Is FortiGate Affected by PHP2Shell?
Last updated: 24 October 2026
Short answer: No. FortiOS (the operating system that runs FortiGate) is confirmed not affected by PHP2Shell.
PHP2Shell is the name for two critical remote code execution vulnerabilities in the PHP language itself (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 Critical under CVSS v4.0 by PHP). They affect PHP web servers, not firewalls.
Fortinet’s official position
According to Fortinet PSIRT advisory FG-IR-26-186 (last updated 23 October 2026):
FortiOS — confirmed not impacted
FortiManager, FortiAnalyzer, FortiWeb, FortiMail — confirmed not impacted
FortiClient (Linux/Windows/macOS/iOS/Android), FortiSASE, FortiAuthenticator, FortiSwitch, FortiNAC and several other products — also confirmed not impacted
A small number of Fortinet products remain under investigation (including FortiDDoS and FortiSOAR). FortiGate is not on that list. As of 24 October 2026, FortiDDoS-F is confirmed not impacted.
What this means for you
If you run FortiGate, you do not need to patch the firewall for PHP2Shell. The vulnerability is in PHP, and Fortinet has confirmed FortiOS is not impacted.
You still need to patch any PHP servers (websites, portals, WordPress, Laravel, etc.) that sit behind the FortiGate. FortiGuard Labs has released IPS signatures that can help protect those servers while you patch:
62657 — PHP.longjmp.Remote.Code.Execution (CVE-2026-109618)
62658 — PHP.stale.global.state.Remote.Code.Execution (CVE-2026-109619), in IPS database 37.317
For step-by-step FortiGate IPS configuration, see PHP2Shell and How FortiGate IPS Helps Mitigate It.
Frequently asked questions
Does FortiGate itself need a firmware update for PHP2Shell?
No. FortiOS is confirmed not affected.
Can FortiGate protect my PHP websites from PHP2Shell?
Yes, if the FortiGate has IPS database 37.317 or later, the two signatures are in an IPS sensor with the action changed from the default Pass to Block, and the sensor is applied to the policy protecting your PHP servers. HTTPS traffic needs SSL deep inspection to be inspected. It is not a substitute for patching the PHP servers.
Where should I check the latest status?
Fortinet PSIRT advisory FG-IR-26-186 and the FortiGuard Threat Signal for PHP2Shell.
Megatron Technology (est. 1990, UEN 199002644W) is an authorised Cisco Networking Partner and Managed Services Provider in Singapore, and a Fortinet reseller. Our 4 Cisco-certified engineers design, licence, procure, deploy and support Cisco Meraki, FortiGate and Cisco enterprise networks. Verify us on the Cisco Partner Locator. Contact: +65 6346 2001 · info@megatron.com.sg.
Sources (checked 24 October 2026):