Government Advisory

Two PHP Flaws Added to CISA's Exploited Vulnerabilities List: Time to Check Your Websites

CISA · 26 Oct 2026

Key Takeaway If your website or web applications run on PHP, ask your developer or hosting provider to confirm the latest PHP patches are applied now, and to check for signs of compromise on any internet-facing systems that were exposed before patching.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two new PHP vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, which lists flaws that are being used in real attacks. The two flaws are CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability. CISA also updated its existing alert, "Critical Vulnerabilities in PHP Require Immediate Patching".

CISA notes that these types of vulnerabilities are a frequent attack vector for malicious cyber actors. Its binding directive, BOD 26-04, requires US federal civilian agencies to prioritise rapid fixes for KEV-listed flaws on publicly exposed assets where an attacker could gain total control after exploitation. The directive also sets basic expectations for checking whether a system was compromised before the patch was applied.

The directive applies only to US federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and prioritise their security updates accordingly.

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.