Urgent PHP security update: protect MagnusBilling on Debian 11, 12 and 13

Act immediately: install the PHP fix and validate MagnusBilling. Operators running MagnusBilling earlier than version 8 must immediately begin a controlled upgrade by migration to MagnusBilling 8. Operators on Debian older than 11, CentOS or other legacy systems should migrate to Debian 13 as quickly as possible.

The 21 October 2026 security alert

CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in affected configurations. PHP identifies Apache mod_php as highest risk. Fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or vendor packages with verified backports.

Read the official PHP advisory→

Choose the procedure for your server

Before changing anything: backups and identification

Run commands as root. Make verified off-server backups of the database, application, customizations, Asterisk configuration, and required audio and recordings; take a snapshot where available. Schedule maintenance: updates and restarts can interrupt the panel, API and telephony processes.

CLI PHP may differ from web PHP. Loaded modules alone do not establish the handler for every site: inspect VirtualHosts and FPM configuration.

cat /etc/debian_version
php -v
apache2ctl -M | grep -Ei 'php|proxy_fcgi'
dpkg -l | grep -E '^ii[[:space:]]+(libapache2-mod-php|php[0-9.]+-(cli|common|fpm))'
ls -l /etc/apache2/mods-enabled/*php* /etc/apache2/conf-enabled/*fpm* 2>/dev/null

Debian 12 and 13: refreshing package lists does not install a fix

apt update refreshes repository information. apt upgrade installs available updates and may update other components too; review the list before confirming. Resolve apt update errors before treating the server as up to date.

apt update
apt list --upgradable
apt upgrade

Debian 12 with Apache mod_php 8.2

Verify libapache2-mod-php8.2 and php8.2-common are 8.2.35-1~deb12u1 or a later fixed revision. This example applies to mod_php 8.2. Restart only after installing the fix; configtest must succeed.

apt-cache policy libapache2-mod-php8.2 php8.2-common php8.2-fpm
dpkg-query -W libapache2-mod-php8.2 php8.2-common
apache2ctl configtest && systemctl restart apache2
systemctl is-active apache2

Debian 13 with Apache mod_php 8.4

Verify libapache2-mod-php8.4 and php8.4-common are 8.4.27-1~deb13u1 or a later fixed revision. For another PHP branch or external repository, check that supplier’s advisory.

apt-cache policy libapache2-mod-php8.4 php8.4-common php8.4-fpm
dpkg-query -W libapache2-mod-php8.4 php8.4-common
apache2ctl configtest && systemctl restart apache2
systemctl is-active apache2

Using PHP-FPM? Restart the correct FPM service

Restarting Apache alone does not ensure FPM workers are replaced. Restart the unit actually used by the site: php8.2-fpm or php8.4-fpm in these examples. Adapt the name for other branches and verify the fixed package. Do not run both commands indiscriminately.

systemctl restart php8.2-fpm
# OR, on the server using PHP 8.4 FPM:
systemctl restart php8.4-fpm

If the candidate version is still old

Compare Installed and Candidate in apt-cache policy. If both still list a vulnerable package, apt upgrade and restarting Apache will not fix it. Check apt update errors, the security repository, mirror synchronization, held packages and PHP package origin. A backport can fix issues without changing the upstream version: compare the full package revision with the supplier’s advisory. Restrict web access until patched. Do not mix repositories from different Debian releases.

Debian 11: a temporary PHP 8.2 option

Regular Debian 11 LTS ended on 31 August 2026. archive.debian.org is a historical archive, not a source of new fixes. Debian 13 is the recommended destination.

For MagnusBilling 8, you can temporarily evaluate patched PHP 8.2 using Sury packages specifically built for bullseye. This adds an external supplier and does not restore support for the rest of the OS. Test on a server clone: moving from PHP 7.4 to 8.2 does not guarantee compatibility with customizations, additional modules or commercial extensions.

The following commands target Debian 11 with mod_php 7.4. Check whether Sury is already configured to avoid duplicate entries, and back up /etc/apt, /etc/php and /etc/apache2. Stop if any step fails. Extended support with a confirmed backport is another option when the application cannot change PHP versions.

Read the current Sury instructions→

Debian 11 — add the repository and check the version

Verify the key’s source before installing it. Continue only after both the key download and installation succeed.

apt update
apt install ca-certificates curl
curl -fsSLo /tmp/debsuryorg-archive-keyring.deb \
  https://packages.sury.org/debsuryorg-archive-keyring.deb &&
dpkg -i /tmp/debsuryorg-archive-keyring.deb

Use bullseye exclusively on this server. Confirm the PHP 8.2 candidate is 8.2.35 or later before installation. Stop if it is unavailable.

echo 'deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] https://packages.sury.org/php/ bullseye main' \
  > /etc/apt/sources.list.d/sury-php.list
apt update
apt-cache policy libapache2-mod-php8.2 php8.2-cli php8.2-common

Debian 11 — simulate and install the extensions

This set covers a typical deployment with curl, GD, mbstring, MySQL, SQLite and XML. Inventory php -m and adapt it for every extension you use. JSON is built into PHP 8.2. The simulation changes no packages; review removals and conflicts.

apt-get -s install libapache2-mod-php8.2 \
  php8.2-cli php8.2-common php8.2-curl \
  php8.2-gd php8.2-mbstring php8.2-mysql \
  php8.2-opcache php8.2-readline php8.2-sqlite3 php8.2-xml

With a restorable backup and the simulation reviewed, install during maintenance. Package installation can automatically change services and alternatives; do not assume the live environment stays unchanged until the next step.

apt-get install libapache2-mod-php8.2 \
  php8.2-cli php8.2-common php8.2-curl \
  php8.2-gd php8.2-mbstring php8.2-mysql \
  php8.2-opcache php8.2-readline php8.2-sqlite3 php8.2-xml

Debian 11 — activate CLI and Apache PHP

First confirm /usr/bin/php8.2 exists and works. This block assumes mod_php 7.4 is active; do not apply it to a site served through FPM. If configtest fails, fix the configuration before restarting.

/usr/bin/php8.2 -v
update-alternatives --set php /usr/bin/php8.2
hash -r
a2dismod php7.4 &&
a2enmod php8.2 &&
apache2ctl configtest &&
systemctl restart apache2

Debian 11 — verify the result

Expect PHP 8.2.35 or later, php8.2 links under mods-enabled and Apache active after a successful restart. Keep old packages until validation is complete, but do not leave sites or workers serving requests through unpatched PHP 7.4. Do not run autoremove at this stage.

php -v
php -m
ls -l /etc/apache2/mods-enabled/*php*
dpkg-query -W libapache2-mod-php8.2 php8.2-common
systemctl is-active apache2

Validate the panel, API, AGI and billing

• Review memory, upload and timezone settings in /etc/php/8.2/apache2/php.ini and /etc/php/8.2/cli/php.ini, or the paths for your actual version and SAPI. Do not copy the entire old php.ini.
• Confirm web PHP through a temporary diagnostic restricted to authorized access, then remove it. Do not publish phpinfo() openly.
• Check AGI scripts, shebangs, cron jobs and services explicitly invoking php7.4: update-alternatives does not rewrite those paths. Check old FPM pools that are still in use too.
• Test login, API, inbound and outbound calls, audio, CDR, rating, balances, scheduled jobs and payment integrations. Inspect logs.
• If recovery requires reverting to a vulnerable version, restrict web access during recovery. An operational rollback does not remove the security flaw.

Old Debian, CentOS and MagnusBilling before 8: urgent migration

If you run Debian older than 11, CentOS or another legacy system, migrate to Debian 13 as quickly as possible. CentOS 7 reached official end of life on 30 June 2024. A working system is not necessarily a patched system. This is MagnusBilling’s operational migration recommendation, not a claim that every release of every other OS is unsupported.

If you still run MagnusBilling earlier than 8, immediately begin a controlled migration to MagnusBilling 8. Moving from 7 to 8 requires another server: do not run the version 8 installer over the old installation. Prepare fresh Debian 13, follow the migration documentation, and validate the database, trunks, endpoints, chan_sip/PJSIP conversion and billing before cutover.

Until patching or migration is complete, restrict HTTP/HTTPS to a VPN or trusted IPs, covering IPv4 and IPv6. Account for required APIs and callbacks, and preserve SIP/RTP rules. Strong passwords and application login restrictions do not replace network filtering or PHP patches.

Plan migration to MagnusBilling 8→

References and verification date

Procedures checked on 21 October 2026. Confirm current packages and supplier instructions before running commands.

• PHP: security advisory, 21 October 2026
• Debian 12: PHP 8.2.35 security update
• Debian 11 lifecycle
• Sury PHP repository instructions
• MagnusBilling 8 migration documentation
• CentOS Linux lifecycle