PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
2026-10-25T20:52:16Z•59628475413662249bedfca0faeabfc0dd320b1e7efd920bf6baa981fb6289b9
CVE-2022-0778CVE-2026-109618CVE-2026-109619CWE-22CWE-284CWE-78CWE-89FortinetOpenSSLPHPSQL-injectionaccess-controlarbitrary-file-writeauthentication-bypasscommand-injectioncross-site-scriptingdenial-of-serviceexploited-in-the-wildpath-traversalremote-code-execution
What happened
Fortinet's advisory feed reports numerous vulnerabilities affecting PHP core and Fortinet products, including critical remote code execution, authentication bypass, arbitrary file write, SQL/OS command injection, sensitive-information exposure, and denial-of-service issues. The highest-risk items include PHP RCE vulnerabilities CVE-2026-109618 and CVE-2026-109619 (CVSS 9.8), an exploited-in-the-wild Fortinet path traversal/NULL-byte flaw enabling unauthenticated arbitrary file writes (CVSS 9.8), FortiSandbox authentication bypass and NAT-rule access-control issues, and a FortiMonitorOnSight [1
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- fortinet_blog
- Record identifier
- 59628475413662249bedfca0faeabfc0dd320b1e7efd920bf6baa981fb6289b9
- Enrichment time
- 2026-10-25T20:52:16Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.