# PHP updates in less than 2 hours: Upcoming Critical PHP Security Release **URL:** \ **Category:** Maintaining my Dolibarr\ **Created:** [October 21, 2026, 12:17pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421 "2026-10-21T12:17:14Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![MarcLaporte](https://www.dolibarr.org/forum/user_avatar/www.dolibarr.org/marclaporte/32/9319_2.png) [@MarcLaporte](https://www.dolibarr.org/forum/u/MarcLaporte)\ **Post date:** [October 21, 2026, 12:17pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/1 "2026-10-21T12:17:14Z")
[https://www.php.net/archive/2026.php#2026-10-20-1](https://www.php.net/archive/2026.php#2026-10-20-1) “The PHP security team would like to give advance notice of an **upcoming security release**. **It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.** It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.” ---
**Author:** ![florian.hoedl](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/f/6de8d8/32.png) [@florian.hoedl](https://www.dolibarr.org/forum/u/florian.hoedl)\ **Post date:** [October 21, 2026, 5:57pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/2 "2026-10-21T17:57:54Z")
Latest fixes are also on dockerhub! ---
**Author:** ![jonbendtsen](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/977dab/32.png) [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\ **Post date:** [October 21, 2026, 9:16pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/3 "2026-10-21T21:16:15Z")
> [@MarcLaporte](#): > > [PHP: News Archive - 2026](https://www.php.net/archive/2026.php#2026-10-20-1) > > “The PHP security team would like to give advance notice of an **upcoming security release**. **It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.** It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.” How do we test if we have a safe version? ---
**Author:** ![jonbendtsen](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/977dab/32.png) [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\ **Post date:** [October 21, 2026, 9:33pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/4 "2026-10-21T21:33:43Z")
Here’s how to test according to my Lumo AI. visit this page `/admin/system/phpinfo.php?mainmenu=home&leftmenu=admintools` ![image](https://www.dolibarr.org/forum/uploads/dolibarrorg/original/2X/5/5407ee5382166cdbe0969ecab29a8d83ec749815.png) _The [php.net](http://php.net) archive shows security releases in the 8.2 series up to at least 8.2.33/8.2.34, and the critical release was scheduled for today at 14:00 UTC. Your image was built at 16:03 UTC the same day – i.e. **two hours after** the release time – and version 8.2.35 sits above the earlier security releases mentioned. This strongly suggests your container is already running the patched version (e.g. if the image was pulled/restarted this afternoon)._ _ **But to verify:** Since the PHP team had not yet published which exact version number contains the critical fix, you should double-check on the [php.net ChangeLog for 8.2](https://www.php.net/ChangeLog-8.php) that 8.2.35 is the current security release – or simply pull the latest image once more (`podman pull` + restart) to guarantee you’re up to date._ And when I look at the changelog for 8.2, it seems like version 8.2.35 has the necessary fixes. ---
**Author:** ![MuhammadAli.Dev](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/m/3d9bf3/32.png) [@MuhammadAli.Dev](https://www.dolibarr.org/forum/u/MuhammadAli.Dev)\ **Post date:** [October 21, 2026, 10:49pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/5 "2026-10-21T22:49:23Z")
That phpinfo page (Home \> Admin tools \> PHP info) is the right place to check, since it shows what the web server really runs. Safe versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer; anything older in those branches is not fixed. After updating, restart Apache or PHP-FPM and check the page again. One catch: Debian/Ubuntu packages can carry the fix under an older version number, so check the package changelog if in doubt. Docker users: the 8.2.35 tags did land, as Florian said. If you also want the end-of-life date and a Dolibarr upgrade path, I made a small free checker: [PHP Version Check: PHP2Shell patch, end of life & upgrade path | SiliconBlaze](https://www.siliconblaze.com/tools/php-version-check/) (in-browser, nothing stored). Disclosure: I built it. ---
**Author:** ![lojiego](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/l/c37758/32.png) [@lojiego](https://www.dolibarr.org/forum/u/lojiego)\ **Post date:** [October 22, 2026, 6:05pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/6 "2026-10-22T18:05:36Z")
I updated my Dolibarr (from 19-24.02) and all worked fine. (although it seemed that some recent invoices weren’t showing on the main dashboard, they were still present). Then I updated my PHP from 8.1 to 8.4, and how I am unable to log-in to Dolibarr. ☹ I get the error on the top saying , “\*\*Security token has expired, so action has been canceled. Please try again.” \*\* I have erased the only module I had installed in /custom (TOTP 2FA), but I’m still getting the error. What can I try next!? ---
**Author:** ![lojiego](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/l/c37758/32.png) [@lojiego](https://www.dolibarr.org/forum/u/lojiego)\ **Post date:** [October 22, 2026, 7:50pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/7 "2026-10-22T19:50:31Z")
Well, I back-dated to PHP 8.3.36 and it works … so something between 8.3 and 8.4 was broken for me … Anyone else have an issue doing that migration? ---
**Author:** ![jonbendtsen](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/977dab/32.png) [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\ **Post date:** [October 24, 2026, 9:27am UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/8 "2026-10-24T09:27:32Z")
@lojiego which Dolibarr version are you running? ---
**Author:** ![jonbendtsen](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/j/977dab/32.png) [@jonbendtsen](https://www.dolibarr.org/forum/u/jonbendtsen)\ **Post date:** [October 24, 2026, 9:28am UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/9 "2026-10-24T09:28:53Z")
> [@lojiego](#): > > I get the error on the top saying , “\*\*Security token has expired, so action has been canceled. Please try again.” I get something like that when I come back to a tab to dolibarr and just start filling in username and password. Reloading the page usually works ---
**Author:** ![lojiego](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/l/c37758/32.png) [@lojiego](https://www.dolibarr.org/forum/u/lojiego)\ **Post date:** [October 24, 2026, 8:37pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/10 "2026-10-24T20:37:21Z")
dolibarr 24.02. Refreshing the page / new browser, etc… does not fix it. Couldn’t get it to work on PHP 8.5 or 8.4 ---
**Author:** ![MuhammadAli.Dev](https://www.dolibarr.org/forum/letter_avatar_proxy/v4/letter/m/3d9bf3/32.png) [@MuhammadAli.Dev](https://www.dolibarr.org/forum/u/MuhammadAli.Dev)\ **Post date:** [October 28, 2026, 5:39pm UTC](https://www.dolibarr.org/forum/t/php-updates-in-less-than-2-hours-upcoming-critical-php-security-release/31421/11 "2026-10-28T17:39:36Z")
@lojiego That error usually means the session is being lost between page load and login, so I’d compare the PHP 8.4 setup against 8.3 rather than blame Dolibarr first. Since you’re on a new PHP version, check that its php.ini has session.save\_path pointing to a writable folder and that the cookie settings (session.cookie\_secure and session.cookie\_samesite) match your 8.3 file, because a fresh php.ini often resets those. The PHP error log from a failed login attempt would also tell us a lot. Is this a WAMP or Doliwamp install, or Linux with php-fpm? — Ali — Dolibarr AI Consultant > **[ERP Intelligence for SMEs | SiliconBlaze](https://www.siliconblaze.com/)** > > Read-only AI assistants for Dolibarr, inventory and financial intelligence modules, and citation-grounded document AI. Cloud or fully on-premise.