Emergency security maintenance affecting some Wildix services
Identified
Update – PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
Most cloud PBXs have now been updated with the patched PHP versions. A small number remain, and our team is handling them individually. No action is required from partners for cloud PBXs.
All Wildix cloud services remain fully operational.
On-premise PBXs without auto-upgrade enabled should be updated as soon as possible, if this hasn’t been done already.
Identified
Update – PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
All Wildix cloud services have been updated with the patched PHP versions and are fully operational, including Legacy Kite, Legacy File Sharing, Zoho Integration Service and Wildix Integrations Hub. The rollout to cloud PBXs is in progress. No action is required from partners.
On-premise PBXs without auto-upgrade enabled should be updated as soon as possible, if this hasn’t been done already.
We will post a final update once the cloud PBX rollout is complete.
Identified
Update – PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
On 21 October 2026, the PHP project disclosed two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0: 9.2). Both could allow remote code execution without authentication. PHP has released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s advisory: https://www.php.net/archive/2026.php#2026-10-21-5
Wildix PBX
Supported PBX versions run on PHP 8.2 (WMS 6 and WMS 7 up to 7.08) and 8.4 (WMS 7.09 and later). Patched packages for on-premise PBXs are available in all Wildix repositories.
• Cloud PBXs: The update is being rolled out by Wildix. No action is required from partners. We will post an update here once the rollout is complete.
• On-premise PBXs with auto-upgrade enabled will receive the update automatically.
• On-premise PBXs without auto-upgrade must be updated manually as soon as possible.
• PBXs on versions older than WMS 6 must be upgraded to WMS 6 or WMS 7 as soon as possible.
Wildix services Our teams are applying the patched version across our infrastructure.
As a precaution, the following services have been taken offline until patching is complete:
•Legacy Kite •Legacy File Sharing •Zoho Integration Service •Wildix Integrations Hub
Other PBX features are not affected by this maintenance.
We will post further updates here as services are restored.
Reported
We are carrying out urgent security work following the disclosure of vulnerabilities affecting certain PHP-based services. As a precaution, access to some Wildix services may be temporarily unavailable while we apply protective measures and investigate potential exposure. We will post further updates here as work progresses and we can confirm the impact and recovery timelines.
For more information about this vulnerability, please refer to the CERT-EU security advisory: https://cert.europa.eu/publications/security-advisories/2026-018