CISA Adds Two PHP Flaws to KEV Catalog
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
CISA added two actively exploited PHP vulnerabilities, memory corruption and stale internal request-state, to its Known Exploited Vulnerabilities catalog.
CISA has added two newly identified PHP vulnerabilities, CVE-2026-109618 (PHP Memory Corruption Vulnerability) and CVE-2026-109619 (PHP Stale Internal Request-State Vulnerability), to its Known Exploited Vulnerabilities (KEV) Catalog, updating a prior PHP alert that called for immediate patching. Both CVEs are confirmed to be exploited in the wild, making them a priority for remediation per CISA guidance.
Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on publicly exposed assets rapidly, particularly those that grant full control of the asset post-exploitation, and to verify whether compromise occurred prior to patching. While the directive is binding only on FCEB agencies, CISA recommends all organizations running affected PHP versions apply patches promptly and check for signs of prior compromise given confirmed in-the-wild exploitation.
Defenders should identify any PHP installations in their environment, confirm whether they are affected by these two CVEs, apply available patches as soon as possible, and review logs for indicators of exploitation predating remediation. No technical exploitation details or affected version ranges were provided in this bulletin; organizations should consult CISA's PHP alert and vendor advisories for specifics.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 14,256 reports from 143 sources, 599 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs