FreeSense 1.1.10: update now, two critical PHP vulnerabilities are fixed
A Stable security patch. PHP 8.5.12 fixes CVE-2026-109618 and CVE-2026-109619, two critical remote code execution flaws in PHP itself. It also hardens the WebUI, updates HAProxy to 3.4.7 and fixes two smaller problems.
FreeSense 1.1.10 is a Stable security patch. The PHP project fixed two critical vulnerabilities on 21 October 2026, and 1.1.10 ships the fixed PHP. Update promptly.
The PHP vulnerabilities
- CVE-2026-109618: memory left in an invalid state when a request runs out of memory early, for example during a crafted multipart upload.
- CVE-2026-109619: state left over from a finished request that a later request on the same worker can reach.
The PHP project rates both as critical (CVSS 4.0 score 9.2) and says they can allow remote code execution without logging in. It says updating PHP is the only complete mitigation. The FreeSense WebUI runs PHP-FPM behind nginx; the PHP advisories describe a demonstrated exploit only for Apache's mod_php and say PHP-FPM is affected under some conditions, so do not rely on that. FreeSense 1.1.9 and earlier ship PHP 8.5.11, which is affected.
Until you can update, do not expose the WebUI to the internet. Management access should be limited to trusted networks.
Development 1.2 ships the same PHP 8.5.12 since build 1.2.0-dev.20261020.1792754032, published on 23 October. Development is experimental and unsupported. FreeSense 1.0 is frozen and receives no fix: upgrade to 1.1 (the upgrade is one-way, so read Upgrading from 1.0 first).
What else is in 1.1.10
- WebUI hardening from our security audit: XML-RPC code execution is limited to the admin user, captive portal file names and CSRF checks are tightened, disconnecting a client from the Captive Portal widget is a CSRF-checked POST, stored data is no longer unserialized into objects, and old password hashes are upgraded to bcrypt at the next login.
- HAProxy 3.4.7 (Optional package, from 3.4.2) fixes buffer overflows in JWT and JWE handling, HTTP/2 and HTTP/3 framing problems that could be used for request smuggling, and a number of crashes.
- VXLAN multicast tunnels with a non-default local port work.
- Cloud images keep an administrator's password when the cloud configuration is applied again.
How to update
Systems on 1.1.0, 1.1.5 and 1.1.9 update from System → Update as usual; update the Optional Packages afterwards so HAProxy gets its fix. Systems on 1.1.1 to 1.1.4 need one console command first. Every release is upgrade-tested on a virtual machine before it is published. FreeSense 1.1.9 is not withdrawn; it works, but it carries the vulnerable PHP.
Download FreeSense 1.1.10 or read the full release notes. The advisories that apply to each release are listed on security.freesense.org.