[OpenSIPS-Devel] PHP Security Vulnerabilities CVE-2026-109618 and CVE-2026-109619

[Liviu Chircu]

Hi Bob,

These vulnerabilities affect the PHP runtime.  Now, OpenSIPS is mostly a 
C application and does not use PHP in any of the current 193 modules on 
master branch.  So the SIP server is not directly affected by either 
CVE-2026-109618 or CVE-2026-109619.

However, if you run OpenSIPS Control Panel, please update the PHP 
packages serving it according to your distribution’s security 
advisories, then restart the relevant PHP/web server processes.

The upstream fixes were released on 21 October in PHP 8.2.35, 8.3.36, 
8.4.27 and 8.5.12. Distribution packages may include backported fixes 
under older version numbers.

See the official PHP advisory, here 
<https://www.php.net/archive/2026.php#2026-10-21-5>.

Best regards,

Liviu Chircu
www.opensips-solutions.com |www.siphub.com

On 28/10/2026 15:33, Bob Falls via Devel wrote:
>
> Hi Support.
>
> Please can you advise on your position of the php2shell 
> vulnerabilities for following security bulletin.
>
> Kind Regards
>
> Bob
>
> *Bob.Falls | Senior Network Engineer | Operations | JT (GBRJT 23450) *
>
> *DDI: +44 1534 882853  | Mobile +447797726878 | emal 
> Bob.Falls at jtglobal.com*
>
> JT, PO Box 53, No 1 The Forum, Grenville Street, St Helier, Jersey, 
> JE4 8PB
> JT, 24 High Street, St Peter Port, Guernsey, GY1 2JU, Registered 
> Company no. 39971_
> _www.jtglobal.com <http://www.jtglobal.com/> *View*our JT Facebook 
> Page <http://www.facebook.com/jtsocial> *Follow JT*on Twitter 
> <http://www.twitter.com/jtsocial>
>
> This email is confidential and may also be privileged. If you are not 
> the intended recipient please delete it and notify us immediately by 
> telephoning or e-mailing the sender. You should not copy it or use it 
> for any purpose nor disclose its contents to any other person. 
> Information on the licensed/regulated subsidiaries of JT may be found 
> on our website: www.jtglobal.com
>
> _______________________________________________
> Devel mailing list
> Devel at lists.opensips.org
> http://lists.opensips.org/cgi-bin/mailman/listinfo/devel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.opensips.org/pipermail/devel/attachments/20261102/f74801cc/attachment.html>