PHP2Shell (CVE-2026-109618 en CVE-2026-109619): OPNsense 26.7.7 / 26.4.2p3

[AdSchellevis]

Dear community and business users,

We have just released a hotfix for both the OPNsense Community Edition (26.7.7) and Business Edition (26.4.2p3), addressing two recently disclosed critical PHP vulnerabilities.

The update includes the following PHP version upgrades:

Community Edition 26.7.7: PHP 8.5.12

Business Edition 26.4.2p3: PHP 8.3.36

We strongly recommend installing this security update as soon as possible to ensure your systems remain protected.

Important: Users running the captive portal are advised to restart their captive portal service after installing the update to ensure the security fixes take effect.

Best regards,

Stay safe and open source,

Your OPNsense team

[1] https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
[2] https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp