PHP2Shell and How FortiGate IPS Helps Mitigate It
PHP2Shell is a pair of critical remote code execution bugs in PHP. FortiGate IPS signatures block the known exploit traffic while you patch.
Megatron Technology is a Fortinet reseller in Singapore. This post explains what the bugs are, who is affected, and how a FortiGate with current IPS signatures reduces the window of exposure.
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP interpreter, disclosed on 21 October 2026:
CVE-2026-109618 — remote code execution via out-of-memory corruption. A crafted request can force PHP to run out of memory while request data is only partly initialised. Cleanup then treats the half-built data as valid.
CVE-2026-109619 — remote code execution via stale global state. A second request can reuse uninitialised memory from the first.
Both are rated 9.2 under CVSS v4.0 (Critical) by PHP. NIST's National Vulnerability Database scores CVE-2026-109618 at 9.8 and CVE-2026-109619 at 8.1 under CVSS v3.1. Details, including the CVE IDs, leaked ahead of the planned disclosure, so PHP brought its security release forward to 21 October 2026.
What is affected?
Any internet-facing service running a vulnerable PHP version is at risk. Fixed versions are:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
PHP 8.1 and older are affected and no longer receive regular updates from the PHP project. Given the severity, the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1; otherwise check with your distribution or LTS vendor, or upgrade to a supported version. Distribution packages (Ubuntu, Debian, Alpine, etc.) may ship the fix under different version numbers.
FortiOS itself is not affected. Fortinet's PSIRT advisory (FG-IR-26-186) lists FortiOS, FortiGate Cloud, FortiManager, FortiAnalyzer, FortiWeb and many other products as not impacted. As of 23 October 2026, FortiDDoS, FortiDDoS-F, FortiClient Cloud Services, FortiSOAR and FortiSOAR PaaS remain under investigation.
How critical is it?
Critical. Both bugs allow unauthenticated remote code execution against a PHP process. A successful exploit can give an attacker a shell on the server, with access to application files, databases, and anything else the PHP process can reach. Public proof-of-concept research appeared within a day of disclosure. Exploitation attempts were observed from 17 October 2026, before the patches were released, although as of 22 October reported activity was mostly scanning and failed attempts. As of 23 October 2026 the CVEs are not on CISA's Known Exploited Vulnerabilities catalogue. Patching is the only complete fix.
How FortiGate IPS mitigates it
FortiGuard Labs released IPS signatures for both CVEs within about a day of disclosure; FortiGuard's Threat Signal report was published on 21 October and updated on 22 October 2026. The signatures detect and block the known exploit traffic before it reaches the PHP server.
| CVE | IPS signature | Database |
|---|---|---|
| CVE-2026-109618 | PHP.longjmp.Remote.Code.Execution | 37.317 |
| CVE-2026-109619 | PHP.stale.global.state.Remote.Code.Execution | 37.317 |
OT Virtual Patch signatures were released in database 37.316 and require a separate OT Security Service licence. Once the FortiGate has the updated database, the signatures appear under Security Profiles → IPS Signatures (IDs 62657 and 62658; confirm which maps to the longjmp signature in the FortiGuard encyclopedia). Load them into an IPS sensor (or Virtual Patching profile) and apply the sensor to the firewall policy that protects the PHP servers. Change the action from the default “Pass” to Block if you want the traffic dropped.
How quickly were the signatures released?
Within about a day. FortiGuard lists the IPS signatures in Attack Definitions 37.317. FortiGuard's Outbreak Alert and the Fortinet Community article were published on 22 October 2026. With the default automatic update schedule, a FortiGate checks for new definitions within each one-hour period, so subscribed units typically receive new signatures within hours, not days.
How it blocks the attack
The IPS engine inspects HTTP requests matching the known exploit patterns for both CVEs. When a match is found and the signature action is set to Block, the FortiGate drops the request before it reaches the PHP process. This is virtual patching: it reduces exposure while you schedule the actual PHP update. It does not replace patching. New exploit variants can appear, and encrypted traffic requires SSL inspection to be inspected.
How FortiGate stays current for zero-day attacks
FortiGate pulls IPS and antivirus definitions from FortiGuard on a schedule. On current FortiOS releases the default schedule is automatic: the FortiGate checks for updates within every one-hour period, at an interval calculated from the model and its valid subscriptions (Fortinet's example is every 10 minutes). It can also be set to a fixed interval, daily or weekly. Larger models (2U and above) can also keep a persistent connection to FortiGuard to be notified of new packages.
Requirements:
A valid FortiGuard IPS subscription.
At least one firewall policy with an IPS sensor applied (otherwise the IPS database does not update).
Scheduled updates enabled under System → FortiGuard (automatic is the default).
Check the current database with diagnose autoupdate versions or in the GUI under System → FortiGuard. Force an immediate update with execute update-ips or the “Update licenses & definitions now” button.
This is the same mechanism that delivers signatures for other zero-day and newly disclosed vulnerabilities. The PHP2Shell signatures followed the same path: research, signature creation, database package, automatic delivery to subscribed FortiGates.
What to do now
Patch PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the equivalent distribution package).
Until you can patch, apply PHP's interim mitigations, including session.upload_progress.enabled=0 (PHP reiterated this on 23 October 2026).
Confirm the FortiGate has IPS database 37.317 or later.
Add the two PHP2Shell signatures to an IPS sensor and change the action from the default Pass to Block.
Apply the sensor to the policy protecting your PHP servers.
Keep automatic FortiGuard updates enabled.
Frequently asked questions
Does the FortiGate itself need a firmware update?
No. FortiOS is not affected. Only the IPS signature database needs to be current.
Is IPS enough?
No. IPS blocks known exploit traffic. It does not fix the underlying PHP bug. Patch the servers.
What if the PHP traffic is encrypted?
The FortiGate must decrypt the traffic (SSL inspection) to inspect it. Without decryption, the signatures cannot see the request body.
Megatron Technology (est. 1990, UEN 199002644W) is an authorised Cisco Networking Partner and Managed Services Provider in Singapore, and a Fortinet reseller. Our 4 Cisco-certified engineers design, licence, procure, deploy and support Cisco Meraki, FortiGate and Cisco enterprise networks. Verify us on the Cisco Partner Locator. Contact: +65 6346 2001 · info@megatron.com.sg.
Sources (checked 23 October 2026):