PHP2Shell and VICIdial: what it is, and how we patched every server

On 21 October 2026 the PHP project shipped emergency fixes for two critical bugs, CVE-2026-109618 and CVE-2026-109619, now widely called PHP2Shell. If you run VICIdial, this one is about you: the agent screen and the admin pages are PHP, served by Apache. If your server is hosted with VICIfast, it's already done. We updated every managed server on 22 October, and there's nothing you need to do.

What PHP2Shell is

• Both bugs let an attacker run their own code on your server just by sending crafted web requests. No login is needed.
• They sit in PHP itself, not in VICIdial, so it doesn't matter how VICIdial is set up. Anything PHP serves is a way in.
• They are rated 9.2 out of 10, and researchers reported exploit attempts within hours of the announcement.
• Fixed upstream in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older PHP versions only get the fix through your Linux distribution or package maintainer.

Why VICIdial servers are exposed

Every VICIdial server runs a web server: agents log in through the browser, managers use the admin pages, and the Webphone connects over the same port. Most installs run PHP as an Apache module (mod_php), so every one of those requests passes through PHP. If your server's web port is open to the whole internet, treat it as at risk until it's patched.

What we did

• Checked every managed VICIdial server. All of them were running a PHP build without the fix.
• Confirmed the fixed package from its own changelog, then tested it on our demo server with 44 agents logged in and dialing: no errors, nobody logged out.
• Updated every server on 22 October, starting with the ones that accept web traffic from the widest range of addresses.
• Checked each one afterwards: the new PHP on disk, Apache and PHP restarted onto it, agents still connected.
• Changed our nightly maintenance so PHP security updates now install automatically during idle hours, like the rest of the system's security updates.

Your campaigns, leads, recordings and settings were not touched.

If you run VICIdial yourself

1. Check what you have: php -v, and on Ubuntu or Debian dpkg -l | grep php for the package versions.
2. Update PHP from wherever it came from. On Ubuntu 22.04 or 24.04 with Ubuntu's own PHP, install the update from USN-8948-1 (on 24.04 the fixed package is 8.3.6-0ubuntu0.24.04.13; the version number still says 8.3.6). If your PHP comes from the ondrej PPA, as many VICIdial installs do, run apt update and upgrade your PHP packages; for PHP 7.4 the fixed build is 7.4.33-31. ViciBox and other distributions: install your distribution's PHP security update as soon as it's out.
3. Restart Apache, and PHP-FPM if you run it, so the running processes load the new code. Until then the old code is still in memory.
4. Keep your web port closed to everyone except your agents and admins. Our guide to VICIdial firewall ports shows what to open and what to keep shut.

A firewall narrows who can reach PHP, but it isn't the fix. Update PHP either way.

Security updates are part of hosting

Patching like this, quickly, tested, and without taking a floor offline, is part of what a managed VICIdial server should include. It comes with every VICIfast plan, alongside the rest of our security hardening. See plans and pricing.