CISA lists PHP flaws as exploited, sets 29 October deadline
The United States Cybersecurity and Infrastructure Security Agency (CISA) has added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalogue, marking a new formal step in the response to the PHP flaws that have dominated security warnings this month. The entries, added on 26 October, cover CVE-2026-109618, a memory corruption flaw, and CVE-2026-109619, a stale internal request-state flaw. CISA said both types of vulnerability are a frequent attack route for malicious actors and pose significant risks to the federal enterprise. Inclusion in the catalogue means CISA has evidence the flaws have been exploited in the wild, rather than merely being theoretically exploitable.
What systems are most at risk
The PHP Group, which maintains the language, rates both flaws at 9.2 under CVSS version 4.0. It describes Apache installations using the mod_php module as the highest-risk deployment, because an attack can run before application code in that setup. Other web-serving setups are also in scope, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October. Versions 8.1 and earlier receive no further project patches, which leaves operators of older versions with a harder choice.
What happens if patching is not possible
Under Binding Operational Directive 26-04, United States Federal Civilian Executive Branch agencies must prioritise remediation of the listed flaws on publicly exposed assets where exploitation grants total control, and must check whether a system was already compromised before or while a patch is applied. Their due date for these two entries is 29 October. The directive binds federal civilian agencies only; CISA encourages other organisations to follow the same risk-based approach. For systems that cannot be updated immediately, or that still run unsupported versions, CISA's updated alert directs operators to take the PHP-based systems offline until they can be patched, rather than leaving a known exploited flaw exposed while waiting for a maintenance window.
