CISA KEV Alert: Two Critical PHP Vulnerabilities Demand Immediate Action
CVE-2026-109618 and CVE-2026-109619 are actively exploited — here's what your security team must do in the next 30 days
Published 2026-10-27
# CISA KEV Alert: Two Critical PHP Vulnerabilities Demand Immediate Action
CISA has added two actively exploited PHP vulnerabilities — CVE-2026-109618 (PHP Memory Corruption) and CVE-2026-109619 (PHP Stale Internal Request-State) — to its Known Exploited Vulnerabilities (KEV) Catalog, simultaneously updating its PHP security alert to flag both flaws as requiring immediate patching.
What the Advisory Actually Says
The two vulnerabilities affect PHP in ways that threat actors are already exploiting in the wild. CVE-2026-109618 involves a memory corruption condition that, if successfully triggered, can give an attacker significant control over an affected host. CVE-2026-109619 relates to stale internal request-state handling — a class of flaw that can be abused to manipulate how PHP processes requests, potentially bypassing authentication or authorization logic.
CISA's addition of both CVEs to the KEV Catalog is not a passive notification. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are now required to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets — particularly those where successful exploitation grants full control of the asset. BOD 26-04 also establishes a formal expectation that agencies verify whether systems were compromised before a patch was applied, making post-exploitation forensics a compliance obligation, not just good practice.
Why This Matters Beyond Federal Networks
While BOD 26-04 is a federal directive, the downstream pressure on private-sector organizations is real and immediate. PHP powers a significant share of web infrastructure globally, meaning the attack surface is enormous. More importantly, the compliance frameworks that govern most enterprises treat actively exploited CVEs on public-facing systems as a material risk event:
- NIS2 requires essential and important entities in the EU to implement vulnerability-handling policies and report significant incidents. An unpatched KEV-listed flaw on an internet-facing asset is exactly the kind of gap NIS2 supervisory authorities will scrutinize.
- ISO 27001 (Annex A.8.8) mandates timely identification and remediation of technical vulnerabilities.
- PCI DSS v4.0 (Requirement 6.3) requires that all system components are protected from known vulnerabilities by installing applicable security patches.
- SOC 2 (CC7.1) and HIPAA Security Rule (§164.308(a)(5)) both require organizations to monitor for and respond to newly identified threats in a timely manner.
An unpatched PHP instance discovered during an audit — or worse, after a breach — becomes evidence of control failure across multiple frameworks simultaneously.
What Your Team Should Do in the Next 7–30 Days
Within 7 days:
- Inventory all PHP versions running across your environment, including web servers, CMS platforms, APIs, and containerized workloads.
- Identify any publicly exposed assets running affected PHP versions and prioritize them for immediate patching or isolation.
- Run threat-hunting queries against endpoint and network telemetry to check for indicators of compromise before patching — BOD 26-04's forensic requirement is best practice for everyone.
Within 30 days:
- Apply vendor-supplied patches across all remaining internal PHP deployments.
- Update your vulnerability management policy to formally reference CISA's KEV Catalog as a prioritization input — this directly satisfies NIS2 Article 21 and ISO 27001 Annex A.8.8 documentation requirements.
- Conduct a gap assessment against your applicable compliance frameworks to confirm no related controls are in a degraded state.
- Document your remediation timeline and evidence for auditors.
Start Your Free Trial — Every Feature, No Credit Card
RDS GoSOC AI maps vulnerabilities like these directly to your active compliance frameworks — including NIS2, SOC 2, ISO 27001, HIPAA, PCI DSS, and 22 more — so your team can see control gaps, generate audit evidence, and track remediation in a single platform. Start your 14-day free trial with every paid feature unlocked and no credit card required. Once inside, open the User Guide tab for a structured walkthrough, or type your question directly into Sage, the platform's AI assistant, to get framework-specific guidance in seconds.
---
#MSP #ManagedServices #CMMC #FedRamp #CyberSecurity #SOC #SecurityOperations #MSSP #ThreatDetection #Compliance #CloudSecurity #IdentitySecurity #SecurityMonitoring #ITServices #CyberResilience #ManagedSecurity #BusinessGrowth