Critical PHP vuln: php2shell (CVSSv4 9.2, CVE-2026-109618 / CVE-2026-109619)

[tangofan]

Just updated succesfully! Thanks to all the people involved getting this fixed soo fast! :)

Indeed, it was great to get a fix so quickly. One small nitpick: The release version didn't change, e.g. to 26.7.7_1. Perhaps just an oversight in the heat of battle. Certainly something that can be presumably easily corrected, if necessary.

[FelixLo]

Thanks a lot guys. Was my first update (and upgrade) experience with opnsense and worked just flawlessly!

[bimbar]

Thanks @Franco:
for the fast patch !

[newsense]

Certainly something that can be presumably easily corrected, if necessary.

There's really no need for further action until 26.7.8

[moware]

Just updated succesfully! Thanks to all the people involved getting this fixed soo fast! :)

Indeed, it was great to get a fix so quickly. One small nitpick: The release version didn't change, e.g. to 26.7.7_1. Perhaps just an oversight in the heat of battle. Certainly something that can be presumably easily corrected, if necessary.

It's also a bit confusing that the UI in "System: Firmware" shows "Updated on: Wed Oct 14 04:15:27 CEST 2026" in the "Status" tab, which made me wonder whether the patch had been installed by the nightly cron-job at all.

Fortunately, there's also a "Packages" tab, which shows php85 at version "8.5.12", so everything seems to be fine.

Thanks a lot for the quick patch, OPNsense team!