Skip to content

Back to the catalog

cisa.govadvisory

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on 26 October 2026: CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request state). It also updated its PHP alert on critical vulnerabilities requiring immediate patching. The alert restates BOD 26-04, which requires federal civilian agencies to prioritize fast remediation of KEV CVEs on exposed assets and to check for prior compromise.

TL;DR CISA adds PHP memory corruption and stale request-state CVEs to the KEV Catalog and reiterates BOD 26-04 remediation duties.
Open original ↗

Organisations named here

  • BOD 26-04
  • CISA

CVEs named here

  • CVE-2026-109618
  • CVE-2026-109619

Technologies named here

  • Known Exploited Vulnerabilities Catalog
  • PHP
  • Binding Operational Directive 26-04
  • CISA KEV
  • KEV Nomination Form

Techniques named here

  • Risk-based vulnerability management
  • Compromise check before patching

Related in AppSec