# Source: How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community

Fortinet Community (FortiWeb knowledge base): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · vendor · primary · captured

# How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community

**Fortinet Community (FortiWeb knowledge base)** · [https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750](https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750) · published 2026-10-22T07:55 (article time, timezone not stated) · added by `claude-story-site` · slug `fortinet-fortiweb-php2shell`

FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.

## What it says, as the collector read it

#### How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community

Captured by claude-story-site. Status: captured. FortiGuard signatures 090502648, 090502651, 09052654 in database 0.00438; alert-only by default; four custom-rule templates.

- Article 230750, created 10/22/2026 07:55. Signatures 'part of the Known Exploit category'; 'By default, the signatures are in Alert Only mode'.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akamai and Fastly on 21 October; Fortinet signatures by 22 OctoberEvery vendor says the same two things: it is a stopgap, and patch anyway. | the vendors | confirmed | 5/5 | [Cloudflare](../../sources/cloudflare-blog-php2shell-waf/index.html) [Imperva Threat Research](../../sources/imperva-blog-php2shell/index.html) [Akamai Security Research](../../sources/akamai-blog-php-core-rce/index.html) [Fastly](../../sources/fastly-blog-php2shell/index.html) [Fortinet Community](../../sources/fortinet-fortiweb-php2shell/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-22 | The Register carries Dan Lorenc's reply to the PHP Foundation; Fortinet publishes FortiWeb signatures; The Record carries the Foundation's account of the 2024 signs. | stated |

## The bytes
capture 20261022T112039Z · HTTP 200 · https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750- `headers.json` a0454c866ef8c53658075dd181e88a1d6f0387b633b7e59fcf740b5254c0e7d0 823 bytes
- `page.html` d5bc4f5c0a9b665b7bdc4d37c6adebfca47aaab1f93795c3a0551393e25a2531 789,605 bytes
- `provenance.json` ddfff2dafe3e00768857136f2f89239b03664e07eaf4a3282e1552b2b1d65ec1 1,150 bytes
- `rendered.html` 2d8aabfc30d2116425651b788f2c8e4d58122738b69721391022332ab628815b 1,208,805 bytes
- `screenshot.png` 03a275af997e6093c4700503437ee405b77df000307b546eda109ddb0f40acff 826,331 bytes
- `text.txt` 66beb7cb9c50e017b68c7c28ce5f985fd12b156c4060ecd82205cea19185d2a4 6,244 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/fortinet-fortiweb-php2shell/index.html