PSIRT PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)

{
  "id": "26bf8b1f51e41b00f9c7b077a676f4a8a9358c3cdd5160ad4b9396e5d1ffb17a",
  "url": "https://fortiguard.fortinet.com/psirt/FG-IR-26-186",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "PSIRT PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)",
    "summary": "Fortinet reports two PHP vulnerabilities that can lead to remote code execution. Fortinet is investigating the impact on several products and lists many others as not impacted. IPS signatures and a FortiWeb virtual patch are referenced.",
    "evidence": "Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
    "products": [
      {
        "name": {
          "value": "Fortinet Products",
          "evidence": "Fortinet is currently investigating the impact of these CVEs over Fortinet Products."
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      },
      {
        "name": {
          "value": "IPS Signatures",
          "evidence": "IPS Signatures:"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.00438",
            "evidence": "Released in version 0.00438"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "OT IPS Signatures",
          "evidence": "OT IPS Signatures:"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "37.316",
            "evidence": "Released in version 37.316"
          }
        ],
        "affected_versions": []
      },
      {
        "name": {
          "value": "FortiWeb Web Application Security",
          "evidence": "FortiWeb Web Application Security:"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "critical",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-109618",
        "evidence": "CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors"
      },
      {
        "value": "CVE-2026-109619",
        "evidence": "CVE-2026-109619 PHP has various global state that temporarily points into request memory."
      }
    ],
    "security_relevant": true,
    "severity_evidence": "Severity Critical"
  },
  "source_id": "official-fortinet-psirt",
  "document_id": 23548,
  "published_at": "2026-10-21T07:00:00+00:00"
}