wo critical PHP 8.2 vulnerabilities were disclosed this month, and the fix is now available for Debian 12. If you run VitalPBX, your system runs on Debian 12, so this update applies to you.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, may allow unauthenticated remote code execution under certain conditions. In plain terms: an attacker who never logged in could run code on your PBX. Debian has shipped the patched release, PHP 8.2.35.
This post covers what’s affected, the exact commands to update your VitalPBX server, and how to confirm the patch took. The whole process takes a few minutes per server.
What the PHP 8.2 Vulnerabilities Affect on Debian 12
The two CVEs affect PHP 8.2, the PHP branch that ships with Debian 12. VitalPBX installs only on Debian 12 64-bit, so every VitalPBX server should be checked.
Item | Detail |
|---|---|
CVE IDs | CVE-2026-109618, CVE-2026-109619 |
Affected | PHP 8.2 |
Risk | Unauthenticated remote code execution under certain conditions |
Patched version | PHP 8.2.35 |
Advisory |
A PBX is a high-value target. It handles your calls, extensions, trunks, and often billing-sensitive routes. Treat this patch as urgent, not routine maintenance.
How to Patch PHP 8.2 on Your VitalPBX Server
Log in to your VitalPBX server over SSH as root or a sudo user. Then run these two commands:
sudo apt update
dpkg -l | awk '$1 == "ii" && $2 ~ /^php8[.]2/ {print $2}' | xargs -r sudo apt install -y --only-upgrade --no-remove
Here’s what each part does:
sudo apt updaterefreshes the package lists so your server sees PHP 8.2.35.dpkg -l | awk …lists only the PHP 8.2 packages already installed on the system.xargs -r sudo apt install -y --only-upgrade --no-removeupgrades exactly those packages, without installing new ones or removing existing ones.
This targeted approach updates PHP without pulling in unrelated upgrades. If you manage several servers, repeat the steps on each one.
Verify the PHP 8.2.35 Patch
After the update finishes, check the installed version:
root@vpbx:~# php -v
PHP 8.2.35 (cli) (built: Oct 21 2026 06:29:51) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.2.35, Copyright (c) Zend Technologies
with the ionCube PHP Loader v14.4.0, Copyright (c) 2002-2025, by ionCube Ltd.
with Zend OPcache v8.2.35, Copyright (c), by Zend Technologies
The first line must report PHP 8.2.35 or newer. If it still shows an older 8.2 release, run the two update commands again and check that apt update completed without errors.
Frequently Asked Questions
What are CVE-2026-109618 and CVE-2026-109619?
They are two critical vulnerabilities in PHP 8.2. Under certain conditions, they may allow an unauthenticated attacker to execute code remotely on the affected server. Debian 12 has released PHP 8.2.35 to fix both issues. Details are in the CERT-EU security advisory 2026-018.
Is my VitalPBX system affected by the PHP 8.2 vulnerability?
VitalPBX is installed on Debian 12 64-bit, which uses PHP 8.2. If your server runs a PHP 8.2 version older than 8.2.35, it is affected. Run php -v to check: anything below 8.2.35 needs the update.
How do I update PHP 8.2 on Debian 12 for VitalPBX?
Run sudo apt update, then run the targeted upgrade command that lists your installed PHP 8.2 packages and upgrades only those. The command uses --only-upgrade and --no-remove, so it does not add or remove other packages. The full command is in the steps above.
Will the update remove any packages or break my PBX configuration?
The command is built to update only the PHP 8.2 packages that are already installed. It does not remove existing packages. As with any server change, take a backup or snapshot first if your environment allows it.
How do I confirm the PHP patch was applied?
Run php -v on the server. The first line of the output should read PHP 8.2.35 or a newer version. If it shows an older release, repeat the update commands and check for errors in apt update.
Do I need to patch every VitalPBX server?
Yes. Every VitalPBX server running Debian 12 with PHP 8.2 should be updated. MSPs managing multiple servers or tenants should patch each physical or virtual server separately.
Patch Today
These vulnerabilities have significant security implications, so apply the update on every VitalPBX system running Debian 12 as soon as possible. It takes two commands and a quick version check.
Evaluating VitalPBX for your business or clients? Book a live demo (US Eastern Time) or book in Central European Time.
