CISA Adds Two PHP Flaws to KEV Catalog, Citing Takeover Risk

Key points

• CVE-2026-109618 and CVE-2026-109619 affect PHP and were added to CISA's KEV catalog on 2026-10-26
• The pair involve memory corruption and stale request-state, creating asset takeover exposure
• Federal enterprises face mandatory risk-based remediation timelines
• K-12 and state agencies running PHP web services should treat this as urgent

On October 26, 2026, the Cybersecurity and Infrastructure Security Agency moved a pair of PHP vulnerabilities into its Known Exploited Vulnerabilities catalog, designating them CVE-2026-109618 and CVE-2026-109619. Placement in that catalog is not a routine paperwork exercise: it signals that exploitation has been observed in the wild, and it converts patching from a best practice into a binding obligation for federal civilian agencies, with risk-based deadlines attached to each entry.

The technical picture is a familiar and dangerous combination. One flaw is rooted in memory corruption, which in PHP deployments can mean unpredictable process behavior and, in the worst case, attacker-influenced execution within the web server's context. The other involves stale request-state, where unresolved or improperly cleared data from an earlier request bleeds into a later one — a class of bug that can let an unauthenticated visitor inherit another user's context. Together they raise the prospect of asset takeover, not merely a crashed worker process.

Who is exposed? Any organization running PHP-backed services — and that population is enormous. Content management systems, student information portals, district websites, custom intake forms, and internal dashboards across K-12 and state government are disproportionately built on PHP. The federal enterprise is the formal target of the KEV directive, but the same code runs in school districts that never appear in a federal inventory.

Why it matters for us: many districts operate PHP applications with no formal owner, no patch cadence, and no reverse proxy in front of them. The stale request-state issue is particularly concerning for anything that handles authenticated sessions, such as gradebooks or HR portals. A memory corruption bug plus shared-state leakage is a recipe for session hijacking at scale.

What to watch: vendor guidance on fixed PHP releases, any public proof-of-concept code, and whether scanning activity targeting these identifiers appears in your logs. Expect exploit attempts against internet-facing endpoints first, then lateral interest in internal apps once a foothold exists. Inventory before you panic — you cannot patch what you cannot find.

What to do now

1. Inventory every PHP runtime and framework version across district and agency infrastructure, including third-party hosted portals, and assign an owner to each application.
2. Apply the vendor-fixed PHP release for CVE-2026-109618 and CVE-2026-109619, prioritizing internet-facing services and anything handling authenticated sessions.
3. Where patching cannot happen immediately, place affected applications behind a web application firewall or virtual patching layer and restrict access to trusted networks.
4. Rotate session signing keys and invalidate active sessions on systems that may have processed untrusted requests, given the stale request-state exposure.
5. Review web server logs for anomalous request patterns, repeated failed requests, or session tokens used from unexpected addresses, and escalate anything suspicious.
6. Enforce a documented risk-based remediation timeline that mirrors KEV deadlines so future catalog additions do not catch the team unprepared.
7. Confirm remediation with an authenticated rescan and retain evidence of version and configuration state for audit purposes.

CVE references

• CVE-2026-109618
• CVE-2026-109619

Original source

CISA Advisories