Pi-hole has shipped a coordinated security update across all three of its components, fixing five high-severity vulnerabilities alongside a batch of medium and low-severity issues. FTL v6.8, Web v6.6.1, and Core v6.5 are available now, and the Docker image is tagged 2026.10.0. The high-severity fixes address command execution via a crafted PID (GHSA-cf36-4hhc-8398, CVSS 7.8), root writing to config-supplied paths (GHSA-mff6-cjc4-5wq9, CVSS 7.3), a symlink-following bug in the version file writer (GHSA-xch2-4qxw-g5vj, CVSS 7.8), insufficient hardening of /opt/pihole (GHSA-j8vh-6fp9-cjcx, CVSS 7.8), and a Teleporter import flaw that could relocate the document root to / and serve files unauthenticated (GHSA-2h7g-g549-hf74, CVSS 7.7). Medium-severity fixes cover authenticated file reads through file:// adlists, password hash exposure via read-only app sessions, an out-of-bounds write in the API TXT buffer, and EDNS(0) data leaking between clients.
Beyond the security work, FTL v6.8 brings meaningful performance gains for users running Pi-hole on single-board computers or in containers. The live log now uses a ring buffer instead of shifting the entire buffer on every new line, cutting CPU cost per cached answer. Long-term statistics queries are grouped before joining name tables, and two unused in-memory indexes have been dropped, saving roughly 22 MB per million queries. A notable fix for ARM and RISC-V boards means MAC addresses for new devices are now looked up at query time, so MAC-based group policies apply immediately rather than only after the next list reload. For anyone running Pi-hole in Docker or LXC, the load calculation has been corrected to count all host CPUs rather than just the container's allocated cores, which previously caused spurious high-load warnings and inflated load percentages in /api/info/system.
Core v6.5 also overhauls the gravity database schema for better performance, adding WITHOUT ROWID junction tables, new indexes for group lookups, and cheaper triggers. Existing databases migrate automatically to schema version 21 on update. The embedded dnsmasq has been updated to v2.93+30 and SQLite to v3.53.3. Privilege handling has been tightened throughout: gravity.sh now re-executes as the pihole user, the update checker and FTL prestart scripts no longer create or chmod files in /etc/pihole as root, and CAP_CHOWN is no longer granted to everything pihole-FTL executes.
Self-hosters should back up their configuration with Teleporter before updating, either through Settings in the web interface or by running pihole-FTL --teleporter. One behavior change worth noting: queries older than database.maxDBdays are now purged in the first night after a start, 10,000 at a time, so a database that had been growing unchecked will lose its excess backlog on the first night after updating. The update itself is the usual pihole -up.
