Peplink router firmware 8.6.1 went generally available on 30 September 2026. Peplink says the GA build is the same as 8.6.1 RC 2 from 18 September, so a router already on RC 2 does not need another upgrade. This is a fix release on top of 8.6.0, not a new feature train. If you are on 8.5.4 and the hardware is on the 8.6.1 list, this is the build we take.
Should you leave 8.5.4?
Yes, when the exact model and hardware revision is on Peplink’s 8.6.1 supported list. 8.5.4 was the staging stop we used so fleets were not jumping from 8.2, 8.3 or 8.4 straight into 8.6.0. That stop is done. 8.6.1 already contains 8.6.0 (SpeedFusion Boost, SpeedFusion Score, the Starlink health-check work) plus the special builds Peplink shipped afterwards as 8.6.0s019, s033, s080 and the rest. There is no reason to land on 8.6.0 GA and upgrade again a week later.
- On 8.6.1 RC 2. Leave it. GA is that build.
- On 8.6.0. Move to 8.6.1 in a maintenance window. The GPS-in-InControl bug, several SpeedFusion drops, Wi-Fi 6 issues and a set of cellular carrier fixes are in this release.
- On 8.5.4. Move to 8.6.1 if the datasheet hardware revision is listed. Export the config, confirm the Care plan state in InControl, and watch the WAN graph through the first handover.
- On 8.2, 8.3 or 8.4. Do not jump to 8.6.1. Stage through 8.5.4 first, then 8.6.1. Same playbook as the 8.6.0 note.
- Not on the 8.6.1 device list. Stay on the 8.5.x train. Peplink’s download page still offers 8.5.x for some older Balance revisions. We do not force those.
One exception. After RC 2, Peplink confirmed that a Dome Wi-Fi AP in Synergy mode can fail to hand out an IP address, and that the fix is the next release, not 8.6.1. If that is how the boat or site is built, test one unit or wait. Other Synergy fixes in this build still stand.
What is new
- Starlink event log. Status, Event Log, Orbit WAN tab shows Starlink events. Balance, EPX, PDX, SDX, Dome, MBX, BR, Transit, B One, MediaFast, UBR. Not FusionHub.
- Starlink Inhibit RF. Control to inhibit the dish RF, on Dome Pro Duo and Pro LR, BR1 IP55, BR1 Pro, BR1 Pro 5G, BR2 Pro, EPX, PDX and FusionHub.
- Starlink GPS. The status message now says when the subscription is what blocks GPS, and the dashboard only shows “GPS unavailable” when Starlink GPS is actually enabled and no Starlink WAN has a fix.
- Starlink dish API. LAN access to the dish API no longer requires a Care plan.
- Synergy without a Care plan. Synergy Controllers and synergized devices no longer need a Care plan or a licence for Synergy mode. Synergized devices can also connect over USB Ethernet WAN.
- IPv6 on selected cellular. Balance 20X, 310 5G, 310 Fiber 5G, 310X, 380X, 580X, BR1 Pro, BR1 Pro 5G, BR2 Pro, Transit Pro E, B One Plus, B One 5G, plus listed LTE region codes on SDX, Dome and MBX.
- PrimeCare Secure DNS on any device with an active Care plan, not only the previous subset.
- WINS server is back on certain models, including B One, BR1 Mini, BR1 Pro, BR2 Pro, Orbit, MBX, Transit and UBR. A forum note on the beta says InControl still cannot switch it on from LAN network settings, so check the local web admin.
- GPIO. Digital output in WAN Status mode can be inverted, on EPX with the EXM-LCDT module.
- Docker. Container memory uses one shared limit instead of a limit per container.
- IPv6 LAN. Router advertisement intervals and lifetimes follow what the ISP provides.
Security
- Firmware uploads check authentication and the request more strictly.
- Hardening against remote code execution through API requests.
- Security advisories closed in the DHCP client hostname handling, Web Admin access control, and the management CLI.
- Device API input validation on configuration.
- InControl can apply feature activation keys even when the router is restricted to status reporting only.
Those are the reason we do not leave a fleet that is allowed onto 8.6 sitting on 8.5.4 once 8.6.1 is GA.
SpeedFusion and WAN
- SpeedFusion Boost no longer drops traffic to ports 80, 2222, 5000 and 44444, or from clients on the FusionHub LAN.
- SpeedFusion no longer drops IP-fragmented UDP on the receiving side.
- SpeedFusion no longer drops a flow after the sending peer restarts the packet sequence.
- SpeedFusion Score per-WAN tests work when the tunnel includes a standby WAN.
- SpeedFusion Connect tunnels no longer drop large packets.
- WAN health checks now use Google, Cloudflare and Quad9 as the public DNS targets. A WAN that used to pass on the old target can fail on these, or the reverse. Watch the first hour after the upgrade.
- DNS-O-Matic is gone from Dynamic DNS. The service is being discontinued. If a WAN was updating through it, point that record somewhere else before you upgrade.
Fixes that matter on GMTS kit
- GPS in InControl. 8.6.0 GA stopped some routers showing a fix in InControl 2 when the fix came from the cellular module. The local dashboard was fine. Peplink’s special build 8.6.0s019 is rolled into 8.6.1. This hits some MAX BR, Transit, Balance 20X and UBR Plus units.
- B One USB. B One and B One Plus could crash after a USB reset.
- Balance 310 HW5. Tagged VLAN multicast could be dropped when every LAN port was Trunk Any.
- Balance 310 5G HW3. Untagged LAN traffic could drop after a reboot when VLAN access ports were set. InControl 2 could also show PoE against the wrong port number on 310 5G HW3, 580X HW2, BR1 IP55, Transit Pro E, Orbit 8, PDX, SDX, Dome and MBX.
- Balance 1350 EC HA. Both units could come up as HA master after a reboot with LACP on the SFP ports.
- Cellular. Slow registration on Vodafone Italy. 5GD failing to switch carrier profile. IMS left on for 5GK on a private network. LTEA-K failing to get IPv4 on Optus. LTEA-Q failing to connect on KDDI in Japan. LTE-E, LTE-US, LTE-MX and LTE-MXS firmware upgrades failing on RAMIPS models that were on 8.6.0.
- Wi-Fi 6. Clients roaming between SSIDs on the same radio. Air-monitor settings disappearing after the move to 8.6.0, on BR1 Pro, BR2 Pro, Orbit 2 and 4, Dome, Transit and B One.
- Wi-Fi WAN. Failing to roam back to a Fast Transition access point after it had associated to one without Fast Transition.
- Synergy. The controller now follows its enable setting. Wi-Fi clients could fail to get an address when one controller ran several synergized devices; that specific case is fixed. BR1 Mini could not form Synergy while the controller still had the default admin password and LAN IP. The Dome Wi-Fi AP case above is not fixed.
- LAN. Bonjour forwarding advertising client-network services back onto the service network. DHCP conflict detection storing a blank MAC. UDP and Bonjour forwarding failing between VLANs with similar IDs.
- FusionHub. FIPS can be enabled again. InControl remote web admin works with FIPS on and Remote Assistance off.
- Other. GPS forwarding no longer emits malformed TAIP LN sentences. Repeated SNMP GPS queries no longer leak memory. CLI SSH starts after you enable it. Heavy client-recognition traffic no longer knocks InControl offline. Balance 580X front panel no longer clips long text. RAMIPS Ethernet can link at 100 Mbps with Energy Efficient Ethernet on. Transit Duo Pro port settings no longer label a WAN port as LAN. Docker storage is cleared by a factory restore on devices that have no other MediaFast storage. QoS initialisation no longer reboots the router.
How we apply it
- Match the model and hardware revision to the supported list in the release notes. If it is not listed, stop.
- Export the config. Note Dynamic DNS. Remove DNS-O-Matic if it is in use.
- If the router is on 8.2, 8.3 or 8.4, upgrade to 8.5.4 first and confirm WAN and SpeedFusion before 8.6.1.
- Push 8.6.1 from InControl, or from the local web admin, in a window. Do not upgrade a boat that is underway on the only path.
- After it comes back, check SpeedFusion Score, the WAN graph, and a Starlink handover if there is a dish. On a Synergy Dome Wi-Fi AP, check that clients actually get an address.
Sources: Peplink 8.6.1 GA announcement (30 September 2026), 8.6.1 release notes (30 September 2026), RC 2 forum thread for the open Dome Synergy Wi-Fi issue.
