Messages

https://github.com/opnsense/core/issues/11154

OPNsense 26.7.8 released:
...
. intrusion detection: add abuse.ch API token input
...
. unbound: remove Abuse.ch - ThreatFox IOC from the list
...

AFAICS, this has not arrived in 2026.10_BE yet.

[using the given assistant]

C.f. Migration Notes:

(o) The static PHP pages for firewall rule and outbound NAT management have been moved to the "os-firewall-legacy" plugin which can be manually installed before or after the upgrade.  All rules will continue to work regardless of the plugin being installed or not and are easily migrated using the given assistant found in the menu under Firewall: Migration assistant.

AFAICS, this was offered as long as "old" rules were around.
After all were migrated, this menu entry did not show up any more.

Having migrated early, I can't test if the plugin is necessary for the Migration assistant.

Hth.

- does impact every Linux ...

This is plain wrong.

The original Anthropic publication states:
"This vulnerability (CVE-2026-98432) was patched upstream and backported to all maintained stable kernel branches."

Linus' wording: "It's a bug. Fix it!"

Already at publication 2026-10-15, the original CVE-2026-98432 listed
all the longterm and stable kernel versions being unaffected.
Kernel developers had fixed upstream 10 days before
(October 5, commit e3f33b0a1d89).

Since October 11, four days before publication time,
I was already running a patched kernel (gentoo-sources-7.2.10).

Up to November 1st., the big distributions had provided their patches.

RedHat, RHSB-2026-016, section 'Mitigation':

"Filtering ... is not a substitute for patching.
Applying kernel security updates ... is the only complete solution ... "

Until today, no entry has arrived into the CISA Known Exploited Vulnerabilities Catalog.

. . . creating new security threats in the process.

@ Uwe: +1 !

No, The world is not coming to an end.
Nobody should get enticed into swinging an un-tested big bat
introducing un-foreseen consequences' harm.

Stay vigilant, stay safe -
I allow myself to question the real intention behind any post
advertising commercial "Security Advisories" (1st line OP)
instead of citing cve.org directly.

You have observed the recommendations to save via
     --> System: Configuration: Backups,
right?

Download the install media for the version you desire to run,
exploit OPNsense Importer [1] during re-install and enjoy
a fresh clean consistent Firewall executing your previous working config
within minutes.

[1] "For new installations or migrations, follow this process: ..."
    [ https://docs.opnsense.org/manual/install.html#opnsense-importer ]

And OPNsense Business Edition 26.10 is already safe against
e.g. GHSA-p683-f7x2-pm4p: c.f. Release Notes --> [3]

Enjoy
Manfred

For a single-firewall small business, I will stay on the Community Edition for now and monitor the security updates closely.

Even if 'small': still 'business'. So don't. Upgrade to BE.

Proven since 2020.

3y license cost per annum: neglegible.

Spare your "add-on monitoring" efforts: Franco et al. are perfect at it.

Better make money with your business (where you are perfect at)
and spend some additional donations from those revenues.

VERSION: OPNsense 26.4_20-amd64


Currently, especially after "reset grid layout",
entries are sorted according sequence of creation time.

ENHANCEMENT

Although there is no real "Preference" mechanism,
being able to re-sort the sequence of entries
- like "Move up   / Move to TOP"
- like "Move down / Move to BUTTOM"
might help to illustrate underlying design ideas.

Alphabetically sorting according to  "Domain" does not help
especially if (sub-) Domains have to be added later on
and can not be easily "grouped" into existing context.

Transacting multiple Firefox upgrades since OP, I have not observed the problem lately
[ i7-13700 | Gentoo Linux | www-client/firefox-132.0.2:rapid ]

Perhaps, you might consider looking into
https://forum.opnsense.org/index.php?topic=44049.msg219587
   -->   https://github.com/opnsense/core/issues/8064:
"[ BE 23.10 ... BE 24.10_7-amd64 ] Automatic fail-over to a Fallback Gateway still fails"

Does the issue happen if IPv6 Configuration Type is set to "None"?

Please, also note https://github.com/opnsense/core/issues/8064#issuecomment-2482676644 .

As one former guy confirmed - even in actual Business Edition [BE 24.10_7-amd64] when using bare metal installation.

Processor: Intel Haswell I3-4360T
Memory: 32 GiB
Network:
. Intel I218-V
. Intel I350-T2 v2
. Intel I350-T4 v2
https://github.com/opnsense/core/issues/8064

Strange:
During this time, access to other websites works as expected - not being blocked

Confirmation: Similar under [ BE 24.10_7-amd64 ] .

Example:

-> Interface -> select LAN interface -> enable IPv6 :
. . . "IPv6 Configuration Type" = "Track Interface"
. . . "Assign prefix ID" = 0x11

-> Save -> Apply

-> WEB GUI unresponsible for 3'..4'
-> WEB GUI becomes responsible by itself afterwards; no need to reboot et al.

Please, c.f. detailed description in #8064 :
"[ BE 23.10 ... BE 24.10_7-amd64 ] Automatic fail-over to a Fallback Gateway still fails"
[ https://github.com/opnsense/core/issues/8064 ]

OPNsense 24.10 business edition is based on the OPNsense 24.7.6 community version.

Has anybody out there a similar ISP connection and tried automatic fail-over?

Thanks in advance

Persists on Business Edition OPNsense 24.10_7-amd64.

Discrepancies might be related to:
- Firefox: based upon Quantum
- Vivaldi,
- Falkon: based upon Chromium