Security Notice: Following an industry-wide security update from the upstream PHP project (CVE-2026-109618 & CVE-2026-109619), Xorcom has issued proactive runtime patches across all CompletePBX platforms. Amboya recommends applying these patches during standard IP PBX maintenance windows.
1. Multi-Tenant Deployments (Debian 11 & 12)
Execute from the MT Manager Host (SSH as root), not inside individual tenant containers:
# Download update tools
mkdir -p /root/patches && cd /root/patches
curl -fLO https://updates.xorcom.com/~xorcom/patches/tmx_patch.sh
curl -fLO https://updates.xorcom.com/~xorcom/patches/php-fix_2026-10-22.tar.gz
chmod 700 tmx_patch.sh
# List running tenants
lxc list -c ns
# Patch single tenant
./tmx_patch.sh php-fix_2026-10-22.tar.gz cust1
# Patch multiple tenants sequentially
./tmx_patch.sh php-fix_2026-10-22.tar.gz cust1 cust2 cust3Verify that each target tenant reports SUCCESS!. Logs are recorded to /var/log/tmx_patch.log.
2. Dedicated Hardware & Virtual Appliances (Debian 12)
Upgrade via GUI (Admin > Maintenance > Updates) or via CLI with an active Service Agreement:
apt update && xlic auth && apt full-upgrade -y3. Dedicated Hardware & Virtual Appliances (Debian 11)
Apply the hotfix package directly over SSH:
apt update
xlic auth
apt install php-fix-d11
php-fix-d11Modern business telecommunications rely heavily on the resilience of the underlying Linux environment. Whether deploying dedicated on-premises hardware appliances, virtual PBX instances, or scalable Multi-Tenant (MT) PBX cloud platforms, the integrity of core web services (including the PHP runtime, Nginx, and Apache) is just as critical as SIP signaling and media encryption.
Upstream runtime patches—such as those addressing the recent PHP remote code execution vulnerabilities—ensure that CompletePBX administration portals and API endpoints remain protected against unauthorized access. Keeping your Xorcom VoIP PBX updated via official Debian package repositories and maintaining an active Service Agreement guarantees seamless access to critical security hotfixes without interrupting mission-critical call flow.
For maintenance assistance or service validation, contact Amboya Technical Support.