Last week, PHP shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, popularly known as “PHP2Shell”. Many of our clients have been asking us whether they are at risk, so here is the short answer: QueueMetrics, WombatDialer, our SaaS platform QueueMetrics Live and our Microsoft Teams integration are not affected, as they do not use PHP anywhere. You can rest assured.

PHP2Shell is a pair of critical flaws in the PHP runtime itself, both rated 9.2 under CVSS v4.0. They may let an unauthenticated attacker run arbitrary code on a web server. Exploitation attempts were seen in the wild a few days before the patches came out, and CISA has since added both to its catalog of Known Exploited Vulnerabilities.

If you run any PHP application on your PBX - and Asterisk and FreeSWITCH GUIs are commonly written in PHP - you should upgrade PHP immediately.

It’s only a matter of time

Our products have been designed around a security model since day one. Still, we are not so naive as to expect that there will never be vulnerabilities in our code, or in the code of the libraries we depend on.

The number of vulnerabilities discovered every day has exploded over the last few months, thanks to new AI models that are very good at finding them. All software, even the most famous ones with huge development teams behind them, turns out to have a very large number of vulnerabilities. We would love to think otherwise, but this applies to us too: it is only a matter of time.

What we commit to is that, if an issue is found, it gets fixed as quickly as possible. What you need to do is to be in a position to update your systems quickly.

Be ready to upgrade

The way to be able to update quickly is simply to run a recent version of QueueMetrics, and to update it regularly as soon as new releases come out. So if you are on a release older than 26.10, you should plan your upgrade now. Upgrading has never been easier: QueueMetrics 26.10 runs as a single standalone file and is installed or upgraded with a single command.

If you are still on an RPM-based install, see Updating from a RPM-based distribution in our docs, and remember that our staff is always available to help you. If you’d rather not upgrade on your own, a Remote Support Pack lets our support team do it for you.

Clients on QueueMetrics Live do not need to worry: we keep them updated automatically.

keyboard_arrow_left Back