Upgrade PHP packages to mitigate php2shell

Choose the procedure for your deployment. Perform upgrades during a maintenance window, as PHP package upgrades may restart the web service.

MT tenants (Debian 11 and Debian 12)

Run these commands on the MT Manager host, not inside a tenant container. Connect to the MT Manager via SSH as root.

lxc list -c ns

Select tenants whose status is RUNNING. The patch installer requires one or more tenant names; it does not automatically select every tenant.

For one tenant:
cd /root/patches
./tmx_patch.sh php-fix_2026-10-22.tar.gz cust1

For several tenants:
cd /root/patches
./tmx_patch.sh php-fix_2026-10-22.tar.gz cust1 cust34 cust33

The installer processes the named tenants in sequence. Confirm that each tenant reports SUCCESS! and that the run ends with ***SUCCESS***.

If a tenant fails or its connection is interrupted, check which tenants completed before retrying; do not assume the entire list was patched.

The installer also writes to /var/log/tmx_patch.log on the MT Manager.

Perform the regular system upgrade procedure via Admin > Maintenance > Updates. A valid Service Agreement is required for the PBX to be upgraded.

(alternate procedure via CLI)
apt update && xlic auth && apt full-upgrade -y

A valid Service Agreement is required. Connect to the PBX via SSH and run:

apt update
xlic auth
apt install php-fix-d11
php-fix-d11

The final command upgrades the PHP packages.