PHP Vulnerability Responses by Company

Sangoma US Inc.

Global cloud / infrastructure
Aliases / services
Sangoma / Sangoma Technologies Corporation / Sangoma US Inc. / Digium / FreePBX / PBXact / sangoma.com
Official website
https://sangoma.com
Sources identifying the operating company

Provider in the cited PBXact UC maintenance and support contract; not a determination of the contracting entity for every group service.

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

FreePBX

Response status
v17 updates and v16 backport guidance
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

Business communications and PBX products.

Apply PHP security updates on v17. The v16 PHP7.4 backport began as testing; the official team representative said on 26 October it was being promoted to production and on 27 October that it passed QA on fully updated standard v16/v17 installations.

Scope: This does not confirm installation on every deployment. Unofficial v15-or-earlier patches and customer success reports are not Sangoma guarantees.

What users should do

Use the official update path, verify running PHP and operation after restarting. Plan migration of older systems to v17 and consult support if updates cannot be completed.

Official service URL

Source URLs

  1. PHP2Shell response and scopehttps://community.freepbx.org/t/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact/110423Response evidence
  2. https://community.freepbx.org/t/php-cve-patching/110401?page=4https://community.freepbx.org/t/php-cve-patching/110401?page=4Response evidence
  3. https://community.freepbx.org/t/php-cve-patching/110401?page=5https://community.freepbx.org/t/php-cve-patching/110401?page=5Response evidence

PBXact

Response status
v17 updates and v16 backport guidance
Response information checked
2026-10-28

Current re-audit: Official response verified · Research date: 2026-10-28

The joint notice directs PBXact v17 users to update PHP and older users to plan migration. It describes a v16 PHP7.4 test backport; confirm applicability to your installation with support.

Scope: Follow the official PBXact v17 guidance. Subsequent v16 backport QA remarks describe standard FreePBX installations, not validation of every PBXact environment.

What users should do

Use the official update path, verify running PHP and operation after restarting. Plan migration of older systems to v17 and consult support if updates cannot be completed.

Source URLs

  1. PHP2Shell response and scopehttps://community.freepbx.org/t/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact/110423Response evidence
Related official sources
  1. PHP2Shell response and scopeOfficial notice
  2. Operating entityOfficial information directory

Comments