CISA Warns of Active Exploitation of Critical PHP Vulnerabilities, Mandates Federal Agency Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. These flaws allow unauthenticated remote code execution and affect a vast number of web applications. Federal civilian executive branch agencies are mandated to patch these vulnerabilities by October 29, 2026, with CISA urging all organizations to prioritize remediation.