Back Community.Fortinet

Using the FortiGate to protect against PHP vulnerabilities CVE-2026-109618 and CVE-2026

Community.Fortinet • October 23, 2026

This article discusses the recent critical-severity vulnerabilities for PHP ( CVE-2026-109618 and CVE-2026-109619 , published 2026-10-21) and how the FortiGate can protect affected services until they can be patched.

FortiGate, IPS, OT Virtual Patch;

Important: Refer to the PSIRT Advisory FG-IR-26-186 regarding the above two CVEs and how they relate to Fortinet products. At the time of this writing, FortiOS itself is not impacted by these PHP-specific CVEs. Instead, this article discusses how the FortiGate can be used to protect other services that do use PHP.

At this time, Fortinet has released both IPS signatures and Operational Technology (OT) Virtual Patching signatures for both of the above CVEs. For more information on these signatures, refer to the following entries on the FortiGuard Labs encyclopedia:

CVE-2026-109618 PHP.longjmp.Remote.Code.Execution (OT Virtual Patch) PHP.longjmp.Remote.Code.Execution (IPS)

PHP.longjmp.Remote.Code.Execution (OT Virtual Patch)

PHP.longjmp.Remote.Code.Execution (IPS)

CVE-2026-109619 PHP.stale.global.state.Remote.Code.Execution (OT Virtual Patch) PHP.stale.global.state.Remote.Code.Execution (IPS)

PHP.stale.global.state.Remote.Code.Execution (OT Virtual Patch)

PHP.stale.global.state.Remote.Code.Execution (IPS)

Note: Check the above FortiGuard entries for information on the specific database version that introduces support for the associated signatures, then check the FortiGate to ensure that it has updated to a matching or later database version (no firmware updates required). At the time of this writing, support was added as of the following versions:

OT Patch Definitions: 37.316

(IPS) Attack Definitions and Attack Extended Definitions: 37.317

Once the databases are updated on the FortiGate, the signatures can be checked under Security Profiles -> IPS Signatures :

Finally, ensure that the new signatures are loaded into an IPS sensor or Virtual Patching Profile and then assigned to an appropriate Firewall Policy to begin inspecting traffic being sent to your potentially-vulnerable web servers. For more info on configuring IPS sensors and Virtual Patching profiles, refer to the following documentation:

Configuring an IPS sensor

OT virtual patching basic examples

Important: at the time of this writing, the default action of the IPS-based signatures is set to Pass (OT Virtual Patch signatures do not include default actions and follow the Action set within the Virtual Patching profile).

When adding the signatures to an IPS sensor via rule entries, administrators must change the Action from Default to Block (suggested) , Reset, or Quarantine in order to deny the matching traffic:

Additionally, consider that SSL Deep Inspection may be required to completely inspect traffic, particularly when forwarding encrypted HTTPS traffic. See also:

Protecting an SSL server (FortiGate as an SSL terminator/reverse-proxy)

OT Virtual Patching requires a separate license on each FortiGate in order to access the associated signatures (see also: Operational Technology (OT) Datasheet ).

To validate the version of signature database being used, run the command diagnose autoupdate versions and grep for the related databases:

Alternatively, navigate to System -> FortiGuard in the GUI and check under the Intrusion Prevention System (IPS) and Operation Technology (OT) Security Service sections respectively.

To manually force an update of the signature databases, run the command execute update-ips in the CLI or navigate to System -> FortiGuard and select Update licenses & definitions now on the right-hand .

Important: the FortiGate must have an IPS sensor applied in the configuration (e.g. on at least one Firewall Policy) otherwise it will not conduct an update of the IPS database.

PHP2Shell Remote Code Execution Vulnerabilities (Fortinet Threat Signal Report)

How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb

Technical Tip: How does FortiCNAPP Protect from CVE-2026-109618 & CVE-2026-109619, PHP Remote Code Execution Vulnerabilities

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both vulnerabilities allow unauthenticated remote code execution (RCE) and have a CVSS score of 9.2. The attack vector involves the `session.upload_progress` feature in PHP, which can be manipulated to execute arbitrary code. Patches were released on October 21, 2026, but exploitation attempts continued shortly after the fixes were made public. The vulnerabilities affect multiple PHP versions, including those that are no longer supported. Organizations are urged to apply the patches immediately and review their systems for potential exposure. 248 sources 73

Extracted Entities

Using the FortiGate to protect against PHP vulnerabilities CVE-2026-109618 and CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Domains (1)

MITRE ATT&CK (1)

Platforms (2)