PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

Fortinet security advisories covering numerous vulnerabilities across PHP core and Fortinet products, including multiple unauthenticated remote code execution or authentication-bypass issues, arbitrary file write/path traversal, SQL and OS command injection, denial of service, access-control flaws, XSS, and cryptographic weaknesses. The most urgent item is an exploited-in-the-wild path traversal/NULL-byte flaw enabling unauthenticated arbitrary file writes. The PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 are rated CVSS 9.8 and can lead to remote code execution. Other critical risks