CISA orders agencies to patch two targeted PHP bugs by Thursday
Original title: CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
CVE-2026-109618 and CVE-2026-109619 drew thousands of failed attempts; confirmed successful exploitation remains unproven.
CISA added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog and ordered civilian federal agencies to patch by Thursday. CISA's KEV rules treat both attempted and successful exploitation as active exploitation, and the agency would not describe victims. Sophos and Palo Alto Networks posted, then retracted, claims of successful exploitation, while experts found exploit methods by Sunday. CISA tells organizations to inventory every PHP version, patch or take systems offline, and notes firewalls may help temporarily.
Unconfirmed: Successful exploitation is unconfirmed; Sophos and Palo Alto retracted such claims, and CISA counts attempts as active exploitation.
- Dozens of firms reported thousands of failed attack attempts.
- Censys says over 10 million of 42 million internet-facing PHP services were patched since October 21.
- Some estimates put PHP on more than 70 percent of websites.
- Guidance is linked from PHP and agencies in Australia, Canada, New Zealand and the U.K.
Impact: Attackers are attempting to exploit PHP on internet-facing sites
| Product | Affected |
|---|---|
| PHP | Any version |
- 1.Inventory systems running any PHP version and apply the vendor patch.
- 2.Take unpatched PHP systems offline if they cannot be updated immediately.
- 3.Consider a web application firewall as temporary protection.
- Products
- PHP
- Organizations
- CISASophosPalo Alto NetworksCensys
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
2 min read at therecord.mediaCISA added the widely publicized PHP vulnerabilities to the KEV, but didn't specify what kind of exploitation it was observing.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.