On October 21, 2026, the PHP project announced two critical security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow an unauthenticated attacker to execute code remotely on affected systems. PHP is a component used by Xorcom systems, and this notice outlines the update process for each deployment type. Technical information is available in the official PHP security advisory.
How to patch php2shell vulnerability:
Choose the procedure for your deployment. Perform upgrades during a maintenance window, as PHP package upgrades may restart the web service.
MT tenants (Debian 11 and Debian 12)
Run these commands on the MT Manager host, not inside a tenant container. Connect to the MT Manager via SSH as root.
1. Download the patch tools
mkdir -p /root/patches
cd /root/patches
curl -fLO https://updates.xorcom.com/~xorcom/patches/tmx_patch.sh
curl -fLO https://updates.xorcom.com/~xorcom/patches/php-fix_2026-10-22.tar.gz
chmod 700 tmx_patch.sh
2. Identify the tenants to patch
lxc list -c ns
Select tenants whose status is RUNNING. The patch installer requires one or more tenant names; it does not automatically select every tenant.
3. Apply the patch
For one tenant:
cd /root/patches
./tmx_patch.sh php-fix_2026-10-22.tar.gz cust1
For several tenants:
cd /root/patches
./tmx_patch.sh php-fix_2026-10-22.tar.gz cust1 cust34 cust33
The installer processes the named tenants in sequence. Confirm that each tenant reports SUCCESS! and that the run ends with ***SUCCESS***.
If a tenant fails or its connection is interrupted, check which tenants completed before retrying; do not assume the entire list was patched.
The installer also writes to /var/log/tmx_patch.log on the MT Manager.
Debian 12 hardware and virtual appliances
Perform the regular system upgrade procedure via Admin > Maintenance > Updates. A valid Service Agreement is required for the PBX to be upgraded.
(alternate procedure via CLI)
apt update && xlic auth && apt full-upgrade -y
Debian 11 hardware and virtual appliances
A valid Service Agreement is required. Connect to the PBX via SSH and run:
apt update
xlic auth
apt install php-fix-d11
php-fix-d11
The final command upgrades the PHP packages.