What happened
The Cybersecurity and Infrastructure Security Agency (CISA) added two newly disclosed PHP flaws—CVE‑2026‑109618 and CVE‑2026‑109619—to its Known Exploited Vulnerabilities (KEV) catalog on Monday. Within days, CISA observed active exploitation attempts targeting both bugs and issued an emergency directive requiring all civilian federal agencies to apply the vendor‑released patches or isolate affected systems by Thursday. While public proof‑of‑concept exploits remain limited, Sophos, Palo Alto Networks and several independent researchers reported successful exploitation attempts and thousands of failed attacks across the internet. CISA’s advisory urges organizations to inventory every PHP instance, apply patches immediately, or temporarily take PHP‑based services offline; web‑application firewalls may provide short‑term mitigation.
Why it matters for trust and compliance
- The incident demonstrates why organizations must maintain a continuous vulnerability‑management process that can quickly identify, prioritize, and evidence remediation of critical software flaws—a control that maps to multiple frameworks such as NIST CSF and ISO 27001.
- Enable continuous scanning to surface high‑risk vulnerabilities and generate real‑time remediation evidence.
- Provide audit‑ready documentation of patch deployment to satisfy control‑assessment requirements across frameworks.
Who is affected
Technology Government Retail Healthcare
Recommended actions
- Inventory all PHP runtimes across production and test environments.
- Apply the official patches for CVE‑2026‑109618 and CVE‑2026‑109619 immediately.
- If patching is not possible, isolate or shut down the vulnerable services.
- Leverage a Web Application Firewall to block known exploit patterns while remediation occurs.
- Integrate vulnerability findings into change‑management and retain remediation logs for audit purposes.