Many of our clients are running pfSense firewall appliances (both virtual and physical) that are impacted by the vulnerability. If you are running a pfSense virtual or physical appliance, it is crucial that you mitigate or eliminate exposure to this vulnerability being exploited. We recommend that you take the following actions immediately:
Opti9 is aware of recently disclosed PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which may allow remote code execution under certain conditions.
Our engineering teams are actively reviewing all infrastructure components and implementing appropriate mitigations and patches to address the CVE. In parallel, we are coordinating with our vendors and contractors to ensure any required remediation is identified and addressed.
If any of your applications use PHP, we strongly recommend reviewing them as soon as possible. If you are unable to patch promptly, we recommend considering whether the affected application should be taken offline until it can be updated.