What happened
CISA placed two critical PHP vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) in its Known Exploited Vulnerabilities catalog after detecting in‑the‑wild remote code execution against Apache mod_php. The flaws allow unauthenticated attackers to execute arbitrary code on any server running unpatched PHP 8.4.26. Proof‑of‑concept exploits were published before the patches were released, and multiple security firms observed exploitation attempts. Perplexity’s honeypots recorded successful RCE, confirming active exploitation. CISA issued Binding Operational Directive 26‑04, mandating all Federal Civilian Executive Branch agencies to apply the patches within days and urging all organizations to adopt risk‑based vulnerability management.
Why it matters for trust and compliance
- The incident highlights the importance of a robust vulnerability‑management program—a control area that maps to multiple frameworks and demonstrates continuous risk‑based remediation.
- Demonstrate timely patching of high‑severity CVEs as evidence for audit controls
- Implement continuous monitoring of KEV catalog items to satisfy risk‑based remediation requirements
Who is affected
Technology / SaaS providers Web‑hosting operators Federal agencies
Recommended actions
- Apply the PHP 8.4.26 patch for CVE‑2026‑109618 and CVE‑2026‑109619 immediately
- Validate that all production PHP instances are updated and integrate KEV monitoring into your vulnerability‑management workflow