Critical PHP Security Fix for ViciBox v.12.0 (php2shell)

On October 21, 2026 the PHP project released a security advisory for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Apache with mod_php, which is what ViciBox uses, is considered the highest risk since the attack can happen before any ViciDial code runs.

Every ViciBox v.12.0 server needs to be upgraded to PHP 8.2.35 or later. This applies to all v.12.0 releases, including v.12.0.2. In a cluster, upgrade every server that runs Apache, including archive servers.

The commands and instructions are in the ViciBox v.12.0 PHP remote code execution (php2shell) bug fix in the ViciBox v.12.0 manual.