pfSense CE 2.9.0 and Plus 26.07: What Changed

Two pfSense releases dropped this month, and the gap between them tells you almost everything about where the platform is headed. pfSense CE 2.9.0 is a solid, unglamorous maintenance update. pfSense Plus 26.07 is where Netgate is clearly putting its energy, with a new management interface, a rebuilt threat-blocking engine, and DNS tooling that the community edition will never see. If you're running CE and wondering whether that fork is widening into a chasm, the honest answer is: yes, gradually, and it's worth paying attention to.

Tom Lawrence of Lawrence Systems put out a detailed walkthrough of both releases this week, and it's a useful ground-level read from someone who has been deploying pfSense in production environments for years.

What CE 2.9.0 actually delivers

Let me be direct about what's in this release, because the security changes are more meaningful than the patch-note summary suggests.

The headline item is post-quantum key exchange support for SSH. If you're running CE on a small business firewall, this probably sounds abstract. Here's the concrete version: current encryption can be recorded now and decrypted later, once quantum computers are capable enough to break today's algorithms. "Harvest now, decrypt later" attacks are already documented at the nation-state level. The timeline for quantum-capable adversaries is debated, but cryptographers are not debating whether to prepare. Netgate adding post-quantum key exchange to CE means your SSH management traffic is getting future-proofed, and that matters whether your firewall sits in a home lab or in front of a medical practice.

The same release deprecates TLS keys shorter than 2048 bits. This one has an immediate, practical edge: if you're running an older self-signed certificate with a weak key, the system will throw an error after updating. That's a minor annoyance that's also doing you a favor. Weak keys are genuinely exploitable, not theoretically. Generate a new cert, move on.

On that subject, CE 2.9.0 also adds automatic renewal for self-signed TLS certificates, which is a quiet fix for a recurring support headache. Previously, self-signed certs just expired and people noticed when their browser started screaming at them. This is separate from the ACME system that handles Let's Encrypt renewals; it specifically covers the self-signed case. Small thing. Real improvement.

There's also an experimental outbound NAT mode for edge cases where multiple local clients share the same source port against the same remote host. Lawrence flagged this as something the forums have discussed, but noted he hasn't encountered it in practice. I'd treat it the same way: file it, don't deploy it in production yet, watch how it matures.

Netgate's release notes also document cross-site scripting fixes and a patch for a WireGuard vulnerability, CVE-2026-58085, confirmed via the Netgate forum. Lawrence describes the WireGuard fix as "not hair on fire, but definitely things that need to be fixed," which is about right. The update is not optional in any meaningful sense. Run it.

The CE user in 2026

Who is still running CE? Mostly people who need a capable, free, open-source firewall and don't require enterprise-scale management. That's a legitimate use case. Home labs, small offices, budget-conscious IT generalists, and anyone who simply doesn't want to be on a commercial licensing treadmill. CE is not a lesser product for those users; it's appropriately scoped.

The question is whether CE is being maintained or merely sustained. 2.9.0 suggests the latter, not in a damning way, but in a realistic one. The security hygiene is solid. The new features are thin. That's fine if CE is what you need. It starts to matter when you look at what Plus is shipping.

pfSense Plus 26.07: where the development energy went

The centerpiece of Plus 26.07 is the combination of ThreatGate and CoreDNS, which Lawrence describes as "the evolution of pfBlockerNG, redesigned for modern threat landscapes and optimized for performance." Neither is coming to CE.

ThreatGate with CoreDNS handles high-volume block lists efficiently enough to run on modestly resourced hardware, which was a known pain point with pfBlockerNG at scale. Snort version 3 also ships with this release, per the Plus 26.07 release coverage.

The other major piece is the Nexus interface, which is both a new UI and a multi-instance management system. Lawrence walked through it in the video and the verdict is measured but positive: "The new UI is laid out very similar to the old UI, so you're not going to be too lost here... it seems to be completely functional for the usual things you may do in pfSense."

That familiarity is a deliberate design choice, and it's the right one. Gratuitous UI overhauls alienate experienced administrators. Nexus changes the plumbing more than the surfaces. Firewall rules look like firewall rules. VLANs are where you'd expect them. The new services, CoreDNS and ThreatGate, appear in Nexus but not in the legacy interface, which is Netgate's way of signaling which direction the platform is moving without forcing an abrupt migration.

Licensing note for anyone evaluating multi-instance management: each pfSense system you want to manage through Nexus requires a license. Your existing Plus license isn't it; that's a separate cost. You do get one free license to manage the local instance, which covers the single-appliance case. If you're running a fleet, do the math before you commit.

The zero trust egress feature worth understanding

This one caught my attention because it addresses a real attack pattern that is older than most people realize.

CoreDNS in pfSense Plus now supports a zero trust egress mode, which Lawrence describes as "do not talk to strangers." The logic is elegant: when a device on your network communicates with a remote host, it should first resolve that host's name through DNS. If traffic is going directly to a raw IP address without any DNS resolution, that's suspicious. Malware command-and-control infrastructure has historically used bare IP addresses precisely to avoid DNS-based blocking. Legitimate software almost never does.

Zero trust egress mode enforces this expectation at the firewall. Traffic to hosts that haven't been resolved through CoreDNS gets blocked. You can then review the block logs to investigate what's reaching out to IP-only destinations and why.

John Todd, identified in the video as connected to Quad9, actually posted about this concept in the pfSense forums back in 2017. The idea is not new. What's new is that it's now a toggleable feature rather than a manual firewall rule project. Lawrence's point that "old attacks are still happening here in 2026" is fair. The threat this addresses hasn't gone away; the tooling to block it has just gotten more accessible.

The honest picture on coverage

Lawrence is transparent in the video about why his pfSense output has declined: he's consulting less on pfSense deployments and doesn't want to produce lab-only content that lacks real-world grounding. "I really try to bring on this channel real-world use cases for the things I do, not just some lab test." That's a reasonable editorial standard and it's worth knowing as context, not as a signal that pfSense is in trouble.

The platform is not in trouble. What it is doing is differentiating, firmly and intentionally. CE gets security maintenance and occasional improvements. Plus gets the new capabilities. If your use case fits CE, the 2.9.0 update is worth running and the platform serves you fine. If you're evaluating Plus for a more complex environment, the questions to ask Netgate are about the ThreatGate and CoreDNS maturity curve, the multi-instance licensing costs at your scale, and what the legacy UI deprecation timeline actually looks like.

CE users: update, generate new certs if yours are old, and keep an eye on the feature gap. Plus evaluators: get the licensing numbers in writing before you architect around Nexus.

---

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.