pfSense critical PHP vulnerabilities

ExForce9 — Fri, 23 Oct 2026 00:24:05 GMT

You've probably seen in the news the widespread critical PHP vulnerabilities in many websites and systems.

The PHP security advisory can be read here - https://www.php.net/archive/2026.php#2026-10-21-5

I've just been working through all my devices and servers, checking whether I needed to update anything.

I discovered that my fully patched pfSense router was running an out of date and vulnerable version of PHP,

and thought I'd document what I did to ensure it got updated to the latest patched version of PHP.

You need to do all the updating via ssh in the shell command prompt environment.

First ssh into your pfSense, using something like this (using your router's LAN address) -

ssh admin@192.168.1.1

then enter the password you'd usually use to get into the GUI.

From the menu, select <8> for the Shell environment.

0) Logout / Disconnect SSH 9) pfTop 1) Assign Interfaces 10) Filter Logs 2) Set interface(s) IP address 11) Restart GUI 3) Reset admin account and password 12) PHP shell + pfSense tools 4) Reset to factory defaults 13) Update from console 5) Reboot system 14) Disable Secure Shell (sshd) 6) Halt system 15) Restore recent configuration 7) Ping host 16) Restart PHP-FPM 8) Shell

At the shell prompt, type the following to discover which version of PHP your pfSense is running -

php -version

In my case it was version "PHP 8.3.19"

Depending on which pfSense firmware you are running, you need at least one of these versions -

8.5.12
8.4.27
8.3.36
8.2.35

Anything lower is still vulnerable

To list all the PHP modules and their versions, type this -

pkg info | grep php

To update PHP to the safe versions, and ensure Wireguard gets to use the correct PHP version, enter all this at the prompt -

pfSense-upgrade -c && \ pkg upgrade -y && \ pkg upgrade -fy pfSense-pkg-WireGuard && \ /etc/rc.reboot

After a couple of minutes of packages being installed, pfSense rebooted and all was well.

Going back into the shell and checking the PHP version, my system now reports as "PHP 8.3.36"

topic pfSense critical PHP vulnerabilities in Tech Help - Software/Hardware etc

pfSense critical PHP vulnerabilities