Urgent - Critical PHP Security Update

Hello John,

PHP has announced two critical vulnerabilities in their software which affect pfSense software installations: CVE-2026-109618 and CVE-2026-109619. We strongly encourage users on older versions of pfSense software to upgrade to a current supported release as soon as possible.

Who is Affected?

These issues are only a cause for concern if the pfSense software PHP GUI or Captive Portal service are exposed to potential attackers.

• Users of the Captive Portal service, which is by design typically exposed to untrusted clients, should update PHP as soon as possible.
• Users who do not use Captive Portal and also follow secure practices when configuring firewall rules to limit GUI access are not affected, but should still update when convenient to be safe.

How to Update PHP Packages

We have published updated PHP binary packages for pfSense Plus software versions 26.07 and 26.03.1, along with pfSense CE software versions 2.9.0 and CE 2.8.1.

Read the following guide for three methods you can use to update PHP packages.

© Copyright 2026 Rubicon Communications, LLC
Netgate is a registered trademark of Rubicon Communications, LLC
TNSR is a registered trademark of Rubicon Communications, LLC
pfSense is a registered trademark of Electric Sheep Fencing, LLC
Other trademarks are the property of their respective owners.

Netgate, 4616 W Howard Lane, Suite 900, Austin, TX 78728, USA, +1 (512) 646-4100