You've probably seen in the news the widespread critical PHP vulnerabilities in many websites and systems.
The PHP security advisory can be read here - https://www.php.net/archive/2026.php#2026-10-21-5
I've just been working through all my devices and servers, checking whether I needed to update anything.
I discovered that my fully patched pfSense router was running an out of date and vulnerable version of PHP,
and thought I'd document what I did to ensure it got updated to the latest patched version of PHP.
You need to do all the updating via ssh in the shell command prompt environment.
First ssh into your pfSense, using something like this (using your router's LAN address) -
ssh [email protected]
then enter the password you'd usually use to get into the GUI.
From the menu, select <8> for the Shell environment.
0) Logout / Disconnect SSH 9) pfTop
1) Assign Interfaces 10) Filter Logs
2) Set interface(s) IP address 11) Restart GUI
3) Reset admin account and password 12) PHP shell + pfSense tools
4) Reset to factory defaults 13) Update from console
5) Reboot system 14) Disable Secure Shell (sshd)
6) Halt system 15) Restore recent configuration
7) Ping host 16) Restart PHP-FPM
8) Shell
At the shell prompt, type the following to discover which version of PHP your pfSense is running -
php -version
In my case it was version "PHP 8.3.19"
Depending on which pfSense firmware you are running, you need at least one of these versions -
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Anything lower is still vulnerable
To list all the PHP modules and their versions, type this -
pkg info | grep php
To update PHP to the safe versions, and ensure Wireguard gets to use the correct PHP version, enter all this at the prompt -
pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.reboot
After a couple of minutes of packages being installed, pfSense rebooted and all was well.
Going back into the shell and checking the PHP version, my system now reports as "PHP 8.3.36"
.
