Hello,
By default, PHP runs as root on OPNsense.
With that in mind, can you please confirm that OPNsense will release a fix for this critical vulnerability (https://jackalsyn.com/posts/php-up-2026.html) in sync with upstream (scheduled for 14:00 UTC today, 21 Oct 2026 (https://www.php.net/archive/2026.php#2026-10-20-1))?
Thanks in advance!
Adding to this: both CVEs (CVE-2026-109618, CVE-2026-109619) are rated CVSS 9.2 and reported as unauthenticated, so login protection on the GUI won't help. Also worth noting that by default lighttpd binds on every interface address, so the GUI is reachable from all internal VLANs, not only WAN.
Two follow up questions:
Is there any plan for 26.1 installs (still on PHP 8.3.30), or is upgrading to 26.7 the only way to get the fix?
Until the hotfix lands, is restricting Listen Interfaces plus WAN source IPs the recommended mitigation, or is there anything else you'd suggest?