A note from the Sangoma Development Team

———-

On October 21, 2026, the PHP development team disclosed two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow unauthorized remote code execution on affected systems. These vulnerabilities affect PHP, a third-party technology used in the underlying infrastructure of FreePBX and PBXact.

We know unexpected security updates and migrations can be disruptive, and we’re here to help you navigate the next steps.

Immediate Action Recommended:

• FreePBX 17 / PBXact 17: Apply the latest PHP security updates by following the standard system software update procedures outlined in our documentation. Verify that the updated packages have been installed.
• FreePBX 16 / PBXact 16 and earlier: We strongly recommend planning your migration to version 17 as soon as possible. As a temporary measure, we are offering a patched PHP 7.4 for testing in FreePBX/PBXact 16, while evaluating additional measures to reduce exposure for customers who cannot migrate immediately.

Important: Plan your migration to Version 17

Migrating to version 17 requires some planning, as it is not an in-place upgrade. It requires a fresh installation and migration of your existing configurations using the Backup and Restore module. Ensure your new installation has received the latest security updates before placing it into production.

Protect your system in the meantime

Until your system is updated or migrated, restrict access to the web management interface to trusted networks. These measures help reduce exposure but do not eliminate the risk.

Further Assistance

If you’re running version 16, but unable to: migrate to version 17, test the patched PHP 7.4, or restrict access to your systems; Sangoma and its partners may be able to help you explore additional security options for your legacy system. Contact Sangoma Sales to discuss your options.

Additional Resources

• Security Vulnerability CVE-2026-109618
• Security Vulnerability CVE-2026-109619
• FreePBX 16 test patch for PHP 7.4
• FreePBX 17 System Update Information
• FreePBX 17 Migration Information and LEAN Service

We recognize that this may create additional work for our customers and partners, and we appreciate your efforts to keep your systems secure. Our team continues to work on practical solutions and is here to help you navigate the next steps.

Sangoma Open Source Team