Odoo and PHP: Why Critical PHP Vulnerabilities Don't Affect Your Odoo.

Odoo does not run on PHP. That is why the two critical vulnerabilities that PHP fixed on October 21, 2026, do not affect your Odoo, even though they put millions of websites at risk and forced some organizations to take their sites offline as a precaution.

If your company uses Odoo, the short answer is this: your Odoo environments were not compromised. If you also have websites or applications written in PHP, here's what happened and what you should check.

Odoo does not use PHP in any part of its operation.

A PHP error has no way of affecting your ERP—not in accounting, not in the warehouse, and not in the Odoo online store. When the alert went off, our Odoo customers didn't have to do anything. They didn't have to disconnect anything either.

Confusion between Odoo and PHP is common because many ERP systems, online stores, and content management systems are built using PHP. Odoo is not one of them.

The error is in PHP, not in a plugin.

PHP is the language that powers most websites: WordPress, WooCommerce, Magento, Drupal, and thousands of custom applications. When a plugin fails, that plugin is fixed. This time, it was the foundation on which everything else rests that failed.

The two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are rated 9.2 out of 10 in severity. In practice, this means three things:

• All it takes is one request. The attacker doesn't need a username or password. All they have to do is send a specially crafted request to your website.

• It doesn't matter how well-designed your website is. The attack is executed before the application code starts running, so even the best development practices can't stop it.

• The attacker is in control of the server. They can do whatever they want: steal data, install malware, or use your computer to attack others.

The vulnerability has been there for 14 years, since PHP 5.4 (2012), and affects the default settings. All common ways of serving PHP are vulnerable, and Apache with mod_php is the most at risk.

The solution is to update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP 8.1 and earlier versions are no longer supported, so they will never receive an official patch.

From a private report to a PHP patch—in three days.

• August: The researchers from Calif and Wiz privately notify PHP.

• October 20: Details are leaked ahead of schedule, watchTowr confirms they're real, and PHP publishes the story early.

• October 21, 9:43 a.m.: Cloudflare detects the first attacks hours before any patch is available.

• October 21, 3:30 p.m.: PHP releases the fixed versions.

All times are in peninsular time. CERT-EU, the UK NCSC, and the Dutch NCSC issued alerts that same day. CERT-EU's advice was clear: patch immediately or take the system offline if that is not possible.

Millions of PHP websites are vulnerable, and many cannot be patched.

PHP powers about 70% of websites whose server-side language is known. The vulnerability affects WordPress, WooCommerce, Magento, Shopware, Drupal, Joomla, Nextcloud, phpMyAdmin, Laravel, and Symfony.

An estimate based on Shodan puts the number of servers openly exposing PHP on the internet at about 2.2 million. About 884,000 of them are running versions that will never be patched, and another 740,000 hide their version.

In the Netherlands, Tweakers and the NCSC itself took their websites offline as a precaution. Public proof-of-concepts are already circulating, watchTowr is detecting active exploitation attempts, and Magento has a confirmed exploit. E-commerce is the hot spot: Sansec expects widespread exploitation now that the patch and technical analyses are public.

Odoo and PHP in the Same Company: Where There Is a Risk.

Your Odoo is secure, but the systems around it may not be. If you have a WordPress website, a WooCommerce or Magento store, or any PHP application running alongside your Odoo, those components are vulnerable. Check them today:

1. Take inventory. Corporate website, online store, intranet, document management system, internal tools: make a note of everything that runs on PHP.

2. Check the version. You need PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 or later. If you're running 8.1 or earlier, there's no patch: you'll have to upgrade.

3. Ask whoever takes care of it. And ask for an hour, not a promise.

A certificate does not respond to an alert. A team does.

Dynapps is ISO 27001 certified. This certification attests to our commitment to robust security processes. In practice, it means that as soon as an alert is triggered, we know which part of each system is compromised and take action that very same day.

If you work with Odoo, this PHP bug does not affect you.