ViciBox 13 beta php2shell fixes

src/content/posts/vicibox-13-0-0-beta4.md

@@ -0,0 +1,33 @@
+---
+title: "ViciBox v.13.0.0 Beta 4 Release Candidate"
+slug: "vicibox-13-0-0-beta4"
+date: "2026-10-23T12:00:00.000Z"
+excerpt: "ViciBox v.13.0.0 Beta 4 is the new release candidate for v.13.0.0, planned to become the official release on October 31, 2026. It ships PHP 8.4.27 with the fix for the critical php2shell vulnerabilities."
+---
+
+The fourth beta of ViciBox v.13.0.0 is available for testing and replaces Beta 3 as the release candidate:
+
+- [Standard install ISO](https://download.vicidial.com/iso/vicibox/server/ViciBox_V13.x86_64-13.0.0-beta4.iso)
+- [MD Software RAID1 install ISO](https://download.vicidial.com/iso/vicibox/server/ViciBox_V13.x86_64-13.0.0-md-beta4.iso)
+
+MD5 checksums are listed on the [ViciBox Server page](/server), and earlier betas are in the [download archive](https://download.vicidial.com/iso/vicibox/server/archive/).
+
+**Beta 4 is the release candidate for ViciBox v.13.0.0.** Unless testing turns up a major architectural issue that requires fixing the underlying image, it will become the official ViciBox v.13.0.0 release on October 31, 2026. Until then, the current stable release is [ViciBox v.12.0.2](/server).
+
+## PHP 8.4.27 security update
+
+Beta 4 installs PHP 8.4.27 from the openSUSE PHP 8.4 repository, which fixes the critical [php2shell vulnerabilities](https://www.php.net/archive/2026.php#2026-10-21-5) (CVE-2026-109618 and CVE-2026-109619). openSUSE Leap 16.0 itself still ships PHP 8.4.26, so the PHP 8.4 repository is included in the image to keep PHP updated.
+
+Servers installed from Beta 3 or earlier are vulnerable. Run the following as root to add the PHP 8.4 repository, switch PHP over to it, and restart apache:
+
+```bash
+zypper ar https://download.opensuse.org/repositories/devel:/languages:/php:/php84/16.0/devel:languages:php:php84.repo
+zypper mr -f devel_languages_php_php84
+zypper --gpg-auto-import-keys ref
+zypper dup --from devel_languages_php_php84 --allow-vendor-change
+systemctl restart apache2
+```
+
+Afterwards `php -v` should show **PHP 8.4.27** or newer. In a cluster, do this on every server that has apache running, including archive servers. Future PHP updates then come through a normal `zypper up`.
+
+Please report problems and feedback on the [VICIdial forum](https://www.vicidial.org/VICIDIALforum/), including whether you used the standard or MD ISO.

src/data/release.json

@@ -42,23 +42,23 @@
     ]
   },
   "beta": {
-    "version": "13.0.0-beta3",
-    "date": "2026-10-16",
-    "post": "/blog/vicibox-13-0-0-beta3",
+    "version": "13.0.0-beta4",
+    "date": "2026-10-23",
+    "post": "/blog/vicibox-13-0-0-beta4",
     "releaseCandidate": true,
     "plannedRelease": "2026-10-31",
     "isos": [
       {
         "label": "Standard install",
-        "file": "ViciBox_V13.x86_64-13.0.0-beta3.iso",
-        "md5": "6852d495ae3d7a3e20cb2f752b9d15b8",
-        "size": 2702567424
+        "file": "ViciBox_V13.x86_64-13.0.0-beta4.iso",
+        "md5": "b4fcb7e185e6b05f8f0159980bd686be",
+        "size": 2672447488
       },
       {
         "label": "MD Software RAID1 install",
-        "file": "ViciBox_V13.x86_64-13.0.0-md-beta3.iso",
-        "md5": "b2e400dd4ba2d51ba99d616b44058578",
-        "size": 2702911488
+        "file": "ViciBox_V13.x86_64-13.0.0-md-beta4.iso",
+        "md5": "bfc028a1e39b502cbcc6bf874fa0aabc",
+        "size": 2673444864
       }
     ]
   }