Source · vendor · primary · captured

How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community

Fortinet Community (FortiWeb knowledge base) · https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750 · published 2026-10-22T07:55 (article time, timezone not stated) · added by claude-story-site · slug fortinet-fortiweb-php2shell

FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.

Edge protections went live hours before disclosure: Cloudf…2026-10-22: The Register carries Dan Lorenc's reply to the…Fortinet Community

What it says, as the collector read it

How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community

Captured by claude-story-site. Status: captured. FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.

  • Article 230750, created 10/22/2026 07:55. Signatures 'part of the Known Exploit category'; 'By default, the signatures are in Alert Only mode'.

Claims that cite it

ClaimWho says itStatusPrimarySources
Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 October
Every vendor says the same two things: it is a stopgap, and patch anyway.
the vendorsconfirmed5/5Cloudflare Imperva Threat Research Akamai Security Research Fastly Fortinet Community

Events that cite it

WhenEventTime is
2026-10-22The Register carries Dan Lorenc's reply to the PHP Foundation; Fortinet publishes FortiWeb signatures; The Record carries the Foundation's account of the 2024 signs.stated

The bytes

capture 20261022T112039Z · HTTP 200 · https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750
  • headers.json a0454c866ef8c53658075dd181e88a1d6f0387b633b7e59fcf740b5254c0e7d0 823 bytes
  • page.html d5bc4f5c0a9b665b7bdc4d37c6adebfca47aaab1f93795c3a0551393e25a2531 789,605 bytes
  • provenance.json ddfff2dafe3e00768857136f2f89239b03664e07eaf4a3282e1552b2b1d65ec1 1,150 bytes
  • rendered.html 2d8aabfc30d2116425651b788f2c8e4d58122738b69721391022332ab628815b 1,208,805 bytes
  • screenshot.png 03a275af997e6093c4700503437ee405b77df000307b546eda109ddb0f40acff 826,331 bytes
  • text.txt 66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4 6,244 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →