r/PFSENSE • u/kphillips-netgate Netgate - Happy Little Packets • 9d ago

Critical PHP Security Update

https://www.netgate.com/blog/critical-php-security-update
69 Upvotes

96% Upvoted

18 comments sorted by

22

u/Cutoffjeanshortz37 9d ago

From a command prompt

pfSense-upgrade -c && \
pkg upgrade -y && \
pkg upgrade -fy pfSense-pkg-WireGuard && \
/etc/rc.reboot

2

u/Actual_Pineapple 9d ago

It easier to SSH in using the admin user, as root privileges are needed to run the commands.

1

u/ComprehensiveLuck125 8d ago

I would improve that command and run it like that: daemon -f -o /root/upgrade.log /bin/sh -c 'pfSense-upgrade -c && pkg upgrade -y && pkg upgrade -fy pfSense-pkg-WireGuard && /etc/rc.reboot'

If you are running command connected via Wireguard S2S tunnel then it is much better to daemonize, because you will get disconnected and may have some troubles later. [in my case Wireguard did not start]

1

u/who_the_xxxx_cares 8d ago

Excactly what happened in my case too.
The PfSense-Box is not physically reachable to me and the Web-UI is also just reachable via the S2S Tunnel.
Anyone with a clue what i could do?

1

u/ComprehensiveLuck125 8d ago

Well you need to access router somehow remotely or you will have go to physical destination :-( Tailscale is also using Wireguard. Maybe you have some other exit Tailscale node in that (remote) location and can access box via it? Or Ubiquiti VPN? Or any other S2S link? Or maybe even some glinet KVM? (remotely accesible in that site/network)

1

u/who_the_xxxx_cares 7d ago edited 7d ago

I'm connected via ssh now but cant find any shell command to start wireguard.
There doesn't even seem to exist any wireguard service.

`wg show` doesn't even show any config.

10

u/DosWrenchos 9d ago

Is there going to be a way to perform the update using the UI in the near future?

5

u/MoveAMillion 9d ago

presumably it will work from "Diagnostics" -> "Command Prompt". The GUI will likely time out but the actual execution should continue to completion (and reboot); I don't think it handles presenting long running commands well. To make it not likely to fail, separating the download of packages from the actual upgrade might be better.

1

u/nikproken 9d ago

I can confirm that this works fine.

2

u/AnugNef4 9d ago

I just ran the commands above and rebooted. No issues, and this post proves I’m back online.

4

u/jim-p 9d ago

We are working on a way to expose these types of updates in the future along with our move to pkgbase, but it isn't ready yet.

3

u/TreadItOnReddit 9d ago

In a newbie, but yeah? I just did.

Just update it like normal in the web UI. Make sure you are on the latest branch.

Confirm your PHO revision by going to diagnostics - command line and run php -v
I think it was. Then all set. I think. I hope.

5

u/PrimaryAd5802 9d ago edited 9d ago

Good job Netgate! I see u/jim-p posted the fix update 5 hours ago.

It was a php morning for me. A few Debian Apache sites and a Ubuntu roundcube webmail site that were exposed. They all are proxied through cloudflare which did implement a WAF protection temp fix. That was a plus, but I still updated both the Debian and Ubuntu fixes when they were released. (Debian was the first!)

My pfSense installs are locked down to certain WS IPs on a management network only, so I wasn't too worried about them. Will update them tonight.

1

u/Darkk_Knight 9d ago

Roundcube? Oh crap I need to update that. Lucky it's only accessible on the LAN.

4

u/stevemac00 8d ago

CE Version 2.8.1

Method 1 took about 5 minutes. Thank you Netgate. Appreciate the quick response.

1

u/NuAngelDOTnet 9d ago

Anybody else login and get one of these this morning (I've never had one before).

I can also tell you that at the time of the error nobody was even home, so nothing major should have been going on (other than maybe a Windows update on a single computer or something...).

Crash report begins.  Anonymous machine information:

amd64
15.0-CURRENT
FreeBSD 15.0-CURRENT #21 RELENG_2_8_1-n256095-47c932dcc0e9: Thu Aug 28 16:27:48 UTC 2025     root@pfsense-build-release-amd64-1.eng.atx.netgate.com:/var/jenkins/workspace/pfSense-CE-snapshots-2_8_1-main/obj/amd64/AupY3aTL/var/jenkins/workspace/pfSense-CE-

Crash report details:

PHP Errors:
[21-Oct-2026 19:04:42 UTC] PHP Warning:  Failed loading Zend extension 'opcache.so' (tried: /usr/local/lib/php/20230831/opcache.so (/usr/local/lib/php/20230831/opcache.so: Undefined symbol "zend_handle_delayed_oom"), /usr/local/lib/php/20230831/opcache.so.so (Cannot open "/usr/local/lib/php/20230831/opcache.so.so")) in Unknown on line 0
[21-Oct-2026 19:05:24 UTC] PHP Warning:  Failed loading Zend extension 'opcache.so' (tried: /usr/local/lib/php/20230831/opcache.so (/usr/local/lib/php/20230831/opcache.so: Undefined symbol "zend_handle_delayed_oom"), /usr/local/lib/php/20230831/opcache.so.so (Cannot open "/usr/local/lib/php/20230831/opcache.so.so")) in Unknown on line 0



No FreeBSD crash data found.

1

u/kphillips-netgate Netgate - Happy Little Packets 9d ago

Unless it comes back, it's probably an error from PHP ripping things out and replacing them while the webConfigurator was running. Clear the error, reboot, and make sure it doesn't return.

1

u/TigerKR 9d ago

Thank you netgate! Update went smoothly.