[SA-0010] – Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Phillip Ma
started a topic
about 3 hours ago
[SA-0010] – Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Dear Valued Sippy Customer,
Two critical security vulnerabilities have recently been identified in PHP. Sippy Softswich uses PHP to help operate the web interfaces of your Softswitch. Recently two critical security vulnerabilities have been found in PHP and have been patched by the open source community.
These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow an unauthenticated attacker to execute malicious code remotely on affected systems. Both vulnerabilities have been assigned a CVSS severity score of 9.2 out of 10, making them critical security concerns.
Sippy Software has now included the newest versions of PHP in our software to help address these two concerns. Please contact our support team to schedule a time to update to your systems.
Critical PHP Vulnerabilities
The vulnerabilities, collectively referred to as "PHP2Shell," involve weaknesses in PHP's memory management and error-handling processes.
CVE-2026-109618 – Memory Corruption Vulnerability
This vulnerability occurs when PHP encounters an out-of-memory condition while processing a request. Under certain circumstances, improperly initialized memory can lead to memory corruption, potentially allowing an attacker to execute unauthorized code on the affected server.
CVE-2026-109619 – Use-After-Free Vulnerability
This vulnerability involves PHP retaining references to memory that has already been released. An attacker may exploit this condition to execute arbitrary code remotely, potentially compromising the security of the affected system.
Successful exploitation of either vulnerability could result in unauthorized system access, data exposure, or disruption of services.
Affected Sippy Releases
Sippy Software has identified the following PHP versions as the minimum upgrade targets for the corresponding Sippy Soft Switch releases:
Sippy Release
Target PHP Version
Sippy 2024
PHP 8.3.36 or later
Sippy 2023
PHP 8.2.35 or later
Upcoming Sippy releases
PHP 8.5.12 or later
Customers running Sippy 2022 should upgrade to Sippy 2023 and apply the appropriate security updates to address these vulnerabilities.
Resolution and Recommended Actions
Customers should contact the Sippy Software Support Desk to schedule a maintenance window for the installation of these security updates. The update procedure is automated but please be advised that brief service interruptions are expected during the maintenance process.
Customers running Sippy 2022 should coordinate with our Support Desk to schedule an upgrade to Sippy 2023, which will include the necessary security updates to be applied.
Customers running older software versions should contact Sippy Software Support to discuss the appropriate upgrade path.
As an interim measure Customers are encouraged to ensure access to their Sippy SoftSwitch is protected through an effective firewall policy.
Additional Information
For further technical information regarding these vulnerabilities, please refer to the official CVE records:
Sippy Software remains committed to maintaining the security and reliability of our products. We encourage all customers to keep their systems updated and follow recommended security practices.
If you have any questions or require assistance with upgrading your Sippy Softswitch installation, please contact Sippy Software Support.
Phillip Ma
[SA-0010] – Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Dear Valued Sippy Customer,
Two critical security vulnerabilities have recently been identified in PHP. Sippy Softswich uses PHP to help operate the web interfaces of your Softswitch. Recently two critical security vulnerabilities have been found in PHP and have been patched by the open source community.
These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow an unauthenticated attacker to execute malicious code remotely on affected systems. Both vulnerabilities have been assigned a CVSS severity score of 9.2 out of 10, making them critical security concerns.
Sippy Software has now included the newest versions of PHP in our software to help address these two concerns. Please contact our support team to schedule a time to update to your systems.
Critical PHP Vulnerabilities
The vulnerabilities, collectively referred to as "PHP2Shell," involve weaknesses in PHP's memory management and error-handling processes.
CVE-2026-109618 – Memory Corruption Vulnerability
This vulnerability occurs when PHP encounters an out-of-memory condition while processing a request. Under certain circumstances, improperly initialized memory can lead to memory corruption, potentially allowing an attacker to execute unauthorized code on the affected server.
CVE-2026-109619 – Use-After-Free Vulnerability
This vulnerability involves PHP retaining references to memory that has already been released. An attacker may exploit this condition to execute arbitrary code remotely, potentially compromising the security of the affected system.
Successful exploitation of either vulnerability could result in unauthorized system access, data exposure, or disruption of services.
Affected Sippy Releases
Sippy Software has identified the following PHP versions as the minimum upgrade targets for the corresponding Sippy Soft Switch releases:
Sippy Release
Target PHP Version
Sippy 2024
PHP 8.3.36 or later
Sippy 2023
PHP 8.2.35 or later
Upcoming Sippy releases
PHP 8.5.12 or later
Customers running Sippy 2022 should upgrade to Sippy 2023 and apply the appropriate security updates to address these vulnerabilities.
Resolution and Recommended Actions
Customers should contact the Sippy Software Support Desk to schedule a maintenance window for the installation of these security updates. The update procedure is automated but please be advised that brief service interruptions are expected during the maintenance process.
Customers running Sippy 2022 should coordinate with our Support Desk to schedule an upgrade to Sippy 2023, which will include the necessary security updates to be applied.
Customers running older software versions should contact Sippy Software Support to discuss the appropriate upgrade path.
As an interim measure Customers are encouraged to ensure access to their Sippy SoftSwitch is protected through an effective firewall policy.
Additional Information
For further technical information regarding these vulnerabilities, please refer to the official CVE records:
CVE-2026-109618:https://www.cve.org/CVERecord?id=CVE-2026-109618
CVE-2026-109619:https://www.cve.org/CVERecord?id=CVE-2026-109619
Sippy Software remains committed to maintaining the security and reliability of our products. We encourage all customers to keep their systems updated and follow recommended security practices.
If you have any questions or require assistance with upgrading your Sippy Softswitch installation, please contact Sippy Software Support.
Sincerely,
Sippy Software Team