AI Finds the Bugs. People Ship the Fixes

AI is now finding software vulnerabilities faster than ever. As a telecom operator, you should be asking yourself some serious questions for each and every one of those published flaws. Is your system affected? What fix do you need? How can you install that fix without cutting off subscribers from your services? And here’s one you should be asking every day: Are you well informed about how your system receives security updates?

PortaOne is here to help you answer that last question, at least when it comes to PortaSwitch. Read on to learn how we handle telecom security updates, including who does the work, how those fixes reach your PortaSwitch installation, how to read a scanner report, and how you can update your system even outside the maintenance window.

Finding the Vulnerability Is Step One

In April 2026, Anthropic announced Project Glasswing. It gave selected companies and open-source maintainers early access to Claude Mythos Preview, an AI model that finds previously unknown security flaws. Within weeks it found thousands of high-severity vulnerabilities, including a 16-year-old bug in FFmpeg and a chain of Linux kernel flaws that gave ordinary users full control of a machine. 

Those AI-detected flaws are now patched, but each of them still had to be confirmed, fixed, tested, and shipped by actual people. In a later update, Anthropic emphasized that verifying, disclosing, and patching flaws has to keep up as finding them gets faster. The same AI can help attackers too, so the time between a flaw going public and someone exploiting it is getting shorter.

For an operator, one unpatched server can mean exposed subscriber data, dropped calls, or a billing run that stops halfway.

A Recent Example: The October 2026 PHP Vulnerability

On October 21, 2026, the UK’s National Cyber Security Centre warned about two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. (CVE stands for Common Vulnerabilities and Exposures.) Under certain conditions, these flaws would let an unauthenticated attacker run code on a server. The NCSC asked organizations to check products that bundle PHP, as well as their own servers.

Every case like this comes down to the same three checks. Is the component installed? Does the flaw apply to that version and configuration? And which update closes it? Here’s how PortaOne runs those checks for PortaSwitch, and what happens next.

How PortaOne Delivers Telecom Security Updates to PortaSwitch

PortaSwitch and PortaBilling run on third-party software including Oracle Linux, databases, web servers, and other packages. A flaw in one of them may or may not reach your installation, depending on the version and configuration.

According to the PortaOne third-party software documentation, here’s how PortaSwitch receives security updates.

• Each build of a maintained PortaSwitch release includes the security updates available on the day it was built.
• Each new PortaSwitch release refreshes its packages from upstream repositories.
• Active PortaSwitch releases adopt Oracle Linux minor-version updates as they come out.
• Major operating system upgrades arrive with new PortaSwitch maintenance releases.

Of course, there’s more to it than that. PortaOne is big on continuous improvement. We ship a new PortaSwitch maintenance release roughly every seven weeks, with extra builds in between for bug fixes. For the most critical security issues, PortaOne Support delivers a custom patch to current PortaSwitch releases without waiting for a build.

An available fix still has to be installed, however. That means you need to know which release you run, which updates exist for it, and when to deploy them. The longer an installation goes without an update, the bigger that job gets.

Not Sure Which PortaSwitch Release You’re Running?

We can help with that. Send PortaOne Support your installation details, and we’ll tell you which updates are available for it. You can find your PortaSwitch update options here.

Why Your Vulnerability Scanner Flags CVEs That Are Already Fixed

Oracle Linux, like Red Hat Enterprise Linux, often fixes flaws by patching the existing package version instead of moving to the newest upstream version. This process is called backporting. The package keeps its old version number, but the fix is inside.

In our PortaOne documentation you can find the example of CVE-2023-38545. This was a critical flaw in libcurl that Oracle Linux fixed upstream in curl 8.4.0. They applied the fix to an older version and shipped it as libcurl-7.76.1-23.el9_2.4. (By the way, if you want to know more about how our documentation portal evolved, we have a great story about that.)

A scanner that only compares version numbers still reports that package as vulnerable. So, before acting on an alert, check the CVE against Oracle Linux ELSA advisories, or send it to PortaOne Support to check against your PortaSwitch release.

Who Turns Fixes into Telecom Security Updates?

AI can point at a flaw, but it’s people who decide what it means for a live network and how to roll out the fix.

PortaOne finds new CVEs in three ways. The first is a scanner that runs continuously on PortaSwitch releases and builds in development. The second is a report that Oracle sends monthly to inform us of new security issues. Finally, a PortaOne security engineer checks new CVEs against PortaSwitch every business day. If an update is needed, the work follows the documented PortaOne update procedure:

1. We work with you to choose the target release.
2. Our team runs compatibility checks and prepares the installation.
3. We schedule the work around your off-peak hours.
4. We deploy the update.
5. Our team works with yours to check that the system works.
6. We help with any questions that come up.

Each PortaSwitch server keeps two software partitions. The new version installs on the inactive partition while the server keeps running the old one. Then, the server reboots into the new version. If something goes wrong, the previous version is still on the other partition, so rolling back takes one more reboot.

Your team provides the context PortaOne can’t get from outside your business: which services matter most, when traffic peaks, and which integrations need extra testing.

Updating PortaSwitch Without Downtime

Most operators already know they should install security updates, but the harder part is the maintenance window.

On a single-site PortaSwitch installation, most of the preparation happens in the background. Switching to the new version requires a server reboot, and some database changes need a short service interruption. Both of these happen in a maintenance window.

Operators with stricter uptime targets have three options:

1. Update one site while the other carries traffic

PortaSwitch can update without downtime on site-redundant installations with a dispatching SBC on at least two dedicated servers. One site keeps handling traffic while the other is updated, and PortaOne Support checks the updated site before moving traffic to it. Since this requires that architecture to be in place first, it isn’t available on every installation.

2. Have a second site take over

In a geographically dispersed PortaSwitch installation, the main site is paired with fully redundant secondary sites, connected into one private network. Users register with the nearest site, so they keep service if the main site goes down. The same setup lets PortaSwitch spread load across sites and update one site at a time.

3. Keep backups somewhere else

When you keep your backup on the same servers as the system it protects, you can lose it to the same ransomware attack, hardware failure, or fire. PortaSwitch has an archivist utility that copies backups to a remote destination, such as an FTP server outside the installation. Keep at least one copy isolated from production, limit who can reach it, and test restores. PortaOne support and maintenance includes help with setting up backup policies and recovering databases.

These setups don’t replace security patches. They do keep PortaSwitch running while updates go in, and give you a way back when something fails.

What Happens to PortaSwitch When You Let Support and Maintenance Lapse?

If you haven’t updated your installation for a while, you may be several maintenance releases behind. A standard update can only move a PortaSwitch installation to the nearest long-term support release (any release ending in 0 or 5). So, a big gap means undertaking several updates in a row.

For long jumps, Dual Version PortaSwitch can run your old and new systems side by side while we work together to move customers across in batches. If there is a problem during the migration, it will only affect a small group of customers instead of all of them.

PortaOne support and maintenance includes:

• PortaSwitch software updates and maintenance releases, including security updates and custom patches for the most critical issues
• 24/7 technical support
• 24/7 automated remote monitoring
• Help with backup policy setup and database recovery
• A dedicated Customer Success Manager

While none of this replaces your own security team, it gives you the updates, and the people to plan and install them.

Five Things to Check Before Your Next PortaSwitch Update

If you’re feeling inspired to undertake an update, here are a few things you should have prepared before the process begins:

1. Your current release. Which PortaSwitch maintenance release are you running, and which security updates exist for it?
2. The update history. When did you run the last successful update, and which fixes are still not installed?
3. Uptime. Does your PortaSwitch architecture support updates without downtime or a second site? If not, what would it take?
4. Your backup plan. Where are the copies, who can reach them, and when did you last test a restore?
5. Your full support team. Who gets the updates to you, who installs them, and who do you call if something breaks?

Review Your PortaSwitch Update Plan Before the Next CVE Arrives

AI is helping defenders find flaws faster, but it’s also helping attackers come at systems more often and more effectively. Keeping your telecom network safe still comes down to regular and conscientious checking, patching, testing, and planning.

Whether you run an older PortaSwitch release, want to update without a maintenance window, or have let support and maintenance lapse, start by finding out where your installation stands. As always, if you need help or guidance, our team is at hand. Reach out to one of our Customer Success Managers and we’ll be happy to help.

FAQs