CISA Alerts Agencies to Active Exploitation of Critical PHP Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, confirming their active exploitation. CISA has mandated that all federal civilian agencies patch these bugs by Thursday, underscoring the widespread risk given PHP's use by over 70% of websites.