CISA Warns of Active Exploitation of Two Critical PHP Vulnerabilities, Sets Federal Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two PHP vulnerabilities, CVE-2026-109618 (memory corruption) and CVE-2026-109619 (stale internal request-state), to its Known Exploited Vulnerabilities catalog. Both flaws allow unauthenticated remote code execution and are being actively exploited in the wild, prompting a federal deadline of October 29, 2026, for agencies to apply patches.