Hi there,
On October 21, 2026, the PHP development team disclosed two critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could allow unauthorized remote code execution on affected systems. These vulnerabilities affect PHP, a third-party technology used in the underlying infrastructure of FreePBX and PBXact.
We know unexpected security updates and migrations can be disruptive, and we're here to help you navigate the next steps.
Immediate action recommended:
FreePBX 17 / PBXact 17: Apply the latest PHP security updates by following the standard system software update procedures outlined in our documentation. Verify that the updated packages have been installed.
FreePBX 16 / PBXact 16 and earlier: We strongly recommend planning your migration to version 17 as soon as possible. As a temporary measure, we're offering a patched PHP 7.4 for testing in FreePBX/PBXact 16, while evaluating additional ways to reduce exposure for customers who cannot migrate immediately.
Important: Plan your migration to version 17
Migrating to version 17 requires a fresh installation rather than an in-place upgrade. Transfer your existing configurations using the Backup and Restore module, and ensure your new installation has received the latest security updates before placing it into production.
Protect your system in the meantime
Until your system is fully updated or migrated, restrict access to the web management interface to trusted networks. These measures help reduce exposure but do not eliminate the risk.
Further Assistance
If you're running version 16, but unable to: migrate to version 17, test the patched PHP 7.4, or restrict access to your system, Sangoma and its partners may be able to help you explore additional security options. Contact Sangoma Sales to discuss your options.
Нет, для freepbx16:
yum install sangoma-devel16
yum upgrade
reboot
