Map

Serial number:AV26-1080
Date:October 23, 2026

As of October 22, 2026, Arista Networks is affected by a vulnerability in the following product:

• VeloCloud Orchestrator (VCO)
  • Prior to 5.2.3.18
  • Prior to 6.1.3.10
  • Prior to 6.4.2.12

Arista Networks indicates that CVE-2026-114625 is exploited in the wild.

Update 1

On October 23, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-114625 to their Known Exploited Vulnerabilities (KEV) Database.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Security Advisory 0199
• Arista Networks Advisories & Notices
• CISA KEV: CVE-2026-114625

Number: AL26-026
Date: October 21, 2026
Updated: October 23, 2026

Audience

This Alert is intended for IT professionals and managers.

Purpose

An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested.

Details

The Canadian Centre for Cyber Security (Cyber Centre) is aware of critical vulnerabilities affecting PHP^Footnote1. In response to the vendor advisory, the Cyber centre released an advisory on October 21, 2026^Footnote2.

Tracked as CVE-2026-109618^Footnote3 and CVE-2026-109619^Footnote4, these vulnerabilities are Use After Free vulnerabilities (CWE-416)^Footnote5 affecting multiple versions of PHP. Known as “php2shell”^Footnote6, successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system. Internet-facing PHP servers and applications are at heightened risk.

The PHP Security Team has released security updates addressing these vulnerabilities. Organizations should identify affected systems and apply the appropriate updates immediately.

PHP remains a widely deployed technology and continues to support a substantial proportion of web applications worldwide.

All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are at risk. PHP assess the risk as greatest for mod_php, as a demonstrated exploit allows an unauthenticated request to trigger the vulnerability before application-level code is executed.

The Cyber Centre has observed open-source reporting indicating that a Proof of Concept (PoC) is available, with no active exploitation being identified at this time, but that can change quickly.

Suggested actions

The Cyber Centre strongly recommends that organizations running affected PHP versions upgrade to the following fixed version:

Note: versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.

The Cyber Centre recommends that organizations:

• Update affected PHP installations immediately to a fixed, supported release.
• Prioritize Internet-facing systems and applications that process untrusted input.
• Identify third-party products, appliances and containers that include vulnerable PHP components^Footnote7.
• Where immediate remediation is not feasible, organisations should consider isolating internet-facing applications from public networks until a fix can be applied.
• Monitor for potential compromise by reviewing web server, application, authentication, and endpoint logs for suspicious activity.
• Investigate unexpected processes, commands, files, accounts or outbound connections associated with PHP or web-server services.
• Continuously monitor third-party vendors for security updates, including appliances, applications and services that bundle PHP, and apply applicable patches without delay.

Organizations should also review the Cyber Centre’s Top 10 IT Security Actions^Footnote8.

Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email contact@cyber.gc.ca.

References

Serial number:AV26-1081
Date:October 23, 2026

As of October 21, 2026, Fortinet is affected by vulnerabilities in the following products:

• FortiAnalyzer 8.0
  • Versions prior to 8.0.2
• FortiAnalyzer 7.6
  • Versions prior to 7.6.8
• FortiAnalyzer 7.4
  • Versions prior to 7.4.12
• FortiAnalyzer 7.2
  • Versions prior to 7.2.13
• FortiAuthenticator 8.0
  • Versions prior to 8.0.4
• FortiAuthenticator 6.6
  • Versions prior to 6.6.11
• FortiMail 8.0
  • Versions prior to 8.0.2
• FortiMail 7.6
  • Versions prior to 7.6.7
• FortiMail 7.4
  • Versions prior to 7.4.9
• FortiMail 7.2
  • Upgrade to branch 7.4 or above
• FortiManager 8.0
  • Versions prior to 8.0.2
• FortiManager 7.6
  • Versions prior to 7.6.8
• FortiManager 7.4
  • Versions prior to 7.4.12
• FortiManager 7.2
  • Versions prior to 7.2.13
• FortiOS 8.0
  • Versions prior to 8.0.2
• FortiOS 7.6
  • Versions prior to 7.6.8
• FortiOS 7.4
  • Versions prior to 7.4.13
• FortiOS 7.2
  • Versions prior to 7.2.14

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Fortinet Releases Security Hardening Release for Multiple Products
• Fortinet PSIRT Advisories

Serial Number:AV26-1037
Date:October 13, 2026
Updated:October 23, 2026

As of October 13, 2026, Fortinet is affected by vulnerabilities in the following products:

• FortiAnalyzer
  • Prior to 7.6.5
  • Prior to 7.4.8
  • Prior to 7.6.5
• FortiAnalyzer Cloud
  • Prior to 7.6.5
  • Prior to 7.4.8
  • Prior to 7.2.12
• FortiManager
  • Prior to 7.6.5
  • Prior to 7.4.7
• FortiManager Cloud
  • Prior to 7.6.5
• FortiMail
  • Prior to 7.6.4
  • Prior to 7.4.6
  • Prior to 7.2.9
• FortiSIEM
  • Prior to 7.5.1
• FortiSandbox
  • Prior to 4.4.10
  • Prior to 5.0.7
• FortiSandbox PaaS
  • 4.4 all versions
  • Versions prior to 5.0.7

Update 1

Open-source reporting indicates that CVE-2026-106173 is being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Multiple Arbitrary File Read/Write via SQL Injection
• Arbitrary file write in grpc phQueryMaster
• SQL command injection in webmail
• Improper access control and session management in the web management interface
• Fortinet PSIRT Advisories

Serial number:AV26-1079
Date:October 22, 2026

As of October 22, 2026, Hewlett Packard Enterprise (HPE) is affected by vulnerabilities in the following product:

• HPE Networking Wireless Operating Systems - AOS
  • Versions prior to 10.8.1.2
  • Versions prior to 10.7.2.7
  • Versions prior to 10.4.1.14
  • Versions prior to 8.13.3.1
  • Versions prior to 8.10.0.24

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• HPESBNW05162 rev.1 - Multiple Vulnerabilities in HPE Networking Wireless Operating Systems (AOS-10 & AOS-8)
• HPE Security Bulletin Library

Serial number:AV26-1078
Date:October 22, 2026

As of October 22, 2026, MongoDB is affected by vulnerabilities in the following product:

• C# Driver
  • Prior to 3.13.0

The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.

• Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization
• Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache
• MongoDB Alerts