Does the Critical PHP Security Flaw Affect Odoo Websites?

This week a critical security flaw in PHP has knocked websites offline around the world while hosts rush out an emergency update, as reported by the BBC. PHP is the programming language behind a huge slice of the web: WordPress, WooCommerce, Magento, Joomla and plenty more besides.

So if your business runs on Odoo, the obvious question is whether you should be worried.

The short answer: Odoo itself isn't affected. Odoo is written in Python, not PHP, so there's no PHP in a standard Odoo website, shop or ERP for attackers to exploit. (Yes, the safe option is the one named after a snake. Software naming has never been about reassurance.)

The longer answer is where it gets interesting. Plenty of Australian businesses run Odoo alongside PHP systems: a WordPress marketing site, a WooCommerce store syncing orders, an integration script someone wrote in 2017 and nobody has looked at since. Those connections are where the risk lives. Below is what's affected, what isn't, and a checklist you can get through in about ten minutes.

Why Odoo itself isn't affected

A vulnerability lives inside a specific piece of software. If that software isn't in the building, it can't be the way in. Here's what each layer of a standard Odoo system actually runs on:

Your hosting choice doesn't change this. Odoo Online and Odoo.sh are run and patched by Odoo, and neither depends on PHP. A self-hosted (on-premise) Odoo server doesn't need PHP either, unless someone has installed other PHP applications on the same machine. More on that shortly.

There's a quieter lesson in here too. When your website runs on Odoo rather than as a separate WordPress site, you have one technology stack to secure instead of two. Fewer moving parts means fewer places for things to go wrong. We made the longer case for that in Addon websites: are they worth it?

Where Odoo businesses can still be exposed

Picture it this way. Your house has excellent locks. But you've left a spare key with the neighbour, and the neighbour's place has just been burgled. Your locks were never the problem. The key is.

Integrations work exactly like that. When a PHP website talks to Odoo, it usually holds an Odoo API key or user login so it can push in orders and pull out stock levels. If that PHP site is compromised, the attacker walks away with the key too, along with whatever access the connector's user has inside Odoo.

That last row deserves a second look. A vulnerable PHP app sitting on the same server as Odoo is a bit like a possum in the roof: it isn't in the living room yet, but it's camped right above the wiring. If you host Odoo yourself, know exactly what else shares the machine.

If you'd like a refresher on how Odoo connects to other systems in the first place, see API integrations with Odoo.

A 10-minute checklist for Odoo users

Work through these in order. If every answer comes back 'no', the PHP flaw doesn't touch your business systems and you can put the kettle on.

1. List every website and online tool connected to Odoo. Include your shop, blog, landing pages, booking tools and any integrations your IT provider set up. The forgotten ones matter most.
2. Find out which of them run on PHP. WordPress, WooCommerce, Magento, PrestaShop, Joomla and Drupal all do. If you're unsure, ask whoever hosts the site.
3. Confirm your host has applied the PHP update. Most managed hosts patch automatically, but shared and self-managed servers often don't. Ask for confirmation in writing.
4. Rotate any Odoo API keys or passwords stored on PHP systems. Generate new keys in Odoo, update the connector, then revoke the old ones. Do this even if you don't think you were breached. Changing the locks after the neighbour's break-in isn't paranoia; it's housekeeping.
5. Check the access rights of integration users in Odoo. A connector user should reach only the records it needs, never full administrator access. A courier integration has no business reading your payroll.
6. Review Odoo's login and activity history. Look for unfamiliar logins, new users, or bulk changes since the flaw was announced. If customer personal information may have been accessed, check your obligations under the Notifiable Data Breaches scheme run by the OAIC.
7. Check what else runs on your Odoo server. If you host Odoo yourself, make sure no PHP applications share the machine, or that any that do are patched.

Odoo still needs its own security updates

Dodging this particular flaw doesn't make any system bulletproof. Odoo releases its own security fixes, and how they reach you depends on where you're hosted.

Not sure which hosting model suits you? We compare them in Cloud or on-premise: what's right for your business?

Whatever your hosting, two habits keep the risk low:

• Stay on a supported Odoo version. Odoo supports its three most recent major versions, and older ones stop receiving security fixes. If you're further behind than that, it's time to plan an upgrade.
• Keep custom modules and third-party apps maintained. Code outside Odoo's core is only as secure as whoever wrote it, so review it at every upgrade rather than assuming it aged well. Code, unlike wine, rarely improves in the cellar.

For the platform side of the story, see how Odoo achieved ISO 27001 certification.

Not sure what's connected to your Odoo?

We can check for you. As an Odoo Gold Partner and Best Odoo Partner 2026, WMSSoft reviews your Odoo setup and every system connected to it, then tells you plainly whether anything is exposed and what to fix.

We'll check your integrations and any PHP sites holding Odoo credentials, rotate those API keys if needed, tighten your integration users' access rights, and confirm your Odoo version still receives security fixes.