CISA adds two exploited PHP flaws to the KEV catalog
Original title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2026-109618 and CVE-2026-109619 are known exploited; BOD 26-04 tells FCEB agencies to remediate them first.
CISA added CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability, to the Known Exploited Vulnerabilities catalog. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize KEV entries on publicly exposed assets that grant total control after exploitation, and to check for compromise before a patch. CISA urges other organizations to remediate KEV vulnerabilities on a risk basis. Due dates are not stated in the alert.
Unconfirmed: The alert does not give affected versions, fixed versions, or agency deadlines.
- CVE-2026-109618 is described as PHP memory corruption.
- CVE-2026-109619 is a stale internal request-state flaw.
- KEV nominations need a CVE ID, exploitation evidence, and mitigation guidance.
- The directive applies only to FCEB agencies.
Impact: Known exploited PHP flaws; specific attacker gain not detailed
| Product | Affected |
|---|---|
| PHP | — |
- 1.Prioritize remediation of both KEV entries on publicly exposed assets.
- 2.Check whether systems were compromised before the patch was applied.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching: CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the…
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.