U.S. Cyber Agency Says Two PHP Flaws Are Under Attack, Federal Fix Due Oct. 29, 2026
The U.S. Cybersecurity and Infrastructure Security Agency added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 26, 2026, the agency's own determination that both are being used in attacks. Its catalog entries give federal civilian agencies until Oct. 29, 2026, to fix them.
Both flaws are in PHP, the programming language behind a large share of the world's websites. A catalog listing also starts the clock for federal agencies. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to move first on listed flaws that sit on publicly exposed systems and would give an attacker total control of them.
The two entries are CVE-2026-109618, listed as a PHP memory corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability. The catalog's description of each says the flaw allows unauthenticated remote code execution, meaning code can be run on a server without logging in. Both entries list known use in ransomware campaigns as unknown.
The flaws themselves, known as php2shell, were disclosed and patched earlier in October 2026. The agency's PHP alert, updated to record the catalog listing, says they affect every PHP installation that serves web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. It tells organizations to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to take offline any system that cannot be updated or that runs PHP 8.1 or earlier.
The directive binds only federal civilian agencies, and it also requires them to check whether attackers had already reached a system before the patch was applied. CISA says it encourages every other organization to prioritize fixing catalog-listed flaws as well.
