CISA warned federal agencies to patch two PHP vulnerabilities by Thursday, adding them to the Known Exploited Vulnerabilities (KEV) list.
The vulnerability or weakness
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-109618 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
| CVE-2026-109619 | 9.2 | CRITICAL | Yes, added 2026-10-26 | 2026-10-29 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
No earlier related attack in our archive yet.
Business impact
Organizations are advised to identify and inventory PHP systems, apply patches, or take systems offline to avoid potential disruptions and data breaches.
Industries affected
This affects all organizations, particularly those using PHP in web applications and web services.
Users affected
Users of PHP-based websites and applications could be at risk of unauthorized access or data theft if systems remain unpatched.
