ViciDial/ViciBoxWebsite
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

php2shell security notice

Browse Source
This commit is contained in:
jamesp committed 2026-10-21 19:22:13 -04:00
1 parent 66a15a4a0d
commit 4d32593834
1 file changed
+12
Download Patch File Download Diff File Expand all files Collapse all files
src/content/posts/vicibox-12-0-php2shell-fix.md
+12
View File
@@ -0,0 +1,12 @@
---
title: "Critical PHP Security Fix for ViciBox v.12.0 (php2shell)"
slug: "vicibox-12-0-php2shell-fix"
date: "2026-10-21T12:00:00.000Z"
excerpt: "Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution. Every ViciBox v.12.0 server needs to be upgraded to PHP 8.2.35 or later."
---
On October 21, 2026 the PHP project released a [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Apache with mod_php, which is what ViciBox uses, is considered the highest risk since the attack can happen before any ViciDial code runs.
**Every ViciBox v.12.0 server needs to be upgraded to PHP 8.2.35 or later.** This applies to all v.12.0 releases, including v.12.0.2. In a cluster, upgrade every server that runs Apache, including archive servers.
The commands and instructions are in the [ViciBox v.12.0 PHP remote code execution (php2shell)](https://docs.vicibox.com/en/12.0/bugfix/bugfix120-2.html) bug fix in the ViciBox v.12.0 manual.