We are happy to announce that all FinDock app updates for addressing reported PHP vulnerability have been completed. A special thanks to our engineering team has worked quickly and diligently to respond to this unexpected situation. The additional measures, such as token refreshing and dyno cycling, are proceeding as planned. No actions are required by customers or partners.
Posted Oct 21, 2026 - 18:58 CEST
Update
Heroku has completed their update of the PHP vulnerability patch, so we are now preparing updates for FinDock apps. These will be pushed to sandbox and production orgs as soon as they are ready.
Posted Oct 21, 2026 - 17:42 CEST
In progress
Our planned hotfix was pushed to sandboxes, but has been cancelled for production orgs. The mitigation efforts of FinDock (and others) were determined to be insufficient. Based on our internal evaluation of the vulnerability, customer data is not at risk given FinDock’s existing encryption practices and other built-in security measures of Heroku. However, this PHP vulnerability can impact organizations in different ways. From the FinDock perspective, to close the potential attack path, you can disconnect ProcessingHub and WebHub. You can also minimize risk by ensuring your Integration User has the least privileged setup, as is best practice. The Heroku stack patching will be handled by Heroku. Once that is completed, we will promptly hotfix FinDock apps following our normal process for general maintenance updates. In addition, we are also taking the following steps to limit risk exposure before Heroku is patched: (1) wiping and refreshing all Salesforce authorization tokens, (2) cycling Heroku dynos, and (3) rotating certificate credentials.
Posted Oct 21, 2026 - 13:20 CEST
Scheduled
This hotfix updates all PHP instances used by FinDock to mitigate the risk of the high severity vulnerability in PHP made public on Oct. 20, 2026.
Posted Oct 21, 2026 - 13:16 CEST
This scheduled maintenance affected: File processing (ProcessingHub), Notifications from Payment Service Providers (WebHub), and Sandboxes.