From liviu at opensips.org Mon Nov 2 14:11:41 2026 From: liviu at opensips.org (Liviu Chircu) Date: Mon, 2 Nov 2026 16:11:41 +0200 Subject: [OpenSIPS-Devel] PHP Security Vulnerabilities CVE-2026-109618 and CVE-2026-109619 In-Reply-To: References: Message-ID: Hi Bob, These vulnerabilities affect the PHP runtime.  Now, OpenSIPS is mostly a C application and does not use PHP in any of the current 193 modules on master branch.  So the SIP server is not directly affected by either CVE-2026-109618 or CVE-2026-109619. However, if you run OpenSIPS Control Panel, please update the PHP packages serving it according to your distribution’s security advisories, then restart the relevant PHP/web server processes. The upstream fixes were released on 21 October in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution packages may include backported fixes under older version numbers. See the official PHP advisory, here . Best regards, Liviu Chircu www.opensips-solutions.com |www.siphub.com On 28/10/2026 15:33, Bob Falls via Devel wrote: > > Hi Support. > > Please can you advise on your position of the php2shell > vulnerabilities for following security bulletin. > > Kind Regards > > Bob > > *Bob.Falls | Senior Network Engineer | Operations | JT (GBRJT 23450) * > > *DDI: +44 1534 882853  | Mobile +447797726878 | emal > Bob.Falls at jtglobal.com* > > JT, PO Box 53, No 1 The Forum, Grenville Street, St Helier, Jersey, > JE4 8PB > JT, 24 High Street, St Peter Port, Guernsey, GY1 2JU, Registered > Company no. 39971_ > _www.jtglobal.com *View*our JT Facebook > Page *Follow JT*on Twitter > > > This email is confidential and may also be privileged. If you are not > the intended recipient please delete it and notify us immediately by > telephoning or e-mailing the sender. You should not copy it or use it > for any purpose nor disclose its contents to any other person. > Information on the licensed/regulated subsidiaries of JT may be found > on our website: www.jtglobal.com > > _______________________________________________ > Devel mailing list > Devel at lists.opensips.org > http://lists.opensips.org/cgi-bin/mailman/listinfo/devel -------------- next part -------------- An HTML attachment was scrubbed... URL: From liviu at opensips.org Mon Nov 2 16:12:08 2026 From: liviu at opensips.org (Liviu Chircu) Date: Mon, 2 Nov 2026 18:12:08 +0200 Subject: [OpenSIPS-Devel] PHP Security Vulnerabilities CVE-2026-109618 and CVE-2026-109619 In-Reply-To: References: Message-ID: <9709934d-90b5-4955-9d04-604adf7eb8e8@opensips.org> Hi Bob, These vulnerabilities affect the PHP runtime.  Now, OpenSIPS is mostly a C application and does not use PHP in any of the current 193 modules on master branch.  So the SIP server is not directly affected by either CVE-2026-109618 or CVE-2026-109619. However, if you run OpenSIPS Control Panel, please update the PHP packages serving it according to your distribution’s security advisories, then restart the relevant PHP/web server processes. The upstream fixes were released on 21 October in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution packages may include backported fixes under older version numbers. See the official PHP advisory, here . Best regards, Liviu Chircu www.opensips-solutions.com |www.siphub.com On 28/10/2026 15:33, Bob Falls via Devel wrote: > > Hi Support. > > Please can you advise on your position of the php2shell > vulnerabilities for following security bulletin. > > Kind Regards > > Bob > > *Bob.Falls | Senior Network Engineer | Operations | JT (GBRJT 23450) * > > *DDI: +44 1534 882853  | Mobile +447797726878 | emal > Bob.Falls at jtglobal.com* > > JT, PO Box 53, No 1 The Forum, Grenville Street, St Helier, Jersey, > JE4 8PB > JT, 24 High Street, St Peter Port, Guernsey, GY1 2JU, Registered > Company no. 39971_ > _www.jtglobal.com *View*our JT Facebook > Page *Follow JT*on Twitter > > > This email is confidential and may also be privileged. If you are not > the intended recipient please delete it and notify us immediately by > telephoning or e-mailing the sender. You should not copy it or use it > for any purpose nor disclose its contents to any other person. > Information on the licensed/regulated subsidiaries of JT may be found > on our website: www.jtglobal.com > > _______________________________________________ > Devel mailing list > Devel at lists.opensips.org > http://lists.opensips.org/cgi-bin/mailman/listinfo/devel -------------- next part -------------- An HTML attachment was scrubbed... URL: