Critical PHP vuln: php2shell (CVSSv4 9.2, CVE-2026-109618 / CVE-2026-109619)

[tangofan]

Just updated succesfully! Thanks to all the people involved getting this fixed soo fast! :)

Indeed, it was great to get a fix so quickly. One small nitpick: The release version didn't change, e.g. to 26.7.7_1. Perhaps just an oversight in the heat of battle. Certainly something that can be presumably easily corrected, if necessary.

[FelixLo]

Thanks a lot guys. Was my first update (and upgrade) experience with opnsense and worked just flawlessly!

[bimbar]

Thanks @Franco:
for the fast patch !

[newsense]

Certainly something that can be presumably easily corrected, if necessary.

There's really no need for further action until 26.7.8

[moware]

Just updated succesfully! Thanks to all the people involved getting this fixed soo fast! :)

Indeed, it was great to get a fix so quickly. One small nitpick: The release version didn't change, e.g. to 26.7.7_1. Perhaps just an oversight in the heat of battle. Certainly something that can be presumably easily corrected, if necessary.

It's also a bit confusing that the UI in "System: Firmware" shows "Updated on: Wed Oct 14 04:15:27 CEST 2026" in the "Status" tab, which made me wonder whether the patch had been installed by the nightly cron-job at all.

Fortunately, there's also a "Packages" tab, which shows php85 at version "8.5.12", so everything seems to be fine.

Thanks a lot for the quick patch, OPNsense team!

[keeka]

On a lighter note, BBC just came out with this! "It was supposed to be kept quiet until everyone had a chance to fix their sites - but the news was leaked."

[stefan00]

thanks for the fast patch, Franco :) !

What patch day - I'm done with all servers now.

However, I wish OPNsense additionally had optional http auth. Old stuff compared to todays fancy multi-factor-auth systems, but it would have helped in this particular situation (PHP stack vulnerability).

cheers :)

[s5n]

Thank you for upgrading so quickly.

For me, I run OPNSense on the current community edition latest release. Well, as it happens I am on holiday right now but thought that this is a critical release, and never ever has something gone wrong with OPNSense updates. Soooo, it will be okay to install it via VPN remotly, won't it? Guess....
Of course the OPNSense device is unreachable now. Of course there is nobody at home who has access or even the slightes knowledge to simply switch it off and on again...

I will go to bed now, knowing that my network is safe now because it's simply offline....

There's been no need to reboot for the PHP packages update AFAIC.

 S.

[nero355]

todays fancy multi-factor-auth systems

That crap being forced upon me where I have ZERO need for it is seriously annoying to be honest! :(

I don't want to check my e-mail for a code!
I don't want to involve my phone with logging in somewhere!

Leave me alone...

Not everything is that important for everyone :)

There's been no need to reboot for the PHP packages update AFAIC.

After each update/upgrade the webGUI is restarted so in this case that should be enough : No reboot needed!