CISA Adds Two Known Exploited Vulnerabilities to Catalog
Critical · CVSS 9.2 (vendor) · fetched 2026-10-26
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
Remediation
Apply the updates and mitigations in the source advisory; if no fix is available, follow the advisory's guidance on restricting or discontinuing use.
Affected PHP branches
PHP 8.2 → fixed in 8.2.35, PHP 8.3 → fixed in 8.3.36, PHP 8.4 → fixed in 8.4.27, PHP 8.5 → fixed in 8.5.12, PHP <8.2 → end-of-life — no fixed release; branch upgrade required
Source: CISA Cybersecurity Advisories · retrieved 2026-10-26T20:20:15-04:00 · https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog