PHP2Shell statement record · Platform
Status in the company's own words: not affected. Statement dated Oct 21, 2026 (Updated Oct 22, 2026).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on fortiguard.fortinet.com, dated Oct 21, 2026 (Updated Oct 22, 2026). Source type: official page.
FG-IR-26-186 PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)
, severity Critical. Mixed: confirmed not impacted list includes FortiOS, FortiProxy, FortiWeb, FortiManager, FortiAnalyzer, FortiClient EMS, FortiMail, FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC and more; still under investigation: FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR, FortiSOAR PaaS. Fortinet is currently investigating the impact of these CVEs over Fortinet Products.
quoted from https://fortiguard.fortinet.com/psirt/FG-IR-26-186. No fixed versions listed; IPS signatures released in version 37.316; known exploited: No.
match
If you mean FortiGate/FortiOS: no—Fortinet explicitly says FortiOS is not affected by CVE-2026-109618 or CVE-2026-109619. That is different from saying every Fortinet product is unaffected. As checked on October 23, 2026: | Question | Verified answer | |---|---| | Is FortiGate/FortiOS affected? | No, according to Fortinet’s official technical article. | | Has Fortinet released protection? | Yes. FortiGate
no status named
Here is a comprehensive summary of Fortinet's status regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), based on the latest available sources: 🔒 PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Fortinet's Status What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. Both allow an unauthenticated attacker to execute their
contradiction
Fortinet’s current position is that FortiOS/FortiGate and several other named products are not affected, while 12 products remain under investigation. Fortinet has not confirmed that any of those products are vulnerable or issued product-specific patches yet. Confirmed not impacted: FortiOS/FortiGate FortiManager FortiAnalyzer FortiWeb FortiMail FortiClient for Linux, Windows, and macOS FortiSASE FortiAuthenticator FortiSwitch FortiNAC Still under investigation: FortiADC and
no status named
Fortinet’s core products—including FortiOS (running on FortiGate firewalls), FortiManager, FortiAnalyzer, FortiWeb, and FortiMail—are not impacted by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, Fortinet is currently investigating 12 specific products to evaluate potential exposure: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard, and FortiEndpoint. For protection and remediation: Patching Status: Because these
match
Based on official Fortinet advisories and documentation: Impact Status: Fortinet's core products (such as FortiOS) are not impacted by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because FortiOS itself does not use the affected PHP implementations. Mitigation / Protection: Because Fortinet products are not vulnerable, no product-specific software patch is required for FortiOS. However, Fortinet has released official IPS (Intrusion
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Fortinet reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Fortinet's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Fortinet and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy