PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-22T20:52:16Z•09b34febdfc203ebe3f9e891e732e857f5040cb6a05fd768e0f5d0618484509e
CVE-2022-0778CVE-2026-109618CVE-2026-109619CWE-22CWE-78CWE-89FortiAnalyzerFortiClientFortiMailFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetOpenSSLPHParbitrary-file-writeauthentication-bypasscommand-injectioncross-site-scriptingdenial-of-servicepath-traversalremote-code-executionsql-injection
What happened
Fortinet advisory feed containing multiple vulnerabilities across FortiOS, FortiProxy, FortiSIEM, FortiSandbox, FortiManager, FortiAnalyzer, FortiMail, FortiSOAR, FortiClient, FortiPAM, FortiMonitorOnSight and related products. The most serious issues include unauthenticated remote code execution or arbitrary file writing, authentication bypasses, SQL and command injection, and vulnerabilities reportedly exploited in the wild. The feed also includes two PHP core RCE vulnerabilities and the OpenSSL CVE-2022-0778 denial-of-service issue.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 09b34febdfc203ebe3f9e891e732e857f5040cb6a05fd768e0f5d0618484509e
- Enrichment time
- 2026-10-22T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.