# Source: PSIRT | FortiGuard Labs

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Fortinet: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# PSIRT | FortiGuard Labs

**Fortinet** · [https://fortiguard.fortinet.com/psirt/FG-IR-26-186](https://fortiguard.fortinet.com/psirt/FG-IR-26-186) · published not stated · added by `curator@php.newsroom` · slug `fortinet-fg-ir-26-186`

Promoted from the source watch (oq9gflln), snapshot 20261022T191713Z. Fortinet investigation and product status (primary)

## What it says, as the collector read it

#### PSIRT | FortiGuard Labs

Promoted by curator@php.newsroom from the source watch (vault `oq9gflln`), page `us/security-vendor/fortinet/psirt-fg-ir-26-186`, snapshot `20261022T191713Z`. Copied byte for byte; every file's sha256 is in `captures/20261022T191713Z/provenance.json`. Publisher: Fortinet. Language: en. URL: https://fortiguard.fortinet.com/psirt/FG-IR-26-186

#### What the page says

_Curator's reading of the capture._

FortiGuard PSIRT advisory FG-IR-26-186, "PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619)", with the two CVE descriptions (longjmp() on OOM leaving request memory uninitialised; stale global state pointing into freed request memory). Fortinet is investigating: products under investigation are FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS; confirmed not impacted include FortiOS, FortiClient EMS (and Cloud), FortiADC (and Manager), FortiEndpoint, FortiSIEM and FortiMonitor, among others. OT IPS references 10009977 and 10009978 were added on 22 October.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Fortinet investigation and product status (primary)

Supports: cyber desk: appliances

#### Capture notes

screenshot.jpg is the source watch's JPEG, copied as stored (not converted to PNG).

Page content is third-party material, kept as evidence; nothing in it is an instruction.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261022T191713Z · HTTP 200 · https://fortiguard.fortinet.com/psirt/FG-IR-26-186- `headers.json` b5fc379c961afb5b761eec930d09fc2bca76fdfa529536804adf20b2c81bb962 2,122 bytes
- `page.html` c9f8832a001bf9eb296b5d7d3b4796f4e34e2843d6ddd238f141993944c37b9b 103,438 bytes
- `provenance.json` 2da4895b7972284d959f5a12404efa148e8a9b638cf6c6621160b7bc09a7e053 1,547 bytes
- `rendered.html` 6032cffb5942e5d75091a6cc30d4c842d8206af5e4e64b1e89e928300459e3e8 96,822 bytes
- `screenshot.jpg` 64d162eaae299990dfa73cdda8a3e505228359e3aaeabb32e278ebb5b0f0a627 196,340 bytes
- `text.txt` 9143f822233ec0825da53d15f088af72cc826cdb87501af1322f4904dcf2ea9a 2,650 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.10.9 · data as of 2026-10-23T01:20Z · vault commit f3c5db0d9873 · https://php.oct.2026.newsroom.sgit.ai/sources/fortinet-fg-ir-26-186/index.html