FORTINET Security Advisory
Published Date: Not specified
CVE: CVE-2026-109618
Advisory Summary
🗓️
🚨 ⚠️ High-Critical Alert: PHP Core Remote Code Execution (RCE)
Fortinet PSIRT reports critical patches for two PHP core vulnerabilities with a CVSSv3 score of 9.8, enabling remote attackers to achieve RCE under specific out-of-memory (OOM) handling conditions.
—
🧩 🔎 What’s happening (Root Cause)
The affected PHP code paths use longjmp() for OOM error handling to abort request contexts. In some execution contexts, this can leave request memory in an uninitialized state prior to subsequent allocations. During request cleanup, that memory may be read or used for branching, creating a reliable path to RCE.
—
- CVE-2026-109618: OOM handling + uninitialized memory → RCE
- CVE-2026-109619: Related PHP core issue enabling similar exploitation conditions (patch required)
—
- Threats are especially relevant for environments running PHP in web-facing or API-facing workloads (including reverse proxies, ingress controllers, CDN/origin setups, and WAF-protected apps).
- Potential business impact includes server compromise, credential theft, lateral movement, and potential persistence mechanisms.
—
📌 🛠️ Recommended Actions (Actionable Checklist)
1. Apply Fortinet’s referenced PSIRT patches immediately for the affected PHP versions/configurations.
2. Inventory all PHP runtimes (containers, VM-based web tiers, PaaS-like environments, embedded appliances, and legacy app servers).
3. Review OOM behavior & memory settings (e.g., PHP memory limits, container memory limits, PHP-FPM worker settings) to reduce exploit reliability while patching.
4. Validate patch success via application smoke tests and endpoint-level regression checks (especially around error handling and cleanup flows).
5. If you use security tooling, ensure your detection rules and signatures are updated to reflect the new CVEs.
—
⚙️ 🏷️ Affected Vendor/Brand Context (Market View)
This advisory is published by FORTINET and is directly pertinent to operators deploying PHP-backed services with FortiGate/FortiGuard-monitored stacks or Fortinet-managed security controls.
—
Informations / Reference & Patch Advisory
-2026-109618
Reference: Vendor Advisory