Victron has pushed out Venus OS v3.85 for its GX devices. It replaces v3.81, which came out on 7 October, and it’s an unusual one: there are no new features, just security fixes.
What v3.85 fixes
According to Victron’s Venus OS team, the release patches three things:
- Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, which PHP patched on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both are memory-handling bugs that can let an unauthenticated attacker run code remotely on a PHP web server, and PHP rates them 9.2 out of 10 (see PHP’s security advisory).
- Compromised intermediate certificates. Victron calls this critical, as it makes man-in-the-middle attacks on https connections possible.
- Node.js issues rated as high.
Victron points out that the PHP and Node.js problems matter less on a boat than on a web server, because an attacker has to be able to reach the GX device first. Most GX units aren’t directly exposed to the internet. Still, Victron’s advice is to patch as soon as possible, and we agree.
Which devices
The v3.85 files are on Victron’s official update feed for every GX platform listed there, including the older CCGX, dated 22 October.
How to install
Online: Settings, General, Firmware, Online updates, then Check for updates. Offline: copy the .swu file for your device from Victron’s update feed to the root of a USB stick or microSD card and use Install firmware from SD/USB. The detailed changelog is on Victron Professional (free login) under Firmware, Venus OS.
Our take
If your GX device is reachable remotely (VRM Remote Console, an open port, or a marina network you don’t control), update now. If it sits on a closed boat network, it’s still worth doing at your next visit. The v3.90 features currently in beta are not part of this release.
Sources
- Victron Community: Venus OS v3.90-beta9 thread, post 9 (22 Oct 2026)
- Victron Venus OS update feed
- Victron Professional firmware page (free login)
- PHP security advisory (21 Oct 2026)
Image courtesy Victron Energy
