VitalPBX patches critical NGINX flaws in 4.5.3 R7

VitalPBX has released version 4.5.3 R7, a security and performance update that fixes two critical NGINX vulnerabilities and adds controls for SIP trunks, endpoint reporting, and real-time call handling. The update is available now for active subscribers and is meant to reduce risk for internet-facing PBX deployments.

Why it matters: - VitalPBX deployments are often internet-facing, so the two critical NGINX fixes reduce exposure on systems that handle business communications. - The update also targets day-to-day operator issues, including endpoint visibility, trunk control, and call-routing latency. - Multi-tenant reporting accuracy improves, which matters for providers and organizations managing more than one customer or business unit.

What happened: - VitalPBX released version 4.5.3 R7 on June 25, 2026. - The update enforces NGINX version 1.22.1-9+deb12u8 or higher. - The NGINX upgrade mitigates CVE-2026-9256 and CVE-2026-42946, both rated critical. - VitalPBX said administrators should apply the update immediately.

The details: - The release adds OpenSSL-based certificate chain verification to catch custom-certificate misconfigurations at upload time. - The PJSIP Endpoints report now includes a registration status filter for faster device identification. - PJSIP Trunks now expose support_path and fatal_retry_interval parameters directly in the interface. - The system adds drag-and-drop uploads for customer certificate files. - The Extensions API read endpoint now returns SMS connection numbers and provider details. - NGINX now includes a specialized WebSocket proxy for more reliable real-time event streaming. - The dynamic routing dialplan now uses FastAGI actions to reduce call-processing latency. - Call traffic tracking on the main tenant now shows activity across all tenants correctly.

Between the lines: - The release shows VitalPBX focusing on hardening core infrastructure while also smoothing operator workflows. - The certificate-validation change suggests an effort to stop deployment errors before they reach production. - The FastAGI and WebSocket updates point to a broader push for faster, more stable real-time communications.

What's next: - Active subscribers can install the update now through the VitalPBX administration interface or from the command line on Debian 12. - Full update instructions are available at the VitalPBX wiki. - New users can try the free Community plan with up to 10 extensions or start a 30-day free trial of a commercial plan at VitalPBX. - VitalPBX also lists a demo booking page at schedule a demo.

The bottom line: - VitalPBX 4.5.3 R7 is a security-first patch release with practical admin upgrades, aimed at keeping PBX systems safer and easier to run.