OPNsense Firewall Update Addresses Multiple Security Issues and Enhances Features

OPNsense has released version 25.7.7, delivering critical security improvements and performance enhancements to strengthen enterprise firewall deployments. The update removes unsafe shell-execution patterns in the backend, notably eliminating the exec() function to reduce the attack surface for command injection. It also remediates a previously unknown vulnerability in the RRD backup code disclosed by security researcher Alex Williams from Pellera Technologies alongside the Trend Zero Day Initiative.

Additional hardening includes applying file_safe() functions across critical components such as the gateway monitor watcher and the mechanism for writing the OpenVPN certificate revocation list file, preventing path-traversal and file-manipulation attacks. The release also enhances firewall live logging with a more efficient rendering engine, configurable table and history limits, and improved handling of in-flight host-resolution requests.

Critical third-party updates accompany the release, including Suricata 8.0.2, StrongSwan 6.0.3, Unbound 1.24.1, PHP 8.3.27, and libxml 2.14.6, with a hotfix 25.7.7_2 already issued to address a high availability synchronization regression. Organizations are urged to update to benefit from these security enhancements, and forthcoming 25.7.x features such as a neighbour watch daemon for IPv6, an NDP proxy plugin, and community themes are anticipated. 7 November 2025