PHP 8.2 Security Patch to 8.2.35 on FusionPBX (CVE-2026-109618 / CVE-2026-109619) | CX Knowledgebase

Purpose: Upgrade the installed PHP 8.2 packages to 8.2.35 on a FusionPBX host, restart dependent services, and verify the stack is healthy.

Scope

Hosts already running PHP 8.2 from the Sury repository (packages.sury.org), Debian 12 or 13.
Not for hosts on PHP 8.1 — use the PHP2Shell emergency patch procedure for those.

Audience

Ops / support engineers with root SSH access to the FusionPBX server.

Impact

Voice calls: no impact (FreeSWITCH does not use PHP).
FusionPBX web GUI: unavailable for a few seconds while php-fpm restarts; users may need to log in again.
CDR import: paused briefly; CDRs are queued in /var/log/freeswitch/xml_cdr and imported afterwards.

Run during off-hours.

1. Pre-checks

Run as root:

Bash

lsb_release -ds; php -v | head -1
fs_cli -x "show calls count"
apt-get update -qq
apt-cache policy php8.2-fpm | head -4
ls /var/log/freeswitch/xml_cdr | wc -l

Expected:

PHP 8.2.x installed; "Candidate" shows 8.2.35 or later from packages.sury.org.
Active calls near 0.
Note the xml_cdr file count as a baseline.

2. Backup

Bash

TS=$(date +%F_%H%M)
tar czf /root/php82-etc-backup-$TS.tgz /etc/php/8.2
dpkg -l | awk '/^ii  php/{print $2, $3}' > /root/php-packages-before-$TS.txt
php -m > /root/php-modules-before.txt

Optional: take a server snapshot (e.g. DigitalOcean) — this is the only way to roll back the packages themselves.

3. Dry run (no changes)

Bash

apt-get install --only-upgrade -s -o Dpkg::Options::="--force-confold" $(dpkg -l | awk '/^ii  php8.2/{print $2}') | grep -E '^(Inst|Remv)'

Expected: only php8.2-* packages moving to 8.2.35; no Remv (remove) lines. Stop and investigate if anything else appears.

4. Upgrade

Bash

apt-get install --only-upgrade -y -o Dpkg::Options::="--force-confold" $(dpkg -l | awk '/^ii  php8.2/{print $2}')

--force-confold keeps all existing configuration files. php8.2-fpm restarts automatically.

5. Restart FusionPBX PHP services

List the FusionPBX services present on this host:

Bash

systemctl list-units --type=service --no-pager | grep -iE 'email_queue|event_guard|fax_queue|system_status|xml_cdr'

Restart the ones listed (remove any not present on this host):

Bash

systemctl restart xml_cdr event_guard email_queue fax_queue system_status
systemctl is-active xml_cdr event_guard email_queue fax_queue system_status

All should report active.

6. Verify

Bash

php -v | head -1; php-fpm8.2 -v | head -1; systemctl is-active php8.2-fpm nginx
php -m | diff /root/php-modules-before.txt - && echo "PHP modules unchanged"
journalctl -u php8.2-fpm -u xml_cdr -u event_guard --since '10 min ago' --no-pager | grep -iE 'error|fail|fatal' | tail -5
grep -rh 'fastcgi_pass' /etc/nginx/sites-enabled/ | sort -u
curl -skI https://127.0.0.1/login.php | head -3
ls /var/log/freeswitch/xml_cdr | wc -l; fs_cli -x "status" | sed -n '1,3p'

Expected:

php and php-fpm8.2 report 8.2.35; php8.2-fpm and nginx are active.
PHP modules unchanged (empty diff).
No new error/fatal lines.
fastcgi_pass points to the php8.2-fpm socket.
/login.php returns HTTP 200 or a redirect.
xml_cdr file count is back to around the baseline and does not grow after new calls; FreeSWITCH status is normal.
Log in to the FusionPBX GUI and open Dashboard and Call Detail Records.

7. Rollback

Configuration problem: restore the config backup and restart PHP:

Bash

tar xzf /root/php82-etc-backup-<timestamp>.tgz -C /
systemctl restart php8.2-fpm

Package problem: the previous PHP version cannot be re-downloaded from the Sury repository (it keeps only the latest release). Restore the server snapshot taken in step 2.
In all cases, capture the output of:

Bash

journalctl -u php8.2-fpm --since '30 min ago' --no-pager