Critical PHP Security Update

PHP has announced two critical vulnerabilities in their software which affect pfSense software installations: CVE-2026-109618 and CVE-2026-109619. 

Who is Affected

These issues are only a cause for concern if the pfSense software PHP GUI or Captive Portal service are exposed to potential attackers. By default, the pfSense software PHP GUI is only accessible from the local private network (LAN), not from the Internet (WAN). The Captive Portal service is not active by default.

Users of the Captive Portal service, which is by design typically exposed to untrusted clients, should update PHP as soon as possible.

Users who do not use Captive Portal and also follow secure practices when configuring firewall rules to limit GUI access are not affected, but should still update when convenient to be safe.

We encourage everyone to review their filter rules and confirm the GUI is not accessible from any untrusted networks. Anyone who has exposed their GUI to the Internet or other untrusted networks should update PHP immediately, reconfigure their rules, and only access the GUI by secure means, such as a VPN, in the future.

New PHP Packages Available

We have published updated PHP binary packages for pfSense Plus software versions 26.07 and 26.03.1, along with pfSense CE software versions 2.9.0 and CE 2.8.1.

pfSense Plus software version 26.07, pfSense Plus software version 26.03.1, and pfSense CE software version 2.9.0 should now have PHP 8.5.12

pfSense CE software version 2.8.1 should now have PHP 8.3.36

Updating PHP Packages

These binary package updates cannot be performed using the pfSense software PHP GUI or the Nexus GUI, they must be performed at a command line.

Use one of the following command sets from an SSH or console shell prompt to upgrade PHP and other packages to the latest available versions:

Note that in each of the following methods, the WireGuard package is reinstalled after other packages. This is a necessary step to ensure the WireGuard package is using the correct version of PHP as it may fail to start otherwise. For users performing this upgrade over a WireGuard connection, this is likely to interrupt connectivity during the process.

Method 1 (Best Practice): Update all binary packages and reboot

The best practice is to update all packages and reboot. This will also catch other recent updates that may require restarting additional services.

# pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.reboot

Method 2: Update all binary packages and restart all web services

This method updates PHP and then restarts both the PHP GUI and the Captive Portal service.

# pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.php-fpm_restart && \
/etc/rc.restart_webgui && \
/etc/rc.captiveportal_configure

Method 3: Update all binary packages and Restart the PHP GUI

This method updates PHP and other binary packages then restarts only the PHP GUI. This is safe for users who do not use Captive Portal.

# pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.php-fpm_restart && \
/etc/rc.restart_webgui

Upgrades and Fresh Installations

We strongly encourage users on older versions of pfSense software to upgrade to a current supported release as soon as possible.

With the updated packages now available in the repository, anyone performing a fresh install, reinstall, or upgrade from an older version to a current release of pfSense software will automatically get the updated PHP packages and will not require additional manual intervention.