Critical PHP vuln: php2shell (CVSSv4 9.2, CVE-2026-109618 / CVE-2026-109619)

[tangofan]

To be fair: Ad did all the work in the background this time.

> The release version didn't change, e.g. to 26.7.7_1.

This and the data installed on the firmware page not changing are intended in this out-of-band package update. Normally we try to avoid doing this, but the alleged severity left us little choice.

The PHP communication on this one seems a bit weird. Also dropping this at 14 UTC means 16 MEST so at the end of the work day. This also increased the pressure unnecessarily IMO.


Cheers,
Franco

Thanks for the background info, Franco. You all certainly did the right thing. I guess I was just a bit surprised, since I don't recall (in my 2+ years using OPNsense) having such an out-of-band update before. And for your and your colleagues' sake, I hope there won't be too many of them in the future.