FreePBX and PHP2Shell

The statement

No public statement located as of 23 October 2026, 01:22 UTC at: https://community.freepbx.org/c/announcements/5 (fetch failed at first try); https://community.freepbx.org/latest; https://community.freepbx.org/t/php-cve-patching/110401 (community thread, 38 replies, no post marked as Sangoma staff); https://community.freepbx.org/t/time-to-say-good-bye-to-v16-and-older-major-php-zero-day-flaw/110404 (listing only); https://github.com/NCSC-NL/php2shell (software list, status update 23 October 2026 00:48 CEST) (FreePBX 17 management framework and Sangoma PBXact 17 listed Investigation citing wiki and installer only).

Notes

No Sangoma or FreePBX project statement on PHP2Shell found as of the last check. The community thread PHP CVE Patching (opened 21 Oct 2026) carries an explicitly unofficial mitigation guide; one poster wrote this fix is not an official Sangoma-endorsed patch. (kierknoby, 21 Oct 2026, quoted from https://community.freepbx.org/t/php-cve-patching/110401). A user question on whether FreePBX 16 (PHP 7.4) will get an update had no Sangoma reply on the page read. NCSC-NL inventory lists FreePBX 17 and PBXact 17 as Investigation.

Change log

• 23 October 2026: first check

Submit a correction or your statement

Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.

Badge

A badge is issued once a public statement is located and verified on the company's own domain or verified official account.

FreePBX's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about FreePBX and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.