CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 26, 2026, and updated the PHP Alert titled Critical Vulnerabilities in PHP Require Immediate Patching. The additions are CVE-2026-109618 (PHP Memory Corruption Vulnerability) and CVE-2026-109619 (PHP Stale Internal Request-State Vulnerability). These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Who this affects
- For exporters: Not specified in the record.
- For investors: Not specified in the record.
- For counsel/compliance: Binding Operational Directive (BOD) 26-04 establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies and requires prioritization of rapid remediation of high-risk KEV Catalog vulnerabilities on publicly exposed assets that grant total control of the asset post-exploitation.
- For policymakers: BOD 26-04 applies only to FCEB agencies; CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
The read
The addition places the two CVEs under the existing BOD 26-04 framework that prioritizes high-risk KEV entries on publicly exposed assets granting total control while deferring lower-risk items, and that sets basic expectations for checking whether systems were compromised before patching. The alert restates the criteria for future catalog entries: a CVE ID, evidence of exploitation, and clear mitigation guidance.
What was the action?
CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities Catalog and updated the related PHP Alert.
What’s the penalty / scope, and how is it set?
No penalty. The action adds the two CVEs to the KEV Catalog. BOD 26-04 requires FCEB agencies to prioritize rapid remediation of high-risk vulnerabilities listed in the catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. The directive applies only to FCEB agencies.
Who else is exposed?
Not specified in the record. CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
What happens next
CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.