PHP critical security vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Incident
Report for Evolve IP EU
Subscribe to Updates
Update
Following the disclosure of the PHP vulnerabilities, XTIUM has reviewed its internal systems and applied the necessary mitigating measures where required.
We have also engaged all relevant vendors to determine whether any customer-facing services are affected. Based on responses received so far, only one vendor has identified potential exposure and is currently implementing remediation actions.
At present, the overall exposure to XTIUM services is considered low. We continue to work with the remaining vendors to complete our assessment and will provide further updates as additional information becomes available.
We have also engaged all relevant vendors to determine whether any customer-facing services are affected. Based on responses received so far, only one vendor has identified potential exposure and is currently implementing remediation actions.
At present, the overall exposure to XTIUM services is considered low. We continue to work with the remaining vendors to complete our assessment and will provide further updates as additional information becomes available.
Update
As a precautionary measure, the PBX Portal (https://pbxportal.mtel.nl) has been temporarily taken offline until further notice. Should you require any configuration changes, please submit a MACD request via the Selfservice Portal (https://selfservice.xtium.eu).
Investigating
On 20 October 2026, the PHP Foundation announced two critical vulnerabilities affecting PHP. The Dutch National Cyber Security Centre (NCSC) has advised organisations to prepare to update affected systems. A security patch is due for release at 16:00 CEST today.
We are investigating this issue and reviewing it with each of our vendors to confirm whether any XTIUM services are affected and whether patching is required. We will provide further updates as we know more.
For further information, see the NCSC guidance: https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php
We are investigating this issue and reviewing it with each of our vendors to confirm whether any XTIUM services are affected and whether patching is required. We will provide further updates as we know more.
For further information, see the NCSC guidance: https://www.rijksoverheid.nl/actueel/nieuws/2026/10/21/ncsc-ernstige-kwetsbaarheden-in-php
This incident affects: Online Business Telephony (OBT - Device registrations, OBT - Webex, OBT - Callcenter Wallboard, OBT - Receptionist application, OBT - Call recording, OBT - Callcenter application, OBT - Reporting, OBT Connector, Portal, Ossmosis Portal, OBT - Call Processing, OBT - Peter Connects, OBT - DMS, OBT - Voicemail), Online Routing Manager (IVR application, System3.mtel.nl, Portal.mtel.nl, ONS Broker), Connectivity (VPN connectivity, Co-location services, IP-Sec, Clearlogin API), Microsoft Teams (Microsoft Teams direct routing), Voice Services (Service numbers, Geographical numbers, International numbers), Akixi (Portal), Customer Ticketing Portal (Portal Access), OCC Online Contact Center (Agent application - Touchpoint, OCC Dialer, OCC Reporting, OCC Supervisor, OCC - Call Processing, OCC Cloud), and Talkdesk.