Critical PHP vuln: php2shell (CVSSv4 9.2, CVE-2026-109618 / CVE-2026-109619)

[daern]

I run a public WLAN with a Captive Portal. Is this done with php, and therefor in danger.

Yes, it is vulnerable, unlike what @meyergru would apparently like us to think. If you can reach any part of the web UI, you can reach php.

Add a firewall rule to only accept traffic to the management UI from the single PC you are currently sat at and sit tight for the update. You could even block all access and only manage the server via the console until such time as an update is available. Either way, there are mitigations available to you and a rushed, untested patch could probably end up resulting in the downtime that you are presumably trying to avoid.

No, it's not an ideal situation, but @meyergru is right in saying that if you think this is the only AI-driven exploit going around, you should probably open your eyes...

[mimugmail]

Calm down guys, Franco is already working on a patch :)

[nero355]

Calm down guys, Franco is already working on a patch :)

COOL! :)

[muchacha_grande]

The security check is frightening !!! it's better not to ask for it

[br_opnsense]

Seems like PHP 8.5.12 is available for 26.7.

[Mks]

Seems like PHP 8.5.12 is available for 26.7.

Yes it is, I've installed it 2min ago, thanks @Franco

[pgerber]

Seems like PHP 8.5.12 is available for 26.7.

My thanks to everyone involved. My experience with updates coming from OPNsense, generally, has been very positive. Updates always arrived in a timely manner with only few regressions, none truly worth mentioning.

I for one prefer to wait a bit longer to get some additional certainty the system won't break on update. I know a number of Windows users that keep disabling updates first thing they get a new machine because their experience has been so bad. Maybe those updates have improved in quality in the last 15 years but there is definitely people out there having a hard time forgetting their experience.

[some-random-user]

Patch released. Thank you!

[Reqmg]

Thank you for upgrading so quickly.

For me, I run OPNSense on the current community edition latest release. Well, as it happens I am on holiday right now but thought that this is a critical release, and never ever has something gone wrong with OPNSense updates. Soooo, it will be okay to install it via VPN remotly, won't it? Guess....
Of course the OPNSense device is unreachable now. Of course there is nobody at home who has access or even the slightes knowledge to simply switch it off and on again...

I will go to bed now, knowing that my network is safe now because it's simply offline....

[nero355]

Just updated succesfully! Thanks to all the people involved getting this fixed soo fast! :)

[NickF]

Calm down guys, Franco is already working on a patch :)

Thanks @Franco - installed on 6 firewalls with no issues