Cyber ·
CISA adds two PHP vulnerabilities to the KEV catalog and calls for priority fixes
CISA added two PHP flaws, CVE-2026-109618 and CVE-2026-109619, to the KEV catalog and updated its alert, recommending that organizations apply the fixes immediately.
On October 26, 2026, CISA, the United States cybersecurity agency, reported adding two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and updating its alert on PHP. The listed flaws are CVE-2026-109618, a memory corruption vulnerability, and CVE-2026-109619, a stale internal request state vulnerability. The agency says these vulnerability types are a frequent attack vector for malicious actors and pose significant risks to the federal sector.
The notice mentions Binding Operational Directive (BOD) 26-04, which directs US federal civilian executive branch agencies to prioritize fixing high-risk KEV-listed vulnerabilities on publicly exposed assets, and to check for compromise before patching. The directive applies only to those agencies, but CISA encourages all organizations to adopt risk-based vulnerability management and to prioritize the KEV catalog.
To consult and verify, open the original alert directly on the official CISA website, search for the two CVEs cited, and check which PHP version your systems run. The agency also accepts nominations of exploited vulnerabilities that have a CVE identifier, evidence of exploitation, and clear mitigation guidance.
Original source: CISA adiciona duas vulnerabilidades exploradas ao catálogo KEV