PHP2Shell security fix for OPNsense 26.1.x?

[weilander]

Hi Franco,

Thanks for the quick response to the critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

I'm currently running OPNsense 26.1.11_10 and haven't upgraded to 26.7 yet due to compatibility considerations with my existing setup. The upgrade is planned, but I can't carry it out immediately.

Will the PHP security fixes also be made available for installations still running 26.1.x, perhaps as a standalone package update or backport?

I understand that older release branches cannot be maintained indefinitely. However, especially with vulnerabilities of this severity, it would be helpful to have a way to apply essential security fixes without having to perform a major version upgrade at short notice.

Thanks for clarifying!

Cheers,
Michael

[nero355]

I'm currently running OPNsense 26.1.11_10 and haven't upgraded to 26.7 yet due to compatibility considerations with my existing setup.

Which ones exactly ?

[weilander]

Which ones exactly ?

Hi nero355,

I've had some rather unpleasant issues with my OPNsense installation in the past, including a FreeBSD pkg version being installed instead of the expected OPNsense version, resulting in segmentation faults and requiring manual repairs.

I've also experienced issues with the Zenarmor repository and recurring WebGUI problems after restarts, apparently related to Zenarmor.

I'm not claiming that these are confirmed incompatibilities with 26.7. However, given those experiences, I'd prefer to prepare and test the major upgrade carefully rather than rush it.

I do intend to upgrade, but I can't do it immediately.

That's why I was asking whether a standalone PHP security fix or backport might be available for 26.1.x in the meantime.

[newsense]

> I'm currently running OPNsense 26.1.11_10

Then worry not, you have far bigger issues than a couple php vulnerabilities

The only way to patch for you on 26.1 is to switch to the BE edition that is based on 26.1 - but that will only take you to next week when 26.10 BE will land

Take a snapshot and do your updates to 26.7.7. There's no better option and no reason to wait for miracles on unsupported versions

[Labber53]

Can you please patch 26.1.x