ViciBox v.13.0.0 Beta 4 Release Candidate

October 23, 2026

The fourth beta of ViciBox v.13.0.0 is available for testing and replaces Beta 3 as the release candidate:

MD5 checksums are listed on the ViciBox Server page, and earlier betas are in the download archive.

Beta 4 is the release candidate for ViciBox v.13.0.0. Unless testing turns up a major architectural issue that requires fixing the underlying image, it will become the official ViciBox v.13.0.0 release on October 31, 2026. Until then, the current stable release is ViciBox v.12.0.2.

PHP 8.4.27 security update

Beta 4 installs PHP 8.4.27 from the openSUSE PHP 8.4 repository, which fixes the critical php2shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). openSUSE Leap 16.0 itself still ships PHP 8.4.26, so the PHP 8.4 repository is included in the image to keep PHP updated.

Servers installed from Beta 3 or earlier are vulnerable. Run the following as root to add the PHP 8.4 repository, switch PHP over to it, and restart apache:

zypper ar https://download.opensuse.org/repositories/devel:/languages:/php:/php84/16.0/devel:languages:php:php84.repo
zypper mr -f devel_languages_php_php84
zypper --gpg-auto-import-keys ref
zypper dup --from devel_languages_php_php84 --allow-vendor-change
systemctl restart apache2

Afterwards php -v should show PHP 8.4.27 or newer. In a cluster, do this on every server that has apache running, including archive servers. Future PHP updates then come through a normal zypper up.

Please report problems and feedback on the VICIdial forum, including whether you used the standard or MD ISO.