What happened
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed CVE‑2026‑109618 and CVE‑2026‑109619 in its Known Exploited Vulnerabilities catalog, stating that both flaws permit unauthenticated remote code execution on PHP 7.4‑8.2 installations. The agency reports active exploitation and mandates a 30‑day remediation deadline for all federal systems. No vendor patch was publicly available at the time; mitigations include disabling the affected functions or applying temporary work‑arounds.
Why it matters for trust and compliance
- The incident underscores the need for a documented vulnerability‑management program that can prove timely patching—a control objective that maps to many frameworks, including NIST CSF 2.0.
- Demonstrates the necessity of continuous evidence collection for patch compliance.
- Supports audit readiness by linking remediation actions to a single control objective across frameworks.
Who is affected
Technology / SaaS providers Government agencies
Recommended actions
- Create an inventory of all PHP runtimes and version numbers.
- Apply vendor patches or implement recommended mitigations (disable proc_open/shell_exec).
- Run authenticated scans to confirm remediation and store evidence in your control‑mapping repository.
- Update your vulnerability‑management policy to enforce a 30‑day SLA for KEV items.
Details
- CVEs
- CVE-2026-109618, CVE-2026-109619