OPNsense Forum

Hi Franco,

Thanks for the quick response to the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

I'm currently running OPNsense 26.1.11_10 and haven't upgraded to 26.7 yet due to compatibility considerations with my existing setup. The upgrade is planned, but I can't carry it out immediately.

Will the PHP security fixes also be made available for installations still running 26.1.x, perhaps as a standalone package update or backport?

I understand that older release branches cannot be maintained indefinitely. However, especially with vulnerabilities of this severity, it would be helpful to have a way to apply essential security fixes without having to perform a major version upgrade at short notice.

Thanks for clarifying!

Cheers,
Michael

Quote from: weilander on Today at 09:41:43 PMI'm currently running OPNsense 26.1.11_10 and haven't upgraded to 26.7 yet due to compatibility considerations with my existing setup.

Which ones exactly ?

Quote from: nero355 on Today at 10:14:01 PMWhich ones exactly ?

Hi nero355,

I've had some rather unpleasant issues with my OPNsense installation in the past, including a FreeBSD pkg version being installed instead of the expected OPNsense version, resulting in segmentation faults and requiring manual repairs.

I've also experienced issues with the Zenarmor repository and recurring WebGUI problems after restarts, apparently related to Zenarmor.

I'm not claiming that these are confirmed incompatibilities with 26.7. However, given those experiences, I'd prefer to prepare and test the major upgrade carefully rather than rush it.

I do intend to upgrade, but I can't do it immediately.

That's why I was asking whether a standalone PHP security fix or backport might be available for 26.1.x in the meantime.