CISA Confirms Attacks on Two PHP Flaws as Millions of Websites Remain Exposed

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. Federal civilian agencies were ordered to patch by Thursday. CISA did not explain the nature of the exploitation or who was targeted, but noted that its definition of active exploitation includes both attempted and successful attacks.

The flaws raised global alarm because PHP runs the vast majority of websites, with some estimates putting its use at more than 70% of the internet. Experts initially tempered fears of mass exploitation because no viable proof-of-concept exploits existed. That changed when several experts found ways to exploit the bugs by Sunday. Sophos and Palo Alto Networks both posted and then retracted claims of successful exploitation. Dozens of security and tech companies have reported thousands of failed attack attempts, and dozens of governments and businesses took websites offline last week.

CISA urged organisations to inventory every system running any version of PHP, then patch or take PHP-based systems offline if they cannot be updated straight away. Web application firewalls may give some temporary protection. Guidance from Australian authorities is linked in the advisory. Experts remain deeply concerned that millions of sites run very old PHP versions that likely cannot be updated. Censys data shows that of 42 million internet-facing PHP services, more than 10 million have been patched since October 21.