diff --git a/src/content/posts/vicibox-12-0-php2shell-fix.md b/src/content/posts/vicibox-12-0-php2shell-fix.md
new file mode 100644
index 0000000..7012442
--- /dev/null
+++ b/src/content/posts/vicibox-12-0-php2shell-fix.md
@@ -0,0 +1,12 @@
+---
+title: "Critical PHP Security Fix for ViciBox v.12.0 (php2shell)"
+slug: "vicibox-12-0-php2shell-fix"
+date: "2026-10-21T12:00:00.000Z"
+excerpt: "Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Every ViciBox v.12.0 server needs to be upgraded to PHP 8.2.35 or later."
+---
+
+On October 21, 2026 the PHP project released a [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Apache with mod_php, which is what ViciBox uses, is considered the highest risk since the attack can happen before any ViciDial code runs.
+
+**Every ViciBox v.12.0 server needs to be upgraded to PHP 8.2.35 or later.** This applies to all v.12.0 releases, including v.12.0.2. In a cluster, upgrade every server that runs Apache, including archive servers.
+
+The commands and instructions are in the [ViciBox v.12.0 PHP remote code execution (php2shell)](https://docs.vicibox.com/en/12.0/bugfix/bugfix120-2.html) bug fix in the ViciBox v.12.0 manual.