DoliCloud servers fully patched within hours following the php2shell vulnerability

Published on Wednesday, October 21, 2026

A critical security vulnerability, known as php2shell, was disclosed recently in the PHP ecosystem. As soon as the official patches were released, our team immediately mobilized to protect the DoliCloud platform and all the instances of our customers.

Our response

Following the publication of the security fixes, all DoliCloud servers were updated within the hours that followed, on Wednesday, October 21. The patching campaign covered our whole infrastructure: web frontends, application servers, database servers and deployment nodes.

No impact on our customers

The updates were applied without service interruption. No exploitation of the php2shell vulnerability has been detected on the DoliCloud infrastructure, and no customer data was affected.

Security is a permanent commitment

Security is not a one-time task. Our team continuously monitors security advisories affecting the software stack we rely on (PHP, Dolibarr ERP CRM, operating system and third-party libraries), and applies patches as soon as they are published, with priority given to critical vulnerabilities. For more technical details about this vulnerability, you can read the PHP2Shell page on Wikipedia.

If you have any question about this security update, feel free to contact our support team.

Thank you for your trust.

The DoliCloud team