"
Adding to this: both CVEs (CVE-2026-109618, CVE-2026-109619) are rated CVSS 9.2 and reported as unauthenticated, so login protection on the GUI won't help. Also worth noting that by default lighttpd binds on every interface address, so the GUI is reachable from all internal VLANs, not only WAN.
Two follow up questions:
Is there any plan for 26.1 installs (still on PHP 8.3.30), or is upgrading to 26.7 the only way to get the fix?
Until the hotfix lands, is restricting Listen Interfaces plus WAN source IPs the recommended mitigation, or is there anything else you'd suggest?
Two follow up questions:
Is there any plan for 26.1 installs (still on PHP 8.3.30), or is upgrading to 26.7 the only way to get the fix?
Until the hotfix lands, is restricting Listen Interfaces plus WAN source IPs the recommended mitigation, or is there anything else you'd suggest?
