FortiGate firewalls have no FortiGate PHP2Shell exposure of their own. Fortinet's PSIRT advisory FG-IR-26-186, last updated on 28 October 2026, lists FortiOS, the operating system on every FortiGate, as confirmed not impacted by CVE-2026-109618 or CVE-2026-109619. A FortiGate PHP vulnerability patch is therefore not needed. The work for FortiGate owners is on the PHP web servers behind the firewall, where Fortinet's IPS signatures can help until PHP is patched.
What PHP2Shell is
PHP2Shell is the name for two flaws in the PHP runtime itself. The PHP project fixed both on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to its news archive. CVE-2026-109618 is a memory corruption bug in out-of-memory handling. CVE-2026-109619 lets a later request read stale state left by an earlier one on the same worker.
Fortinet's advisory rates CVE-2026-109618 critical with a CVSS v3 score of 9.8. FortiGuard Labs scores both at 9.2 under CVSS 4.0. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 26 October 2026, with a due date of 29 October 2026 for US federal agencies. Fortinet's own advisory still marked the flaws as not known to be exploited on 28 October.
PHP 8.1 and older no longer get security releases from the PHP project, as both php.net and FortiGuard point out. Those servers need a backport from the operating system vendor or an upgrade.
Which Fortinet products are still under investigation
As of the 28 October 2026 update, FG-IR-26-186 lists three products as under investigation:
- FortiDDoS
- FortiSOAR
- FortiSOAR PaaS
Help Net Security reported on 22 October that FortiClient Cloud Services was also under review then. The advisory now says Fortinet has fixed the affected FortiClient forensics cloud hosts itself, and customers do not need to do anything for them.
The not impacted list has grown with each update. Besides FortiOS it includes FortiGate Cloud, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiMail, FortiSwitch, FortiAP, FortiExtender, FortiAuthenticator, FortiClient EMS and FortiSIEM, among others. Check the advisory before you quote a status to a customer, because Fortinet revised it on 22, 23, 26, 27 and 28 October.
What FortiGate owners should do
Keep FortiOS current on its normal schedule. Fortinet published the FortiOS 7.6.8 release notes on 22 October 2026 (build 3744, updated 26 October). They do not mention PHP or PHP2Shell, and none was needed for FortiOS, so treat 7.6.8 as a routine update.
Turn on the IPS protection for the servers behind the firewall. Fortinet's blog lists these signatures in IPS database 37.317:
| Signature ID | Name | CVE |
|---|---|---|
| 62657 | PHP.longjmp.Remote.Code.Execution | CVE-2026-109618 |
| 62658 | PHP.stale.global.state.Remote.Code.Execution | CVE-2026-109619 |
For OT networks, FG-IR-26-186 lists OT virtual patch IDs 10009977 and 10009978 in version 37.316. Make sure the FortiGate has a valid FortiGuard IPS subscription and has pulled the update, then apply an IPS sensor to the policies that reach your web servers.
Then patch PHP on those servers. Fortinet's blog says to restart the PHP workers after the update and confirm the fixed runtime is the one serving requests. It also notes that a patch will not remove an attacker who got in first, so review web logs, worker crashes and outbound connections from those hosts. A third PHP issue, CVE-2026-115560, has a separate workaround from php.net: set session.upload_progress.enabled=0 until the next PHP release. FortiGuard's Threat Signal adds that IPS and request size limits reduce exposure while you patch, and the PHP update is still required.
Buyer note for used and refurbished FortiGate units
The IPS signatures above only reach a FortiGate with an active FortiGuard subscription and a FortiOS release that still gets updates, which is often where second hand units fall short.
The FortiOS 7.6.8 supported model list includes the FortiGate 40F, FortiGate 60F and FortiGate 100F. It does not list the FortiGate 60E or the FortiGate 100E. Our model pages record the 60E as end of sale since December 2021 with end of support in December 2026, and the 100E as end of sale since January 2022 with end of support in January 2027.
Before you deploy or resell a used unit, check its serial number in the Fortinet support portal for registration, licence and support dates, and check that its FortiOS branch still gets fixes. An E series box close to end of support is a short term buy for any site that depends on IPS updates.
FAQ
Is FortiGate affected by PHP2Shell?
No. Fortinet's advisory FG-IR-26-186 lists FortiOS, which runs on all FortiGate appliances, as confirmed not impacted by CVE-2026-109618 and CVE-2026-109619. FortiGate Cloud is also on the not impacted list.
Does CVE-2026-109618 affect FortiGate?
No. CVE-2026-109618 is a flaw in PHP, and Fortinet confirmed FortiOS is not impacted. It does affect PHP web servers that a FortiGate may protect, which need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport.
Does FortiOS 7.6.8 fix PHP2Shell?
The FortiOS 7.6.8 release notes do not mention PHP2Shell, and FortiOS was not affected, so no fix was needed. Upgrade to 7.6.8 for its own resolved issues, on your normal schedule.
Which FortiGate IPS signatures cover PHP2Shell?
Fortinet's blog lists IPS signature 62657 for CVE-2026-109618 and 62658 for CVE-2026-109619, both in IPS database 37.317. They need an active FortiGuard IPS subscription.
Which Fortinet products are still under investigation?
As of 28 October 2026, FortiDDoS, FortiSOAR and FortiSOAR PaaS. Check FG-IR-26-186 for later updates.
