PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-25T08:52:16Z•0ca0c9b8a6ed77fc11933dc970f9056e9ab4001c98a4891d588f2a82ffee3dfc
CVE-2022-0778CVE-2026-109618CVE-2026-109619FortiAnalyzerFortiClientFortiMailFortiManagerFortiMonitorOnSightFortiOSFortiPAMFortiProxyFortiSIEMFortiSOARFortiSandboxFortinetOpenSSLPHPSQL-injectionXSSaccess-controlarbitrary-file-writeauthentication-bypasscommand-injectiondenial-of-serviceexploited-in-the-wildinformation-disclosurepath-traversalremote-code-execution
What happened
Fortinet PSIRT feed containing multiple vulnerability advisories across FortiOS, FortiProxy, FortiManager, FortiAnalyzer, FortiSIEM, FortiSandbox, FortiMail, FortiSOAR, FortiPAM, FortiClient, FortiMonitorOnSight, and PHP/OpenSSL components. Issues include remote and unauthenticated RCE, arbitrary file write, authentication bypass, SQL and OS command injection, path traversal, static-key JWT forgery, sensitive information exposure, denial of service, XSS, access-control flaws, and certificate-validation weaknesses. Several advisories have CVSS scores of 9.6–9.9; one path-traversal issue isรายed
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 0ca0c9b8a6ed77fc11933dc970f9056e9ab4001c98a4891d588f2a82ffee3dfc
- Enrichment time
- 2026-10-25T08:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.