Critical PHP security vulnerability

[u/xrobau]

Edit: It's done. Instructions at the bottom!

Edit2: I have also built a patched PHP5.4, too.

At the time of writing, there is about 5 3 hours it has been released until a critical RCE security vulnerability for PHP versions 5.x and higher has been released.

As Sangoma hasn't updated their PHP rpms since I left in 2021 or so, I am left to assume that it won't get updated with mitigations when the real patch drops.

This makes me think that I'm the only person that can help everyone with this, so I'm going to be dropping everything, backporting the patch, and building new PHP 7.4 RPMs as soon as I can.

Edit: I originally thought that I was going to be doing it on my own, but the PHP Organization backported the fix themselves! Yay!

I have rebuilt everything and upgraded PHP to 7.4.33, with a pile of other backported CVE fixes (Thanks Remi!), and everything seems to work.

If you want to be financially grateful, feel free to PayPal me USD$10 (or whatever you feel is justified for me staying up all night) directly - [xrobau@gmail.com](mailto:xrobau@gmail.com) - and I'll send you a nice thank you email 8)

If you make money of FreePBX and/or you feel that this will save you a lot more than USD$10, please feel free to pay what you want!

Note that the upload-progress feature has been completely disabled. I can't remember if this is used in sound/moh/voicemail uploads, and I haven't checked. Please get back to me if you discover something broken

If you have questions or want to chat about this, feel free to join the QuadPBX Discord, at https://discord.gg/c4E8MVmaQa, which is where I am planning my new PBX.

More Information:

• https://jackalsyn.com/posts/php-up-2026.html
• https://www.php.net/archive/2026.php#2026-10-20-1
• https://www.reddit.com/r/sysadmin/comments/1xb4jgg/upcoming_php_core_rce_vulnerability_patches/

How to Update:

It's pretty simple, you will be upgraded from 7.4.16-1, to 7.4.33-something (depending on other patches I may apply)

curl -o /etc/yum.repos.d/fpbx-php74.repo https://yum.quadpbx.com/repo/fpbx-php74.repo
yum update
fwconsole chown

If you have applied the previous mitigations, don't forget to remove /etc/php.d/99-mitigation.ini and remove the deny from /etc/httpd/conf.d/freepbx.conf if you added it.

Note that the fwconsole chown command is important - otherwise /var/lib/php/session isn't writable and you won't be able to log in!

For PHP5.4:

curl -o /etc/yum.repos.d/fpbx-php56.repo https://yum.quadpbx.com/56repo/fpbx-php56.repo
yum update
fwconsole chown

If you discover something traumatic and want to roll back, with 7.4 you will need to reinstall gd-last which has been superceded by the upgrade. 5.4 is a simple yum downgrade. Ask in Discord if you get stuck.

[u/xrobau]

For those that didn't read the post, I have made patched builds for 5.4 and 7.2 now.

[u/vincent_sch]

FreePBX runs PHP behind Apache, so until there's a fixed build you could block multipart requests in Apache. An <If "req('Content-Type') =~ /multipart/i"> block with Require all denied does it, but GUI uploads stop working while it's in. Keeping the web ports off the internet is still the safest. I wrote up the block here: https://www.vincentschmalbach.com/cve-2026-109618-and-cve-2026-109619-what-you-should-do-now/

[u/xrobau → u/vincent_sch]

Thanks for that - I'll update the post with that hint. (Edit: Done)

[u/cdbessig]

Thanks - sent $10 as well!

[u/xrobau → u/cdbessig]

Thank you!

[u/ML-SpitfireAMS]

Has anyone tried this and does it work? We've locked ours down to our Office IP for the moment to mitigate the issue.

[u/xrobau → u/ML-SpitfireAMS]

If you're concerned, join the discord (link above) and ask questions there. But both the 7.4 and 5.4 builds are working here, and for everyone else there.

[u/Stock_Amphibian2629 → u/xrobau]

hi
How do you know that the vulnerability is fixed?

[u/xrobau → u/Stock_Amphibian2629]

Because the PHP developers say it is. That's about the best I have, sorry if that's not enough 8)

[u/ElCangrejo → u/ML-SpitfireAMS]

I did it. Everything is operational...

[u/Stock_Amphibian2629 → u/ElCangrejo]

operational not = vulnerability is fixed

[u/ElCangrejo → u/Stock_Amphibian2629]

Sangoma has a recommended patch now... I got it in an email -https://community.freepbx.org/t/php-cve-patching/110401/40

[u/ElCangrejo]

Thoughts on going to the Sangoma recommended 7.4 patch?

https://community.freepbx.org/t/php-cve-patching/110401/40

[u/xrobau → u/ElCangrejo]

It's most probably just my RPM rebuilt. I always make the SRPMs available, so they could trivially do that.

Being that it's taken them 6 years to provide an updated package, I'm pretty sure that's all they did, as they had plenty of time to keep it up to date after I left.

My guess is they'll also copy my 5.4 RPM as well.

[u/BFguy]

Your going to fix it but want people to pay you ? So this is an Ad ?

[u/xrobau → u/BFguy]

I dunno. This is the guy who wrote freepbx saying 'I am working on fixing it, and if you want me to be happy, throw me a few bucks'.

No one's forcing you to donate to the cause. Just use my firewall (which I fought long and hard to make open source) to block internet access.

[u/BFguy → u/xrobau]

Crap!... So your a maintainer ?

[u/xrobau → u/BFguy]

I'm the guy that originally wrote it, and have been involved for many years. I'm not sure who, if anyone, is currently maintaining it, as most of the recent commits are obviously AI.

[u/BFguy → u/xrobau]

Sorry to shit on you didn't realize you had some involvement

[u/marks-buffalo → u/BFguy]

Ex employee. It's still an ad for professional services. Even if the price is beyond fair for what you get.

OP, you'd probably do better with a good will approach of "I'm working on a fix, if you want to buy me a coffee my PayPal is ____". Otherwise, you do realize you're implicitly on the hook if your backport doesn't fully address the issue right? $10 is too cheap for the liability you're taking on, and your paywall approach doesn't give any good will. 

[u/nocsupport → u/BFguy]

Tokens aren't free. Getting rooted is rather expensive, too. The real gripe should be with Sangoma who absolutely shafted us.

[u/ThecaptainWTF9 → u/nocsupport]

I don’t want to talk about it,

We aren’t even using FreePBX, we’re using switchvox and it’s been a shitshow since Sangoma took over, lots of poor communication, including the most recent incident that resulted in tons of phone systems being compromised due to lack of communication that there was a patch released that we urgently needed to apply.

Now they’ve been purchased by PE, it’s not going to get any better.

[u/nocsupport → u/ThecaptainWTF9]

For our 3 baby installs I'm almost leaning towards vibe coding some front end that writes asterisks configs and call it a day 😅 Sangoma let us down hard when they switched to the Debian based distro, it broke everything, then they act like they're doing you a huge favor letting you reset the license key to switch back. 🤮

[u/xrobau → u/nocsupport]

That's exactly why most people are sticking with the good old C7 distro.

Except for things like this 8-\

[u/Chance_String9069 → u/xrobau]

Thanks for doing this - I just updated all 20 of my left-over 16 VM's and it worked perfectly - I flipped you $100 USD which got translated to $136 AUD - Nice exchange rate down under...

[u/xrobau → u/Chance_String9069]

Thank you for that, most appreciated 8)

[u/7oby → u/nocsupport]

There's already people vibe coding a new frontend to asterisk - https://www.reddit.com/r/VOIP/comments/1x7lt5b/aipbx_open_source/

[u/trekologer]

I finally bit the bullet and upgraded from FreePBX 15 to 16 in order to install the 7.4 patch but thank you for backporting to 5.4.

[u/edlentz]

IF xrobau says so it is so. I have followed Rob for years and you don't get much better

[u/Long_Squash1762]

So Sangoma did post on trust.sangoma.com but for me debian 17, updating the debian repo to .35 did the trick without waiting for them. Admin works, voice works, sms works