PHP2Shell security fix for OPNsense 26.1.x?

[weilander]

Hi Franco,

Thanks for the quick response to the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

I'm currently running OPNsense 26.1.11_10 and haven't upgraded to 26.7 yet due to compatibility considerations with my existing setup. The upgrade is planned, but I can't carry it out immediately.

Will the PHP security fixes also be made available for installations still running 26.1.x, perhaps as a standalone package update or backport?

I understand that older release branches cannot be maintained indefinitely. However, especially with vulnerabilities of this severity, it would be helpful to have a way to apply essential security fixes without having to perform a major version upgrade at short notice.

Thanks for clarifying!

Cheers,
Michael

[nero355]

I'm currently running OPNsense 26.1.11_10 and haven't upgraded to 26.7 yet due to compatibility considerations with my existing setup.

Which ones exactly ?

[weilander]

Which ones exactly ?

Hi nero355,

I've had some rather unpleasant issues with my OPNsense installation in the past, including a FreeBSD pkg version being installed instead of the expected OPNsense version, resulting in segmentation faults and requiring manual repairs.

I've also experienced issues with the Zenarmor repository and recurring WebGUI problems after restarts, apparently related to Zenarmor.

I'm not claiming that these are confirmed incompatibilities with 26.7. However, given those experiences, I'd prefer to prepare and test the major upgrade carefully rather than rush it.

I do intend to upgrade, but I can't do it immediately.

That's why I was asking whether a standalone PHP security fix or backport might be available for 26.1.x in the meantime.

[newsense]

> I'm currently running OPNsense 26.1.11_10

Then worry not, you have far bigger issues than a couple php vulnerabilities

The only way to patch for you on 26.1 is to switch to the BE edition that is based on 26.1 - but that will only take you to next week when 26.10 BE will land

Take a snapshot and do your updates to 26.7.7. There's no better option and no reason to wait for miracles on unsupported versions

[Labber53]

Can you please patch 26.1.x

[nero355]

I've had some rather unpleasant issues with my OPNsense installation in the past, including a FreeBSD pkg version being installed instead of the expected OPNsense version, resulting in segmentation faults and requiring manual repairs.

I've also experienced issues with the Zenarmor repository and recurring WebGUI problems after restarts, apparently related to Zenarmor.

I'm not claiming that these are confirmed incompatibilities with 26.7. However, given those experiences, I'd prefer to prepare and test the major upgrade carefully rather than rush it.

I understand where you are coming from, but AFAIK none of those issues should happen now :
- FreeBSD pkg issues are mainly caused by the wrong repositories being enabled.
- The version of pkg in OPNsense has recently been upgraded.
- ZenArmor is now compatible with version 26.7.x for a long time from what I have seen in their sub-forum.

So in theory there shouldn't be any issues as long as you :
- Make sure you migrate Firewall and NAT Rules in advance.
- Disable Intel CPU Micro Code injection before upgrading to 26.7.x in case you are using it.
- Upgrade your FreeBSD Boot Loader after the first OPNsense 26.7.x upgrade step.
After the last two steps you can then choose to Enable either Early or Late Intel CPU Micro Code injection.
The Late injection option was added in 26.7.x when this bug appeared for people not wanting/knowing how to update their FreeBSD Boot Loader but I suggest to do it anyway!
Easpecially when running in UEFI Boot Mode it's super easy :)


Good luck!