In brief On 21 October 2026, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, scored 9.2/10) allow remote code execution on unpatched servers. PHP versions 8.2, 8.3, 8.4 and 8.5 are affected if they have not received the 21 October patch. Odoo sites, written in Python, are not affected by these vulnerabilities.
On 21 October 2026, the PHP team released emergency security patches for two critical flaws in PHP, referenced CVE-2026-109618 and CVE-2026-109619. Each allows an attacker to execute code remotely on a web server without any authentication. CERT-EU is urging organisations to install the patches immediately (CERT-EU, October 2026).
The building's front door, not your flat
PHP is the language in which a large proportion of websites are written: WordPress, Drupal, Magento and Joomla, among others. These two vulnerabilities are not located in your website or your extensions. They sit in the layer that processes requests before your code runs, in other words in the building's front door, not in your flat.
One exploits poor memory management. The other involves internal data that persists between requests when it should be discarded. The result: an attacker can walk in without a key and act before your application even notices.
No reliable public exploit had been confirmed as of 21 October 2026, according to linuxcompatible and solutions-numeriques. However, information had leaked before the official publication, accompanied by a video showing a tool called PHP2Shell taking control of WordPress, Drupal, Magento and Joomla sites. Caution is essential.
Which versions are affected?
The affected branches are as follows:
- PHP 8.2 prior to version 8.2.35
- PHP 8.3 prior to version 8.3.36
- PHP 8.4 prior to version 8.4.27
- PHP 8.5 prior to version 8.5.12
Older branches have not received security patches for a long time. If your server is still running PHP 7.x or a version of 8.x earlier than those listed above, the problem predates these two CVEs by a wide margin.
Two useful points to bear in mind before taking action. Your hosting control panel may display an up-to-date version even though the server has not been updated: a real-world case reports a panel showing "PHP 8.4" while the vulnerable 8.4.26 was still running (source: X, October 2026). Conversely, an apparently old version number does not necessarily mean the server is vulnerable: Ubuntu 26.04 LTS ships PHP 8.5.4 in its packages but already includes the fix (justgeek, October 2026). Always verify the actual binary version, not what an interface shows.
A maintenance issue more than a technology one
PHP is a solid language when properly maintained. The real issue lies elsewhere. A Censys study, reported in June 2026 by it-daily, indicates that more than 70% of WordPress sites analysed were running outdated versions of PHP. The reason is well known: updates sometimes cause incompatibilities with older extensions and many administrators keep putting them off indefinitely.
The PHP team itself confirms that no temporary measure guarantees complete protection (source: X, October 2026). The only reliable response remains installing the patch.
The four questions to ask your hosting provider today
- What exact version of PHP is running on my server?
- Is the patch from 21 October 2026 installed?
- Who installs patches when the next alert comes?
- Are my extensions compatible with an up-to-date version of PHP?
If the answer is slow to come, that is already an answer.
What about Odoo sites?
Odoo is written in Python, not PHP. The two vulnerabilities CVE-2026-109618 and CVE-2026-109619 therefore do not affect sites and applications powered by Odoo. Python is also the dominant language of artificial intelligence, which is one of the reasons why Odoo 20 includes particularly advanced AI, with 52 dedicated modules in the Enterprise edition.
This does not mean Odoo is immune to everything: Python and Odoo have their own security advisories too. The difference lies in the maintenance model. A single perimeter to monitor, a team that knows the environment, updates applied without having to chase them and no accumulation of forgotten extensions. On Odoo.sh, security updates are managed by the hosting provider. On-premise, they remain your responsibility.
If you also run a WordPress or PrestaShop site alongside Odoo, you remain exposed to these vulnerabilities until the patch is installed. Our consultants can review your environment with you.
A vulnerability takes a day to fix, a habit takes years to build
Security maintenance is not a one-off event. It is a discipline. Every alert like the one on 21 October 2026 reveals which organisations have a process in place and which are scrambling to react. The process review we carry out with our clients systematically covers this area: who monitors, who decides, who acts and within what timeframe.
If your site is still living in an unmaintained PHP environment and you are considering migrating to Odoo, our consultants will support you from the initial analysis through to go-live. Spend 30 minutes with a consultant to take stock of your situation.
Frequently asked questions
How can I tell whether my server is actually vulnerable?
Ask your hosting provider for the exact version of the PHP binary currently running, not the version shown in your control panel. A panel can display a recent version without the server having been updated. Compare the number you receive against the thresholds published on 21 October 2026: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Is my WordPress site automatically protected by WordPress automatic updates?
No. WordPress updates its own code, not PHP. PHP is managed at the server or hosting level. It is a separate action that only your hosting provider or system administrator can perform.
Is there a temporary workaround if I cannot update PHP immediately?
The PHP team itself states that no temporary measure guarantees complete protection. The only reliable response remains installing the patched versions released on 21 October 2026.
Is an Odoo site exposed to these two vulnerabilities?
No. Odoo is written in Python, not PHP. CVE-2026-109618 and CVE-2026-109619 affect only servers running PHP. If you also run a WordPress or PrestaShop site on the same hosting environment, that site remains exposed until the patch is installed.
What can I do if I want to stop managing these repeated alerts?
Moving to Odoo removes the PHP layer from your stack entirely. You remain responsible for Odoo and Python updates, of course, but you are managing a single, coherent environment rather than an accumulation of heterogeneous extensions. A 30-minute conversation with an ANOR consultant can help assess the feasibility for your situation.