IPFire opens Core Update 206 to testing with WIO command-injection fixes
IPFire's next core update is now open to public testing. And yes, the project has a reason to worry you right now, not the least of which is a pair of command-injection holes sitting in its built-in "Who Is Online" monitoring add-on. The lead developer, Michael Tremer, put CU206 into the testing channel. It's not stable yet. You're being asked to test it, break it, and report back.
The translation story is the one you can't actually see. The security fixes are the ones you should. IPFire asks WIO users to install this one fast, the rest can wait for the stable bump.
The language overhaul
For years IPFire ran its own home-grown localization system. The web interface's messages got chopped into fragments and stitched back together in code. The result was sentences that fell apart and the same term spelled differently on two different screens. Contributing a translation meant knowing Git and setting up tooling.
Not anymore. CU206 moves IPFire onto GNU gettext, the de-facto standard used by basically every major open-source project, and funnels all translation work through a dedicated Weblate instance at translate.ipfire.org.
Open a browser. Pick a language. Translate whole sentences instead of jumbled fragments. No Git. No local setup.
"If you're keeping score," community contributions already started arriving within weeks, Tremer said, pointing to live work in Croatian, Danish, Dutch, French, German, Hungarian, Italian, Japanese, Persian, Polish, Brazilian Portuguese, Romanian, Russian, Spanish, Swedish, and Turkish. "Even fixing a single string helps," he added.
The installer picks up the shift too. Hungarian, Romanian, and Swedish are newly available. Portuguese is now Brazilian Portuguese, which is far more complete than the old generic entry. Languages with almost nothing in them have been temporarily yanked from the installer and will come back once they're translated. The installer image is smaller now, compressed with zstd and stripped of graphics drivers it never uses.
Why the translation thing matters more than you'd think
It's easy to dismiss localization as a "nice-to-have" that doesn't belong in a security-release discussion. IPFire deliberately disagrees.
"A firewall is only as good as the person running it, and that person should be able to understand every setting and every warning in their own language," Tremer said.
That's a fair point. Misread a warning. Misconfigure a rule because it came through as awkward machine-translated English. On a security appliance, those aren't typos. They're operational risk.
The part you should care about
The WIO command-injection flaws are the headline here. WIO is a built-in service that watches which devices are connected to your local network and can fire off alarms. It's deeply embedded in IPFire's web server, which makes it an attractive target.
CU206 patches two command-injection vulnerabilities that would have let an attacker run shell commands as the web-server user. That's a bad spot to be in. Unsanitized user input handed to a shell, running with the privileges of the service, usually means the firewall is gone.
"We recommend that all users of WIO install this update as soon as possible," the team said.
Here's the more interesting bit, though. Beyond patching two specific holes, IPFire took a bigger step: the web UI no longer spawns a shell at all. It stopped launching a shell to run commands, read files, or find processes. You can patch injection points one at a time forever. You can also just remove the whole mechanism and close off an entire class of vulnerabilities before they're even found. That's designing security in rather than bolting it on.
Alongside that, IPFire has removed root certificates known to be compromised from the certificate store. Stale trust anchors quietly undermine the whole TLS chain, and this pairs with the ca-certificates 20260909 update. It's a smaller change but the kind of housekeeping that quietly keeps things honest.
Two more worth mentioning. The IPS no longer tries to inspect ESP traffic, the protocol that encrypts IPsec tunnels, since inspecting encrypted payloads was just wasted CPU and a source of false signals. And the DNS resolver's outgoing access is now restricted to DNS ports, a small defense-in-depth move that shrinks the blast radius if the resolver process ever falls under attacker control.
The rest
There's a standard wide-ranging package refresh riding along. OpenSSL is at 3.6.5, OpenSSH at 10.5p1, glibc at 2.44, Suricata at 8.0.8, systemd at 261.3, and strongSwan at 6.1.0, plus binutils, coreutils, and a long tail of smaller bumps. strongSwan 6.1.0 drops its gcrypt plugin, so check that your IPsec config isn't leaning on it.
There's also a piece of release-housekeeping trivia worth knowing. CU206 is renumbered content. The translation and security changes were originally slated for Core Update 205, but an emergency update had to slip into the sequence first. That pushed everything to CU206, and now both a CU205 and a CU206 exist as separate nightly development builds. It's slightly confusing. It's also how the project keeps critical patches moving fast.
Then there's LoongArch. CU206 marks IPFire's build for the architecture, making it the fourth 64-bit IPFire supports after x86-64, ARM, and RISC-V. The port came thanks to a hardware gift from China's Loongson Hobbyists' Community, a machine built around a Loongson 3A6000-HV processor on a Loongson XA61200 motherboard.
It sounds like academic novelty. But it proves the build is clean. Running on four architectures stresses the toolchain and confirms IPFire doesn't quietly depend on one host's quirks, which is itself a security feature. Practical upside? The LoongArch box is now IPFire's fastest build server, finishing a full build in just over two hours. Compare that to roughly seven hours on real RISC-V hardware and a painful 54 to 56 hours under emulation. Tremer calls it "the easiest port yet."
Try it, then report back
This is the testing channel, so treat it like a sandbox. Back up first. Don't test on your production firewall.
Get the build through the Nightly Builds area at nightly.ipfire.org. In the web UI's update settings, point the repository at Testing and refresh, and the CU206 update becomes available. Report anything broken at bugzilla.ipfire.org.
IPFire is an unusual project in a category dominated by pfSense and OPNsense. It runs as a dedicated appliance built from source, it has no investors and no paid tiers, and it leans hard on transparency as a security feature. CU206 fits that shape: it hardens the web interface, broadens who can actually use it, and extends the hardware it can run on. It's a security-relevant update wearing a translation update's outfit. Worth testing on a throwaway box.
Head here to the release nodes.
