Is CVE-2026-109618 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-109618

Organizations should apply vendor-specific patches for the affected PHP components immediately, especially on publicly exposed assets. Priority should be given to systems that could grant total control post-exploitation. Agencies subject to BOD 26-04 must check whether threat actors compromised the system before the patch was applied. All organizations are encouraged to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities.

Quick answers

What is CVE-2026-109618?: Organizations should apply vendor-specific patches for the affected PHP components immediately, especially on publicly exposed assets. Priority should be given to systems that could grant total control post-exploitation. Agencies subject to BOD 26-04 must check whether threat actors compromised the system before the patch was applied. All organizations are encouraged to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities.
How severe is CVE-2026-109618?: high
Is CVE-2026-109618 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-109618 be mitigated?: Organizations should apply vendor-specific patches for the affected PHP components immediately, especially on publicly exposed assets. Priority should be given to systems that could grant total control post-exploitation. Agencies subject to BOD 26-04 must check whether threat actors compromised the system before the patch was applied. All organizations are encouraged to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities.

CVSS

—

Vendor

—

Published

Oct 27, 2026 · 02:55

Patch

Unknown / not confirmed

Affected products

—

Mitigation

CISA Adds Two PHP Vulnerabilities to Known Exploited Catalog, Issues Urgent Patching Advisory

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability, have been identified as frequent attack vectors for malicious cyber actors. CISA also issued a PHP Alert emphasizing immediate patching. These additions are reinforced by Binding Operational Directive (BOD) 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets.

12m

CVE-2026-109618

Quick answers

Related News

CISA Adds Two PHP Vulnerabilities to Known Exploited Catalog, Issues Urgent Patching Advisory