PHP2Shell: the PHP vulnerabilities that should keep you up at night if your FreePBX is exposed

It’s been a busy week for those of us running servers with PHP (that is, pretty much everyone). On October 21, the PHP team released security updates fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, already nicknamed PHP2Shell. And the name is no accident: both have a CVSS v4 score of 9.2 and allow unauthenticated remote code execution.

In a nutshell: the first one is a memory corruption bug triggered when PHP runs out of memory halfway through setting up a request; the second is a use-after-free where a worker reuses data left “hanging around” from a previous request. It affects any PHP installation serving web requests (PHP-FPM, php-cgi, LiteSpeed…) and the most delicate case is Apache with mod_php, because the attack can succeed before a single line of the application has even run. Proofs of concept are already out there, so this is not something to leave for Monday.

The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. For 7.4, 8.0 and 8.1 there are minimal source patches and distribution packages. And for PHP 7.3 or older, including good old PHP 5? Nothing. There is no patch, and there won’t be one.

What does this have to do with Asterisk?

A lot more than it seems. Looking back, I’d dare say that 95% of the web interfaces used to manage Asterisk were built between 2005 and 2020, and practically all of them in PHP: FreePBX, trixbox, Elastix, Issabel, PBX in a Flash… plus a whole bunch of custom panels we all know (and that many of us have written ourselves, let’s be honest).

There were exceptions, of course. Asterisk-GUI was quite innovative back in the day: HTML and JavaScript with Ajax talking directly to Asterisk’s own HTTP server, with no PHP involved. But those were the few.

The problem is that many of those PBXs are still running years later with the same PHP version they were installed with. Abandoned distributions, unsupported CentOS, PHP 5.x or 7.x… and the web interface open to the Internet “so I can log in from home”. With PHP2Shell, that’s a formal invitation.

So what do we do?

Basically there are two paths, and ideally you should take both:

1. Block web access. A PBX admin interface has no business being open to the world. Firewall with an IP allowlist, VPN, or at the very least a properly configured FreePBX Responsive Firewall. If you can’t update today, this is the first thing you need to do today.
2. Update. Check which version you have with php -v. If your distribution has already released the patched package, update and restart Apache/PHP-FPM (without restarting the workers, the patch does nothing). If you’re on PHP 7.3 or older, there’s no shortcut: it’s time to migrate.

How to upgrade FreePBX

Here comes the less fun part: there is no direct upgrade from FreePBX 16 (or older) to FreePBX 17. FreePBX 17 runs on Debian 12 with PHP 8.2, so the procedure is, roughly:

1. Take a full backup with the Backup & Restore module on your current FreePBX.
2. Install a new server with Debian 12 and FreePBX 17 using the official script.
3. Restore the backup on the new server (from the command line if it’s large).
4. Review what has changed: FreePBX 17 ships with Asterisk 22, which no longer has chan_sip or the Macro application, so your SIP trunks will move to PJSIP and any custom dialplan using macros will need to be converted to GoSub.

Sangoma explains it step by step in its documentation: Upgrading to FreePBX 17 and How to Install FreePBX 17 on Debian 12. And if you want more detail on the vulnerabilities, the watchTowr FAQ and Rapid7’s analysis are very good.

I know migrating a production PBX is a pain, especially if it “has been working perfectly for ten years”. But that’s exactly the point: if it hasn’t been touched in ten years, it’s been piling up vulnerabilities for ten years. Better to spend an afternoon on it now than a week dealing with fraudulent traffic bills later.

Do you still have an old Elastix or FreePBX lurking around somewhere? Tell us in the comments or on our Telegram channel.