Experimental PHP Security Fix for ViciBox v.11.0 (php2shell)

On October 21, 2026 the PHP project released a security advisory for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Apache with mod_php, which is what ViciBox uses, is considered the highest risk since the attack can happen before any ViciDial code runs.

ViciBox v.11.0 uses PHP 7.4 on OpenSuSE Leap 15.5. Both are end of life and the PHP project did not release a fixed PHP 7.4, so a PHP 7.4 package built from the PHP security team’s backported fix is provided in the ViciBox sandbox repository. This applies to all v.11.0 releases.

This fix is experimental. Parts of the OpenSuSE Leap 15.5 build infrastructure that ViciBox v.11.0 depends on are now gone, most notably the Asterisk 16 repository no longer exists. You can apply this fix, but our recommendation is to upgrade to ViciBox v.13.0.

The commands and instructions are in the ViciBox v.11.0 PHP remote code execution (php2shell) bug fix in the ViciBox v.11.0 manual.