CISA, the US cyber defense agency, added two PHP flaws to its Known Exploited Vulnerabilities (KEV) catalog, in a notice dated 26 October. The two are CVE-2026-109618, a memory corruption flaw, and CVE-2026-109619, a stale internal request-state flaw. CISA also updated its existing PHP alert, which calls for immediate patching of critical PHP flaws. The notice adds that these types of vulnerabilities are a frequent attack vector and pose significant risks to the federal enterprise.
The notice names the two flaws but gives no exploitation details for them. It does not list affected PHP versions, name who is attacking, or describe fixes. CISA restated Binding Operational Directive 26-04. It requires federal civilian agencies to fix KEV-listed flaws quickly on publicly exposed assets where an attack gives total control, and it lets them defer lower-risk flaws. It also sets basic expectations for checking whether attackers got in before the patch. The directive covers only those agencies.
A KEV listing turns a long patch queue into a ranked list. CISA urges all organizations to manage flaws by risk and to put KEV flaws first. Leaders can ask three questions. Which of our systems run PHP? Which of them are publicly exposed? Could we show whether anyone got in before we patched?