Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · vendor · primary · captured

PSIRT | FortiGuard Labs

Fortinet · https://fortiguard.fortinet.com/psirt/FG-IR-26-186 · published not stated · added by curator@php.newsroom · slug fortinet-fg-ir-26-186

Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. Fortinet investigation and product status (primary)

What it says, as the collector read it

PSIRT | FortiGuard Labs

Promoted by curator@php.newsroom from the source watch (vault oq9gflln), page us/security-vendor/fortinet/psirt-fg-ir-26-186, snapshot 20261022T191713Z. Copied byte for byte; every file's sha256 is in captures/20261022T191713Z/provenance.json. Publisher: Fortinet. Language: en. URL: https://fortiguard.fortinet.com/psirt/FG-IR-26-186

What the page says

_Curator's reading of the capture._

FortiGuard PSIRT advisory FG-IR-26-186, "PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)", with the two CVE descriptions (longjmp() on OOM leaving request memory uninitialised; stale global state pointing into freed request memory). Fortinet is investigating: products under investigation are FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS; confirmed not impacted include FortiOS, FortiClient EMS (and Cloud), FortiADC (and Manager), FortiEndpoint, FortiSIEM and FortiMonitor, among others. OT IPS references 10009977 and 10009978 were added on 22 October.

Why it is here

From the promotion queue (index/promote.json, priority 2): Fortinet investigation and product status (primary)

Supports: cyber desk: appliances

Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261022T191713Z · HTTP 200 · https://fortiguard.fortinet.com/psirt/FG-IR-26-186
  • headers.json b5fc379c961afb5b761eec930d09fc2bca76fdfa529536804adf20b2c81bb962 2,122 bytes
  • page.html c9f8832a001bf9eb296b5d7d3b4796f4e34e2843d6ddd238f141993944c37b9b 103,438 bytes
  • provenance.json 2da4895b7972284d959f5a12404efa148e8a9b638cf6c6621160b7bc09a7e053 1,547 bytes
  • rendered.html 6032cffb5942e5d75091a6cc30d4c842d8206af5e4e64b1e89e928300459e3e8 96,822 bytes
  • screenshot.jpg 64d162eaae299990dfa73cdda8a3e505228359e3aaeabb32e278ebb5b0f0a627 196,340 bytes
  • text.txt 9143f822233ec0825da53d15f088af72cc826cdb87501af1322f4904dcf2ea9a 2,650 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →