What’s changed
On October 21, the PHP project released emergency fixes for two critical flaws in PHP itself, nicknamed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Both can allow an unauthenticated attacker to run code on servers that handle PHP web requests. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to patch immediately, and the PHP project has been clear that updating is the only complete fix. Oro immediately patched all OroCloud managed environments and notified self-hosted customers.
PHP2Shell is one example of a wider trend. AI tools are now finding vulnerabilities in every major language and framework, and they find them faster than before. In June, FIRST (the global forum of incident response and security teams) raised its 2026 forecast to roughly 66,000 published vulnerabilities, well above its own projection at the start of the year, and named AI-assisted discovery as a major driver. FIRST also found that the share of vulnerabilities needing urgent action has held steady. More vulnerabilities are being published, but the job is the same: identify the ones that matter and fix them quickly.
More reports don’t mean the software has become less secure. They mean weaknesses that would previously have gone unnoticed are now being found and fixed. You should expect regular security updates from OroCommerce as part of ongoing platform maintenance. Frequent patches mean faster, more proactive protection — just be sure to review and apply them promptly when they are released.
Attackers are taking advantage. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities is now the most common way attackers first get into an organization, ahead of stolen credentials for the first time in the report’s history. Credential abuse still shows up at some stage in about four in ten breaches.
Put simply, patching quickly and controlling access matter most right now. The sections below cover what Oro handles and what we recommend for your team.
What Oro handles for OroCloud customers
OroCloud is a fully managed platform. Oro maintains the infrastructure your OroCommerce application runs on: the operating system, PHP runtime, web server, database, search, caching and message-queue services, network, and perimeter defenses. Patching that stack is our responsibility, not yours.
- We updated all OroCloud environments to patch PHP versions on October 22nd. You don’t need to take any action.
- Our security and infrastructure teams monitor advisories from government and industry threat-intelligence sources and from the maintainers of every component in our stack, and prioritize fixes by severity. When a critical infrastructure patch is released, we may schedule unplanned maintenance to apply it, and we notify environment owners when we do.
- All traffic to OroCloud first passes through Cloudflare, which acts as the first layer of intrusion detection and prevention. A second web application firewall then applies rate limiting and blocks known malicious patterns before requests reach your application.
- We monitor critical systems, OS, and log files in real time. Any unexpected change, addition, or deletion sends an alert to our team for review.
- An independent auditor reviews Oro every year. Our current SOC 2 Type II and SOC 1 Type II reports cover June 2025 through May 2026, and we maintain PCI DSS v4.0.1 compliance as a service provider. We also run annual third-party penetration tests and quarterly external scans by an approved scanning vendor. Reports are available under NDA from us.
At the application level, responsibility is shared. Oro releases security fixes for the standard OroCommerce application, including its bundled frameworks and libraries, as patch releases. You or your implementation partner maintain any custom code, extensions, or third-party packages added during implementation, and should apply our patch releases promptly. Our Shared Security Responsibility model lists who owns what in detail.
If you host OroCommerce yourself
Please check that your servers run PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later, and restart all PHP workers after updating. On October 23, PHP also disclosed a narrower, related issue (CVE-2026-115560) that these releases don’t fix; until PHP’s next regular release, set session.upload_progress.enabled = 0 in php.ini or your PHP-FPM pool configuration. PHP 8.2 reaches end of life on December 31, 2026 and will get no security fixes after that, so if you’re on 8.2, start planning your upgrade. Your Oro account team can help.
Recommended steps for your team
Many incidents start with access rather than infrastructure. We recommend the following:
- Require multi-factor authentication wherever possible. OroCommerce Enterprise supports two-factor authentication for back-office users, so enforce it for administrators at minimum, and also on email, SSO, code repositories, and partner accounts that touch your environment.
- Give people only the access their job requires, and review roles at least quarterly.
- Disable accounts on someone’s last day, and tell Oro Support when anyone with OroCloud environment access (VPN, SSH, or deployment rights) leaves.
- Don’t share credentials. If credentials or a device are lost or stolen, contact Oro through the Customer Support Portal right away. Implement enterprise-grade password management tools where practical.
- Limit API and integration users to the permissions they need, rotate their keys regularly, and keep secrets out of code.
- Make sure your team or partner applies our patch releases promptly and runs automated dependency and security checks on custom code and extensions.
- Provide regular security-awareness training. Phishing and pretexting are still among the most common ways attackers get in.
Questions
If you’d like to review your environment, access controls, or our compliance reports with us, contact your Oro account team.
Sources
- CISA, “Critical Vulnerabilities in PHP Require Immediate Patching” (Oct 21, 2026): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- PHP project, PHP 8.4.27 security release notes (Oct 21, 2026): https://github.com/php/php-src/releases/tag/php-8.4.27
- PHP project, “Informational advisory: Session upload progress” (CVE-2026-115560) (Oct 23, 2026): https://www.php.net/archive/2026.php#2026-10-23-1
- FIRST, Mid-Year 2026 Vulnerability Forecast (Jun 15, 2026): https://www.first.org/newsroom/releases/20260615
- Verizon, 2026 Data Breach Investigations Report (May 2026) — summary via Help Net Security: https://helpnetsecurity.com/2026/05/20/verizon-2026-dbir-findings
- Oro, OroCloud Shared Security Responsibility and Best Practices: https://doc.oroinc.com/cloud/security/best-practices/
