{"id":3026,"date":"2026-10-24T08:00:32","date_gmt":"2026-10-24T14:00:32","guid":{"rendered":"https:\/\/pippintech.com\/?p=3026"},"modified":"2026-11-09T09:30:42","modified_gmt":"2026-11-09T15:30:42","slug":"freepbx-php-security-note","status":"publish","type":"post","link":"https:\/\/pippintech.com\/index.php\/2026\/10\/24\/freepbx-php-security-note\/","title":{"rendered":"FreePBX &#8211; PHP Security Note"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"3026\" class=\"elementor elementor-3026\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d713527 e-flex e-con-boxed e-con e-parent\" data-id=\"d713527\" data-element_type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-faa8cc8 elementor-widget elementor-widget-text-editor\" data-id=\"faa8cc8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A note from the Sangoma Development Team<\/p><p>&#8212;&#8212;&#8212;-<\/p><p>On October 21, 2026, the PHP development team disclosed <strong>two critical security vulnerabilities<\/strong> (CVE-2026-109618 and CVE-2026-109619) that could allow <strong>unauthorized remote code execution on affected systems<\/strong>. These vulnerabilities affect PHP, a third-party technology used in the underlying infrastructure of FreePBX and PBXact.<\/p><p>We know unexpected security updates and migrations can be disruptive, and we\u2019re here to help you navigate the next steps. <img decoding=\"async\" class=\"emoji\" title=\":person_tipping_hand:\" src=\"https:\/\/community.freepbx.org\/images\/emoji\/twitter\/person_tipping_hand.png?v=15\" alt=\":person_tipping_hand:\" width=\"20\" height=\"20\" \/><\/p><h1><a class=\"anchor\" href=\"https:\/\/community.freepbx.org\/t\/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact\/110423#p-472502-police_car_light-immediate-action-recommended-1\" name=\"p-472502-police_car_light-immediate-action-recommended-1\" aria-label=\"Heading link\"><\/a><img decoding=\"async\" class=\"emoji\" title=\":police_car_light:\" src=\"https:\/\/community.freepbx.org\/images\/emoji\/twitter\/police_car_light.png?v=15\" alt=\":police_car_light:\" width=\"20\" height=\"20\" \/> Immediate Action Recommended:<\/h1><ul><li><strong>FreePBX 17 \/ PBXact 17:<\/strong> Apply the latest PHP security updates by following the standard system software update procedures outlined in our <a href=\"https:\/\/sangomakb.atlassian.net\/wiki\/spaces\/FP\/pages\/2121924609\/FreePBX+Open+Source+-+Update+system+software+on+FreePBX+17\" data-clicks=\"122\" aria-label=\"documentation link clicked 122 times\">documentation<\/a>. Verify that the updated packages have been installed.<\/li><li><strong>FreePBX 16 \/ PBXact 16 and earlier:<\/strong> We strongly recommend planning your migration to version 17 as soon as possible. As a temporary measure, we are offering a <a href=\"https:\/\/community.freepbx.org\/t\/php-cve-patching\/110401\/41\" data-clicks=\"181\" aria-label=\"patched PHP 7.4 link clicked 181 times\">patched PHP 7.4<\/a> for testing in FreePBX\/PBXact 16, while evaluating additional measures to reduce exposure for customers who cannot migrate immediately.<\/li><\/ul><h2><a class=\"anchor\" href=\"https:\/\/community.freepbx.org\/t\/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact\/110423#p-472502-important-plan-your-migration-to-version-17-2\" name=\"p-472502-important-plan-your-migration-to-version-17-2\" aria-label=\"Heading link\"><\/a>Important: Plan your migration to Version 17<\/h2><p>Migrating to version 17 requires some planning, as it is not an in-place upgrade. It requires a fresh installation and migration of your existing configurations using the Backup and Restore module. Ensure your new installation has received the latest security updates before placing it into production.<\/p><h3><a class=\"anchor\" href=\"https:\/\/community.freepbx.org\/t\/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact\/110423#p-472502-protect-your-system-in-the-meantime-3\" name=\"p-472502-protect-your-system-in-the-meantime-3\" aria-label=\"Heading link\"><\/a>Protect your system in the meantime<\/h3><p>Until your system is updated or migrated, restrict access to the web management interface to trusted networks. These measures help reduce exposure but do not eliminate the risk.<\/p><h3><a class=\"anchor\" href=\"https:\/\/community.freepbx.org\/t\/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact\/110423#p-472502-further-assistance-4\" name=\"p-472502-further-assistance-4\" aria-label=\"Heading link\"><\/a>Further Assistance<\/h3><p>If you\u2019re running version 16, but unable to: migrate to version 17, test the patched PHP 7.4, or restrict access to your systems; Sangoma and its partners may be able to help you explore additional security options for your legacy system. <a href=\"https:\/\/www.freepbx.org\/contact\/\" data-clicks=\"1\" aria-label=\"Contact Sangoma Sales link clicked 1 time\">Contact Sangoma Sales<\/a> to discuss your options.<\/p><h2><a class=\"anchor\" href=\"https:\/\/community.freepbx.org\/t\/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact\/110423#p-472502-additional-resources-5\" name=\"p-472502-additional-resources-5\" aria-label=\"Heading link\"><\/a>Additional Resources<\/h2><ul><li><a href=\"https:\/\/access.redhat.com\/security\/cve\/cve-2026-109618\" data-clicks=\"12\" aria-label=\"Security Vulnerability CVE-2026-109618 link clicked 12 times\">Security Vulnerability CVE-2026-109618<\/a><\/li><li><a href=\"https:\/\/access.redhat.com\/security\/cve\/cve-2026-109619\" data-clicks=\"5\" aria-label=\"Security Vulnerability CVE-2026-109619 link clicked 5 times\">Security Vulnerability CVE-2026-109619<\/a><\/li><li><a href=\"https:\/\/community.freepbx.org\/t\/php-cve-patching\/110401\/41\" data-clicks=\"181\" aria-label=\"FreePBX 16 test patch for PHP 7.4 link clicked 181 times\">FreePBX 16 test patch for PHP 7.4<\/a><\/li><li><a href=\"https:\/\/sangomakb.atlassian.net\/wiki\/spaces\/FP\/pages\/279052296\/FreePBX+Open+Source+-+Version+17+FAQ\" data-clicks=\"28\" aria-label=\"FreePBX 17 System Update Information link clicked 28 times\">FreePBX 17 System Update Information<\/a><\/li><li><a href=\"https:\/\/www.freepbx.org\/freepbx17\/\" data-clicks=\"5\" aria-label=\"FreePBX 17 Migration Information and LEAN Service link clicked 5 times\">FreePBX 17 Migration Information and LEAN Service<\/a><\/li><\/ul><p>We recognize that this may create additional work for our customers and partners, and we appreciate your efforts to keep your systems secure. Our team continues to work on practical solutions and is here to help you navigate the next steps.<\/p><p><em>Sangoma Open Source Team<\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>A note from the Sangoma Development Team &#8212;&#8212;&#8212;- On October 21, 2026, the PHP development team disclosed two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow unauthorized remote code execution on affected systems. These vulnerabilities affect PHP, a third-party technology used in the underlying infrastructure of FreePBX and PBXact. We know unexpected security updates [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30],"tags":[],"_links":{"self":[{"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/posts\/3026"}],"collection":[{"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/comments?post=3026"}],"version-history":[{"count":4,"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/posts\/3026\/revisions"}],"predecessor-version":[{"id":3032,"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/posts\/3026\/revisions\/3032"}],"wp:attachment":[{"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/media?parent=3026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/categories?post=3026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pippintech.com\/index.php\/wp-json\/wp\/v2\/tags?post=3026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}