Hi Bob,
These vulnerabilities affect the PHP runtime. Now, OpenSIPS is mostly a
C application and does not use PHP in any of the current 193 modules on
master branch. So the SIP server is not directly affected by either
CVE-2026-109618 or CVE-2026-109619.
However, if you run OpenSIPS Control Panel, please update the PHP
packages serving it according to your distribution’s security
advisories, then restart the relevant PHP/web server processes.
The upstream fixes were released on 21 October in PHP 8.2.35, 8.3.36,
8.4.27 and 8.5.12. Distribution packages may include backported fixes
under older version numbers.
See the official PHP advisory, here
<https://www.php.net/archive/2026.php#2026-10-21-5>.
Best regards,
Liviu Chircu
www.opensips-solutions.com |www.siphub.com
On 28/10/2026 15:33, Bob Falls via Devel wrote:
Hi Support.
Please can you advise on your position of the php2shell
vulnerabilities for following security bulletin.
Kind Regards
Bob
*Bob.Falls | Senior Network Engineer | Operations | JT (GBRJT 23450) *
*DDI: +44 1534 882853 | Mobile +447797726878 | emal
[email protected]*
JT, PO Box 53, No 1 The Forum, Grenville Street, St Helier, Jersey,
JE4 8PB
JT, 24 High Street, St Peter Port, Guernsey, GY1 2JU, Registered
Company no. 39971_
_www.jtglobal.com <http://www.jtglobal.com/> *View*our JT Facebook
Page <http://www.facebook.com/jtsocial> *Follow JT*on Twitter
<http://www.twitter.com/jtsocial>
This email is confidential and may also be privileged. If you are not
the intended recipient please delete it and notify us immediately by
telephoning or e-mailing the sender. You should not copy it or use it
for any purpose nor disclose its contents to any other person.
Information on the licensed/regulated subsidiaries of JT may be found
on our website: www.jtglobal.com
_______________________________________________
Devel mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/devel
_______________________________________________
Devel mailing list
[email protected]
http://lists.opensips.org/cgi-bin/mailman/listinfo/devel
