Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP. Collectively referred to as PHP2Shell, these vulnerabilities can potentially allow an unauthenticated attacker to remotely execute code on a vulnerable system.
On Wednesday, October 21st, Fortinet announced a coordinated set of critical security updates for several of its most widely deployed products to become available October 22nd.
The Systems Engineering team has been tracking this announcement closely and is responding proactively for our clients – we are in direct communication with any clients we believe will be impacted by this announcement and the associated patching required.
Systems Engineering is aware of the recently disclosed FortiBleed security situation, which has impacted a significant number of organizations utilizing Fortinet FortiGate devices globally. The security of our clients is our top priority, and our team has assessed the FortiBleed situation.
Systems Engineering is closely monitoring a critical security situation involving Fortinet FortiOS. Recent analysis has identified a sophisticated exploitation technique targeting the Single Sign-On (SSO) mechanism, allowing unauthorized administrative access to affected devices. Additionally, we are continuing our response to a separate high-severity vulnerability released earlier this month.
Citrix has released a security bulletin (CTX693420) disclosing two high-severity vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. Depending on the deployment configuration, these vulnerabilities could allow attackers to bypass management access controls or perform memory over-reads.
Fortinet has announced a critical vulnerability surrounding FortiSwitch Firmware. The vulnerability is related to the switch's password change function. An unauthenticated attacker with access to the GUI could modify passwords via specially crafted requests.
