Not php.net · Not NVD · Not CISA

PHP Vulnerability Tracker

Unofficial briefing on PHP security vulnerabilities

English简体中文日本語DeutschFrançaisNederlandsEspañol

Security alert

PHP2Shell: upgrade PHP. That is the only complete fix.

CVE-2026-109618 and CVE-2026-109619 are critical, unauthenticated remote-code-execution bugs in PHP itself. The PHP project shipped fixes on 21 October 2026 for the supported 8.2–8.5 branches. Restart PHP after you upgrade. A firewall is not a substitute.

Remediation steps

Products and stacks · Firewalls, appliances and IT tools

PHP2Shell in Fortinet: is it affected and how to fix it

How to check the PHP version Fortinet uses

Run the command for your setup. A version at or above 8.2.35, 8.3.36, 8.4.27 or 8.5.12 in its branch is fixed; older branches are fixed only by a vendor build that says so.

get system status

Run it on the FortiADC or FortiDDoS CLI; for FortiSIEM and FortiSOAR, read the version in the GUI and compare it with FG-IR-26-186.

The command-line php can differ from the PHP that serves the site. To be sure, check the web SAPI (a temporary phpinfo() page behind authentication, or the panel's PHP settings) and remove it afterwards. Our version checker compares a version number for you.

🔎 Got a version number? Paste it into the PHP2Shell checker →

How to fix PHP2Shell in Fortinet

  1. Keep the management interfaces of FortiADC, FortiDDoS, FortiSIEM and FortiSOAR off the internet and reachable only from a management network or VPN.
  2. Watch FG-IR-26-186 for each product's verdict and fixed versions, and install them when they ship.
  3. Until the vendor ships fixed PHP, the PHP-based interface should not be reachable from untrusted networks: restrict it to a management network, an IP allowlist or a VPN.
  4. Install the vendor update as soon as it appears and re-check the version.

Prefer to let an AI agent do the checks? Check if you are affected · Fix with an AI agent

If you cannot patch yet

FAQ

Is Fortinet affected by PHP2Shell?

Affected, and the vendor has not shipped a fix yet. Fortinet PSIRT advisory FG-IR-26-186 (21 October 2026) says Fortinet is investigating impact. Under investigation: FortiADC, FortiADC Manager, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard and FortiEndpoint. Confirmed not impacted: FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, FortiMail Cloud, FortiSandbox, FortiNAC, FortiNAC-F, FortiAuthenticator, FortiSwitch, FortiAP, FortiGate Cloud, FortiSASE, FortiPAM, FortiDeceptor, FortiClient EMS and the FortiClient apps. Separately, FortiGuard Labs lists IPS virtual patches for both CVEs (signature package 37.316) for protecting other PHP servers.

Does updating Fortinet itself fix CVE-2026-109618 and CVE-2026-109619?

Only if the update contains fixed PHP. PHP2Shell is a flaw in the PHP interpreter, so what matters is the PHP that Fortinet runs on. Check the version after updating.

Which PHP versions fix PHP2Shell?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released 21 October 2026. PHP 8.1 and older get no release from the PHP project; only vendor builds with a backport (or a self-built source patch for 7.4, 8.0 and 8.1) fix them.

What if Fortinet has no fix yet?

Keep its PHP-based web interface off the internet (VPN or IP allowlist), apply PHP's interim settings such as disabling session upload progress, and install the vendor update as soon as it ships. Interim settings reduce risk but are not a fix.

← All products that bundle PHP

See also: Remediation by platform · Affected versions · Vendor status

Sources

Outbound links leave this site. We do not host exploit code.

Unofficial summary of public sources. This site is not affiliated with the vendor or the PHP project and hosts no exploit code.