CISA Adds Two Known‑Exploited PHP Vulnerabilities (CVE‑2026‑109618, CVE‑2026‑109619) to KEV Catalog
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) announced that two PHP‑related flaws have been added to its Known Exploited Vulnerabilities (KEV) Catalog.
- CVE‑2026‑109618 – a memory‑corruption bug that can allow an attacker to achieve arbitrary code execution on affected PHP installations.
- CVE‑2026‑109619 – a “stale internal request‑state” issue that may let an adversary manipulate request handling, potentially leading to privilege escalation or data leakage.
Both vulnerabilities are confirmed to be actively exploited in the wild and are classified as high‑risk. CISA’s Binding Operational Directive 26‑04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV items on publicly exposed assets, and it encourages all organizations to adopt the same risk‑based patching discipline. No public patches are detailed in the advisory; administrators should apply the latest PHP security updates as soon as they are released.
Affected Products – PHP runtime (all supported versions that have not yet applied the latest security patches).
Why It Matters for Trust & Control Assurance – The findings test the vulnerability‑management control objective: organizations must continuously identify, assess, and remediate high‑risk software flaws to maintain defensible audit evidence.
Recommended Actions –
- Verify which assets run PHP and confirm their version.
- Apply the vendor‑supplied patches for CVE‑2026‑109618 and CVE‑2026‑109619 immediately.
- Record remediation dates and evidence in your control‑mapping repository to satisfy audit requirements.
- Conduct a post‑patch validation scan to ensure the flaws are fully mitigated.
Source: CISA Advisory – 2026‑10‑26