> For the complete documentation index, see [llms.txt](https://docs.mikopbx.com/mikopbx/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.mikopbx.com/mikopbx/english/other/changelog/mikopbx-2026.6.34.md).
# MikoPBX 2026.6.34
Changes since MikoPBX 2026.5.6
The main focus of MikoPBX 2026.6.34 is security. PHP has been updated to 8.4.27, closing two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under certain conditions, they allow unauthenticated remote code execution.
Call recording and MP3 playback have also been improved, employee call forwarding is more reliable, and Cloud.ru Evolution is now supported.
{% hint style="warning" %}
Back up the PBX before updating. When updating from 2026.5.6, upload the IMG image manually: the "Download" button does not work in that version. For PBXs installed before 2026.1.1, use the .img image.
{% endhint %}
### Security
PHP has been updated to 8.4.27 (CVE-2026-109618, CVE-2026-109619), along with nginx and OpenSSH.
The built-in attack protection now scans the whole request body, including `DELETE` requests. The scan runs after blocklist and rate limit checks and does not add load during brute-force attempts. REST API requests larger than 4 MB are rejected with a clear error.
Internal recording view links are no longer reachable from the network, and system log archive downloads are restricted to generated archives only.
### Call recordings and call history
If a call transfer fails because of the PBX's custom dialplan rules and the caller returns to the agent, recording continues. Previously, the conversation after the return was not recorded.
A transfer answered via `*8` pickup is now stored in call history as an answered call with its own recording. Previously, such a conversation appeared as missed, and its recording file was left on disk unlinked from the call.
Handling of unevenly arriving audio has been fixed; it could cause stutters, clicks, and "stretched" fragments in recordings. MPEG-2.5 MP3 decoding has been fixed; it could distort IVR greeting playback.
When recordings are played or downloaded as MP3, WAV, or OGG, the converted file is cached. Replaying and seeking no longer start a new conversion, and temporary copies no longer pile up on disk: the cache is cleaned automatically.
### Call forwarding and SIP
Employee call forwarding changes are now always applied after saving. Previously, if telephony was restarting at that moment or SIP settings could not be applied, a new forward could silently fail to take effect.
{% hint style="warning" %}
If a custom dialplan reads forwarding from the Asterisk database (`DB(FW...)`), it must be updated: the values are now stored in the global variables `FW_`, `FW_BUSY_`, `FW_UNAV_`, and `FW_TIME_`.
{% endhint %}
Two providers with inbound registration and the same login can no longer be saved, nor can a provider whose login matches an extension number. Previously, this mistake stopped all trunks and employees. Manual `set_var` parameters in advanced settings are applied again, including several lines in a row.
The TLS transport in the employee card is deprecated and is no longer offered for new employees. To connect over TLS, set the SIP client username to `number-TLS`, for example `105-TLS`, with the same password. Employees that already use TLS get a warning in their card and in notifications.
The PBX's external NAT address is no longer derived from its hostname. Previously, this could break calls behind NAT and TLS connections. The link in the weak SIP password warning opens the right employee card again.
### Cloud, storage, and updates
Automatic PBX setup in Cloud.ru Evolution has been added, including SSH keys from the virtual machine parameters.
Swap now uses a compressed area in RAM. The swap file on disk is used only when that area fills up, which reduces wear on flash storage.
Downloading updates from the web interface works again for future updates: previously, clicking the button did not start the download. Installation from LiveCD works again: the installer no longer exits on its own without waiting for disk selection and confirmation.
The system log no longer loses entries prematurely: nine archived parts are kept instead of two. The progress of a factory reset is now saved in the log, which makes a failed reset easier to investigate.
### For developers
Module REST APIs return proper HTTP error codes instead of `200` for `result: false`. Empty JSON objects in responses are no longer turned into arrays. A timeout returns `504`, and an overloaded queue returns `503`.
Chunked file uploads send blocks of at most 10 MB. The module update notice appears again after the cache is cleared. Updating an API key's last-used time works on read-only installations, such as LXC.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.mikopbx.com/mikopbx/english/other/changelog/mikopbx-2026.6.34.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
