnecting servers that had not yet been updated ; the US NSA issued the same guidance.

Why It Matters, in Plain Terms

These two vulnerabilities allowed an attacker, without a password and without any login, to :

• Remotely execute code on the server — in other words, literally take control of the machine hosting the website ;
• Access the data stored on the server ;
• Cause service outages (denial of service), making the site unusable.

To put it plainly : could you imagine anyone in the world being able to open your safe without a key ? That is exactly what these flaws made possible on an unpatched server. And within days of the patches’ release, real-world attacks were observed : the US agency CISA officially added these vulnerabilities to its catalog of flaws actively exploited by attackers on October 26.

The Patches That Were Applied

The response was fast and well coordinated. On the evening of October 20, the PHP team warned the community that a critical update would be released the next day. The patches were published on October 21, 2026, at 2:00 PM UTC (4:00 PM Paris time), in the following versions :

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

What About Older Versions, Especially PHP 7 ?

The PHP 7.4, 8.0, and 8.1 branches are no longer officially maintained by the PHP project, but the situation affected so many servers that patches were nonetheless released for these versions :

• Official backports : the PHP security team provided « backported » patches (source backports) for PHP 7.4, 8.0, and 8.1, intended for those who compile PHP themselves or who do not receive a package from a vendor ;
• Third-party patches : specialized companies such as TuxCare offer patched versions for even older branches (down to PHP 5.2) through their ELS service, for organizations that cannot migrate immediately ;
• Linux distributions and hosting providers have backported the patches into their own packages : check with your distribution or your host whether a security update is available for your PHP 7 version.

A word of caution, however : these PHP 7 patches are stopgap measures. These branches will receive no further patches going forward (the next vulnerability will most likely not be covered), and PHP 8.2 itself will stop receiving fixes after December 31, 2026. The truly durable solution remains to plan a migration to a maintained PHP version (8.3 or newer) — which generally also involves upgrading Dolibarr.

Hosting providers, operating system vendors, and solution suppliers received the patches in advance and deployed them within hours or days. For a properly updated server, the risk has been eliminated today.

What This Means for Your Dolibarr ERP

Dolibarr is a business management software package (invoicing, accounting, inventory, CRM…) that runs on PHP : it was therefore directly affected by this vulnerability. Here are the key points :

1. The flaw did not come from Dolibarr. It was the PHP « engine, » on which Dolibarr is built, that was vulnerable. Dolibarr itself had no security defect to fix in this episode.

2. What matters is the version of PHP installed on the server hosting your Dolibarr. If the server has been updated to one of the patched versions listed above, your ERP is protected.

3. If your Dolibarr is hosted by a service provider (specialized host or external IT team), the PHP update was very likely handled by them as a matter of course. One simple question is all it takes : « Is our Dolibarr running on a patched version of PHP (at least 8.2.35) ? »

4. If your Dolibarr runs under Docker, you need to verify that the container image has been rebuilt with a patched PHP — this is the responsibility of whoever maintains the installation.

5. If Dolibarr runs on your own server with an outdated PHP version (7.4 to 8.1), backported patches have been released (see the section « What About Older Versions ? »), but the durable solution remains a migration to a maintained version of PHP.

The risks of doing nothing are far from theoretical for a business : an attacker exploiting the flaw can steal your customer and supplier data, your invoices, and your banking information, encrypt your files to demand a ransom, or use your server to attack other targets.

Good Habits to Keep

This episode is an excellent lesson in « cybersecurity for everyone » :

• Keep your software up to date : the vast majority of attacks exploit flaws that have already been fixed. Applying updates is like locking your door.
• Check the PHP version of your web tools at least once a year, and insist on a version that is still maintained.
• Back up your data regularly (invoices, Dolibarr database) to a separate storage medium : it is the best insurance against ransomware.
• Restrict external access to your Dolibarr wherever possible, and use strong passwords.
• When in doubt, unplug : as the prefectures did, temporarily taking an unpatched service offline is always better than leaving it exposed.

In Summary

On October 21, 2026, two critical vulnerabilities discovered thanks to AI threatened the « backbone of the web » — PHP. Thanks to exceptional coordination, patches were released in less than 24 hours and applied at scale. Dolibarr, like any software running on PHP, was exposed through its server ; a server updated to PHP 8.2.35 or newer is protected today. Vigilance remains essential : these flaws are actively exploited, and forgotten servers remain easy prey.

Main Sources

• Anssi / CERT-FR : alert of October 21, 2026 on the critical PHP vulnerabilities
• PHP Foundation : security advisories of October 20 and 21, 2026 (CVE-2026-109618, CVE-2026-109619)
• CISA (United States) : immediate-patching alert, addition to the KEV catalog on October 26, 2026
• CERT-EU : advisory 2026-018 « Critical Vulnerabilities in PHP »
• Dolibarr France forum : thread « Correctif de sécurité PHP pour les failles CVE-2026-109618 et CVE-2026-109619 »
• AFP dispatches of October 21, 22, and 24, 2026 ; analyses by Wiz, watchTowr, Rapid7, Unit 42, IT-Connect, Cybelangel