# CISA Adds Two PHP Flaws to KEV Catalog

Published: 2026-10-26 · Severity: severe · Sectors: Government (National)
Canonical: https://vorant.io/reports/cdbc649c-4826-57e1-a16f-9d5b0d8d598d/cisa-adds-two-php-flaws-to-kev-catalog

> CISA added two actively exploited PHP vulnerabilities, memory corruption and stale internal request-state, to its Known Exploited Vulnerabilities catalog.

CISA has added two newly identified PHP vulnerabilities, CVE-2026-109618 (PHP Memory Corruption Vulnerability) and CVE-2026-109619 (PHP Stale Internal Request-State Vulnerability), to its Known Exploited Vulnerabilities (KEV) Catalog, updating a prior PHP alert that called for immediate patching. Both CVEs are confirmed to be exploited in the wild, making them a priority for remediation per CISA guidance.

Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to remediate KEV-listed vulnerabilities on publicly exposed assets rapidly, particularly those that grant full control of the asset post-exploitation, and to verify whether compromise occurred prior to patching. While the directive is binding only on FCEB agencies, CISA recommends all organizations running affected PHP versions apply patches promptly and check for signs of prior compromise given confirmed in-the-wild exploitation.

Defenders should identify any PHP installations in their environment, confirm whether they are affected by these two CVEs, apply available patches as soon as possible, and review logs for indicators of exploitation predating remediation. No technical exploitation details or affected version ranges were provided in this bulletin; organizations should consult CISA's PHP alert and vendor advisories for specifics.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (KEV), CVE-2026-109619 (KEV)

Source reporting: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cdbc649c-4826-57e1-a16f-9d5b0d8d598d/cisa-adds-two-php-flaws-to-kev-catalog.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup