26 Oct Critical PHP Security Updates for pfSense
Critical PHP Security Updates for pfSense
Critical PHP vulnerabilities have been identified, affecting pfSense Plus and CE installations. Security updates are now available.
Who is Affected
Users of the Captive Portal service, which is by design typically exposed to untrusted clients, should update PHP as soon as possible.
Users who do not use Captive Portal and also follow secure practices when configuring firewall rules to limit GUI access are not affected, but should still update when convenient to be safe.
We encourage everyone to review their filter rules and confirm the GUI is not accessible from any untrusted networks. Anyone who has exposed their GUI to the Internet or other untrusted networks should update PHP immediately, reconfigure their rules, and only access the GUI by secure means, such as a VPN, in the future.
New PHP Packages Available
Netgate has published updated PHP binary packages for pfSense Plus software versions 26.07 and 26.03.1, along with pfSense CE software versions 2.9.0 and CE 2.8.1.
pfSense Plus software version 26.07, pfSense Plus software version 26.03.1, and pfSense CE software version 2.9.0 should now have PHP 8.5.12
pfSense CE software version 2.8.1 should now have PHP 8.3.36
Updating PHP Packages
These binary package updates cannot be performed using the pfSense software PHP GUI or the Nexus GUI, they must be performed at a command line.
Use one of the following command sets from an SSH or console shell prompt to upgrade PHP and other packages to the latest available versions:
Note that in each of the following methods, the WireGuard package is reinstalled after other packages. This is a necessary step to ensure the WireGuard package is using the correct version of PHP as it may fail to start otherwise. For users performing this upgrade over a WireGuard connection, this is likely to interrupt connectivity during the process.
Method 1 (Best Practice): Update all binary packages and reboot
The best practice is to update all packages and reboot. This will also catch other recent updates that may require restarting additional services
pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.rebootMethod 2: Update all binary packages and restart all web services
This method updates PHP and then restarts both the PHP GUI and the Captive Portal service.
pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.php-fpm_restart && \
/etc/rc.restart_webgui && \
/etc/rc.captiveportal_configureMethod 3: Update all binary packages and Restart the PHP GUI
This method updates PHP and other binary packages then restarts only the PHP GUI. This is safe for users who do not use Captive Portal.
pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.php-fpm_restart && \
/etc/rc.restart_webguiUpgrades and Fresh Installations
We strongly encourage users on older versions of pfSense software to upgrade to a current supported release as soon as possible.
With the updated packages now available in the repository, anyone performing a fresh install, reinstall, or upgrade from an older version to a current release of pfSense software will automatically get the updated PHP packages and will not require additional manual intervention.
If you need assistance applying the latest PHP security updates to your pfSense firewall you can contact our certified pfSense Engineers for professional support and guidance.
Get in touch
Strengthen Your Cybersecurity with ITG
Keeping your firewall updated is just one part of maintaining a strong cybersecurity posture.
Our experienced Cybersecurity Engineers can help your business identify vulnerabilities, strengthen its security defences, and implement effective measures to protect your IT infrastructure against evolving cyber threats.
We also provide professional guidance and support throughout the Cyber Essentials and Cyber Essentials Plus certification processes, helping your organisation meet recognised UK cybersecurity standards and demonstrate its commitment to protecting sensitive information.
