PHP: 2 Actively-Exploited Flaws Added to CISA KEV
Key findings • PHP has two new actively exploited vulnerabilities in CISA's KEV. • CVE-2026-109618 and CVE-2026-109619 are confirmed under active attack. • Federal agencies must remediate…
Key findings
- PHP has two new actively exploited vulnerabilities in CISA's KEV.
- CVE-2026-109618 and CVE-2026-109619 are confirmed under active attack.
- Federal agencies must remediate these flaws by CISA's deadline.
- All PHP users should apply patches immediately to mitigate risks.
CISA has added two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) Catalog. This addition on October 26, 2026, signals that these flaws are under active exploitation by threat actors in the wild, posing immediate and significant risks to organizations utilizing PHP-based applications and systems. The KEV catalog serves as a critical resource for defenders, highlighting vulnerabilities that require urgent attention due to their proven exploitation.
The two vulnerabilities, while distinct, both present serious security concerns:
- **CVE-2026-109618**: This flaw is a critical remote code execution (RCE) vulnerability that could allow an unauthenticated attacker to execute arbitrary code on affected PHP installations. Such an exploit could lead to full system compromise, data exfiltration, or the deployment of further malicious payloads.
- **CVE-2026-109619**: This vulnerability is described as an arbitrary file upload flaw, which could enable attackers to upload malicious scripts or files to a server running vulnerable PHP versions. Successful exploitation could grant attackers persistent access, facilitate web shell deployment, or lead to broader network intrusion.
The inclusion of these PHP vulnerabilities in the KEV catalog underscores the urgent need for remediation. CISA mandates that federal civilian executive branch (FCEB) agencies address KEV entries by specific deadlines, but the active exploitation status means all organizations, regardless of sector, should prioritize patching. These types of flaws are frequently leveraged as initial access vectors in sophisticated attacks, including those leading to ransomware deployment or espionage.
Defenders must act swiftly to protect their PHP environments. The primary recommendation is to immediately apply all available security updates and patches for PHP to mitigate CVE-2026-109618 and CVE-2026-109619. Organizations should also review their web application firewall (WAF) rules, implement robust input validation, and monitor their systems for any signs of compromise. Regular vulnerability scanning and penetration testing can help identify and address similar weaknesses before they are exploited.