WatchGuard Fireware OS Affected by 15 Vulnerabilities Including Critical CVE-2026-86131
WatchGuard Technologies has disclosed 15 vulnerabilities affecting Fireware OS, the operating system used in its UTM appliances. The company released multiple security advisories on September 29–30, 2026.
Although the exact impact depends on each environment, the flaws collectively enable code execution, authorization bypass, unauthorized file access, and denial-of-service conditions. At the time of disclosure, WatchGuard stated that no exploitation in the wild had been confirmed.
Critical vulnerability in BOVPN Over TLS
The highest-rated issue, tracked as CVE-2026-86131, carries a CVSS v4.0 base score of 9.2 and a Critical severity rating. The flaw resides in the client-configuration processing logic of the BOVPN Over TLS feature. An attacker who can control the destination VPN server can inject code that results in arbitrary command execution with root privileges on the connecting Firebox appliance.
The remaining 14 vulnerabilities are documented in separate advisories and affect various subsystems of Fireware OS. They are identified by the following CVE numbers:
- CVE-2026-86134
- CVE-2026-86104
- CVE-2026-81433
- CVE-2026-18145
- CVE-2026-86132
- CVE-2026-86133
- CVE-2026-13224
- CVE-2026-86128
- CVE-2026-13046
- CVE-2026-86101
- CVE-2026-86136
- CVE-2026-90441
- CVE-2026-18105
- CVE-2026-86105
Administrators are advised to review the official WatchGuard advisories and apply the corresponding patches as soon as possible.
Related articles
PHP Foundation Reveals Two Critical RCE Vulnerabilities Fixed After 2024 Discovery Delays
The PHP Foundation has disclosed details surrounding two severe remote code execution vulnerabilities in PHP that were addressed in updates released on October 21, 2026. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, affect memory management and error handling routines used in nearly every request. Although signs of one flaw were identified during an external audit in 2024, resource constraints and prioritization of other issues delayed remediation. The foundation had planned a coordinated disclosure, but information leaked prematurely, causing confusion among stakeholders. Updated versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are now available, and immediate patching is strongly recommended for all users. The vulnerabilities' broad impact and the challenges in balancing security fixes with performance considerations made the response particularly complex.
CISA Urges Immediate Patching of Critical PHP Remote Code Execution Vulnerabilities
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding two severe vulnerabilities in the PHP programming language that allow unauthenticated remote code execution. Identified as CVE-2026-109618 and CVE-2026-109619, the flaws affect all environments processing web requests with PHP and have been nicknamed php2shell. CISA recommends applying patches to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 without delay, or taking affected systems offline if updates cannot be applied immediately. Although no exploitation has been observed yet, organizations are instructed to inventory PHP usage, prioritize internet-facing systems, and monitor for suspicious activity such as shell processes spawned from PHP workers. Web application firewalls may offer partial protection but are not considered a substitute for patching.
GitLab Issues Critical Patches for CVE-2026-110264 Affecting Wide Range of Versions
GitLab has released emergency security updates to address multiple vulnerabilities, including one rated critical that allows unauthenticated remote code execution. The flaw, tracked as CVE-2026-110264, stems from an integer overflow in the regular expression compiler and carries a maximum CVSSv3.1 base score of 10.0. It impacts GitLab Community Edition and Enterprise Edition starting from version 7.0, with patches now available for both current and older branches. The company strongly urges immediate updates due to the severity and potential for arbitrary code execution on affected servers. Additional lower-severity issues were also resolved in the same release cycle.
PHP Issues Emergency Patches for Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
PHP has released urgent patches for two critical vulnerabilities collectively known as PHP2Shell that enable unauthenticated remote code execution on affected servers. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, score 9.2 on CVSS v4.0 and have already seen active exploitation attempts with malicious payloads adjusted to bypass WAF rules. The issues affect multiple PHP deployment methods including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and do not require complex application code to be exploitable. CVE-2026-109618 involves a memory corruption chain leading to code execution under the web process privileges, while CVE-2026-109619 stems from an obsolete global state issue causing use-after-free conditions that can result in memory disclosure and code execution. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with administrators advised to restart all persistent workers after updating. Temporary mitigations such as setting memory_limit to -1 and disabling session.upload_progress.enabled are available for environments that cannot patch immediately.