CISA ADDS TWO ACTIVELY EXPLOITED PHP VULNERABILITIES TO KEV CATALOG AND UPDATES CRITICAL PHP ALERT

THREAT SUMMARY

Category: Actively Exploited Vulnerabilities
Affected Product(s): PHP
CVE(s): CVE-2026-109618, CVE-2026-109619
Primary Risks: Memory corruption, stale internal request-state conditions, potential compromise of vulnerable PHP environments, and follow-on activity depending on deployment conditions
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Organizations operating vulnerable PHP deployments
Attack Vector(s): Vulnerability-specific exploitation involving PHP memory handling and internal request-state behavior
CISA Action: Both vulnerabilities added to the Known Exploited Vulnerabilities Catalog on October 26, 2026; CISA also updated its October 21 PHP alert, Critical Vulnerabilities in PHP Require Immediate Patching
Required Response: Federal Civilian Executive Branch agencies must follow BOD 26-04 risk-based remediation requirements. CISA encourages all organizations to prioritize remediation of KEV-listed vulnerabilities.

---

CISA has added two critical PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog after determining that both are being actively exploited, significantly raising the urgency surrounding flaws the agency had already highlighted in its October 21 PHP security alert.

The October 26 additions are CVE-2026-109618, identified by CISA as a PHP memory corruption vulnerability, and CVE-2026-109619, identified as a PHP stale internal request-state vulnerability. Their addition to the KEV Catalog confirms that attackers are no longer dealing with these weaknesses only as theoretical opportunities. CISA now has evidence that exploitation is occurring.

The move also changes the operational posture surrounding CISA’s earlier PHP warning. On October 21, the agency issued its alert, Critical Vulnerabilities in PHP Require Immediate Patching. Five days later, both CVE-2026-109618 and CVE-2026-109619 were formally placed in the KEV Catalog, reinforcing the need for organizations running vulnerable PHP environments to move remediation and compromise assessment to immediate priority.

CISA’s October 26 notice does not provide named threat actors, detailed exploitation chains, vulnerability-specific indicators of compromise, or complete post-exploitation behavior. Those details should not be inferred. The confirmed fact that both vulnerabilities are under active exploitation is sufficient to require prompt action.

---

Vulnerability Details

CVE-2026-109618 — PHP Memory Corruption Vulnerability

CISA identifies CVE-2026-109618 as a PHP memory corruption vulnerability.

Memory corruption vulnerabilities occur when software improperly handles memory in a way that can cause data to be modified, overwritten, accessed incorrectly, or processed outside intended boundaries. Depending on the affected code path and exploitation conditions, memory corruption can range from application instability to more serious security consequences.

For PHP environments, the risk is significant because PHP remains widely deployed across web servers, content-management systems, application frameworks, APIs, administrative tools, and backend services. A vulnerability in the language runtime or its request-processing behavior can affect many different applications even when those applications themselves contain no direct flaw.

CISA’s October 26 alert does not describe the precise memory corruption mechanism, the privileges available after exploitation, the exact conditions required to trigger the flaw, or whether successful exploitation produces the same result across every affected deployment. Those details should remain tied to applicable PHP technical guidance.

The central confirmed fact is that CVE-2026-109618 is being actively exploited.

---

CVE-2026-109619 — PHP Stale Internal Request-State Vulnerability

CISA identifies CVE-2026-109619 as a PHP stale internal request-state vulnerability.

Request-state handling is fundamental to how server-side applications process incoming activity. If internal state from one request is improperly retained, reused, or exposed during subsequent processing, unintended behavior can occur depending on the affected implementation and runtime conditions.

The classification is particularly important in server environments where PHP may process large numbers of requests across persistent processes or shared application infrastructure. A flaw involving stale internal request state can create conditions in which information or execution context is handled incorrectly between request cycles.

CISA’s alert does not specify the full exploitation mechanism, the exact request conditions required, the affected execution models, or the precise post-exploitation capabilities associated with CVE-2026-109619. Those details should not be expanded beyond what authoritative technical guidance establishes.

What has now changed is the threat status. CVE-2026-109619 has moved into confirmed active exploitation.

---

Affected Products and Environments

CISA identifies PHP as the affected technology for both vulnerabilities. Organizations should determine whether potentially vulnerable PHP deployments exist anywhere within their infrastructure and compare those systems against applicable remediation guidance.

Priority asset review should include:

• Public-facing web servers running PHP.
• Internet-accessible applications backed by PHP.
• Internal business applications using PHP.
• Content-management systems relying on vulnerable PHP runtimes.
• API services and web applications operating on PHP.
• Development, staging, and testing environments.
• Legacy PHP installations that may remain connected to production networks.
• Secondary or disaster-recovery environments.
• Systems operated by hosting providers or managed service providers.
• Containers, virtual machines, or application platforms containing vulnerable PHP runtimes.

Organizations should not assume that updating a single production server resolves the entire exposure. PHP can exist across many application stacks, and vulnerable runtimes may remain inside secondary systems, older web servers, containers, test environments, or isolated applications that fall outside the primary patching cycle.

Accurate inventory is therefore essential. If an organization cannot identify every vulnerable PHP deployment, it cannot confidently determine that remediation is complete.

---

Operational Impact

The most important operational development is that both vulnerabilities now carry KEV status.

Organizations may already have been treating the October 21 PHP alert as a high-priority patching event. The October 26 update raises the urgency further because CISA has now established evidence of active exploitation.

That shift matters because vulnerability management is not simply about technical severity. A flaw can be serious in theory yet remain unused by attackers. KEV inclusion establishes that the vulnerability has crossed into real-world offensive activity.

For PHP environments, the scale of potential exposure can be substantial because the runtime may support many different web applications, websites, administrative interfaces, APIs, and backend services. An organization may not even realize how many systems depend on PHP until a complete asset review is performed.

CISA does not state that successful exploitation of either vulnerability automatically results in full server control, complete data theft, unrestricted lateral movement, or persistence. Those outcomes depend on technical details not contained in the October 26 notice. The confirmed exploitation status still warrants rapid remediation and review of systems that remained vulnerable before corrective action.

---

Why KEV Status Matters

CISA’s Known Exploited Vulnerabilities Catalog helps defenders distinguish vulnerabilities that are already being used in active attacks from the much larger population of disclosed CVEs.

For a vulnerability to qualify for potential inclusion in the KEV Catalog, CISA states that it must have:

• A CVE identifier.
• Evidence of exploitation.
• Clear mitigation guidance.

Both CVE-2026-109618 and CVE-2026-109619 have now crossed that threshold.

This means organizations should not treat the vulnerabilities as routine future maintenance items. CISA has confirmed that attackers are already exploiting them.

KEV status should therefore influence remediation order, incident-response planning, and compromise assessment, particularly for systems exposed to the public internet or hosting critical applications.

---

Federal Response

The October 26 additions fall under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the role of the KEV Catalog in identifying vulnerabilities that require prioritized remediation.

Under the directive, federal agencies must prioritize rapid remediation of high-risk KEV vulnerabilities, specifically those affecting publicly exposed assets where successful exploitation can provide total control of the affected system. The directive also provides for risk-based deferral of lower-risk vulnerabilities under its applicable requirements.

BOD 26-04 also establishes basic expectations for determining when agencies should assess whether a system was compromised before remediation was applied.

That requirement is particularly important for CVE-2026-109618 and CVE-2026-109619 because CISA has confirmed active exploitation. Applying a patch closes the vulnerable condition going forward, but it does not establish whether an attacker already used the flaw while the system remained exposed.

CISA encourages organizations outside the federal government to follow the same risk-based approach and prioritize KEV-listed vulnerabilities.

---

Defensive Guidance

Organizations operating PHP should begin by identifying all potentially affected deployments and determining whether those systems remain vulnerable under applicable PHP remediation guidance.

Priority defensive actions should include:

• Inventory all PHP installations across production and non-production environments.
• Record deployed PHP versions and build information.
• Identify internet-facing applications running vulnerable PHP versions.
• Apply supported security updates or vendor-recommended mitigations.
• Prioritize publicly exposed servers and externally reachable applications.
• Verify that remediation completed successfully.
• Review containers, virtual machines, legacy hosts, and secondary environments.
• Confirm that staging and development systems are not overlooked.
• Restrict unnecessary external access to administrative or application interfaces.
• Preserve relevant security and application logs before major changes when compromise is suspected.
• Review activity occurring before remediation for unexplained behavior.
• Verify that hosting providers or third-party administrators have also addressed affected systems.

Organizations should validate remediation directly. Patch-management records or update schedules can show that corrective action was planned or attempted, but technical confirmation is necessary to establish that every vulnerable PHP runtime has actually been corrected.

---

Compromise Assessment

Because CISA has confirmed active exploitation of both vulnerabilities, organizations should consider whether affected PHP systems may have been compromised before remediation.

The October 26 alert does not provide vulnerability-specific indicators of compromise. General suspicious behaviors should therefore not be described as confirmed evidence associated directly with CVE-2026-109618 or CVE-2026-109619.

Potential areas for review include:

• Unexpected web-server or PHP process behavior.
• Abnormal child processes spawned from PHP or web-server processes.
• Unexplained command execution.
• Suspicious outbound network connections.
• Unexpected file creation or modification.
• Unauthorized changes to web application files.
• Newly created user or administrator accounts.
• Changes to application or server configuration.
• Unusual authentication activity.
• Unexpected scheduled tasks or persistence mechanisms.
• Gaps or unexplained clearing in application, web-server, or system logs.
• Requests or traffic patterns inconsistent with normal application use.

Organizations should also review whether potentially exposed credentials, tokens, application secrets, or configuration files were accessible from affected systems.

If suspicious activity is identified, incident response should expand beyond patching. That may include forensic preservation, credential rotation, session revocation, examination of connected systems, verification of application integrity, and investigation of possible persistence or lateral movement.

---

30-Day Outlook

During the next 30 days, organizations should focus on verifying complete remediation across affected PHP environments and assessing systems that may have remained exposed before security updates were applied. The October 26 KEV additions establish the need for risk-based prioritization, particularly where vulnerable systems support publicly accessible services.

Priority actions during this period should include:

• Confirming remediation across production and non-production PHP environments.
• Identifying legacy servers, outdated container images, and overlooked PHP installations.
• Verifying that underlying PHP runtimes have been updated independently of the applications they support.
• Reviewing externally accessible systems for signs of compromise before remediation.
• Assessing secondary infrastructure, backup environments, and disaster-recovery systems.
• Confirming that hosting providers and managed service providers have addressed vulnerable deployments.
• Monitoring CISA and official PHP security advisories for additional technical findings, exploitation details, and remediation instructions.
• Validating completed updates through technical verification rather than relying exclusively on patch-management records.

The principal challenge will be determining whether remediation has reached every vulnerable environment. An organization may successfully update its primary production infrastructure while retaining exposed PHP installations elsewhere in its network. Comprehensive verification remains necessary to establish that the vulnerabilities have been addressed across the complete operational environment.

---

TRJ Verdict

CISA’s October 26 addition of CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities Catalog marks a significant escalation from the agency’s October 21 warning concerning critical PHP vulnerabilities.

CVE-2026-109618 involves memory corruption, while CVE-2026-109619 involves stale internal request state. The weaknesses affect different aspects of PHP processing, but both now carry the same operational reality: CISA has evidence that attackers are actively exploiting them.

Organizations should identify vulnerable PHP deployments, apply appropriate remediation, validate that updates were successfully completed, and review systems that remained exposed before patching for evidence of compromise. Federal agencies must follow the risk-based requirements established under BOD 26-04, while organizations outside the federal government have the same practical reason to place these vulnerabilities near the top of their remediation priorities.

The October 26 update also reinforces a broader security requirement. PHP is not simply a component hidden beneath a website or application. It is part of the execution environment that supports critical web infrastructure, and weaknesses at that layer can affect every application depending on the vulnerable runtime.

Once active exploitation is confirmed, patching should no longer be treated as routine maintenance. It becomes part of incident prevention and compromise assessment.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---