CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch

CISA has added two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to its Known Exploited Vulnerabilities catalog and mandated all civilian federal agencies to patch them within days due to active exploitation attempts. The vulnerabilities affect the widely used PHP programming language and have led to thousands of attack attempts, prompting governments and organisations worldwide to urgently update or take PHP-based systems offline.

This Wire brief sits within Fusion42's coverage of Enterprise Software, and 5 sources have reported it between 21 Oct 2026 and 27 Oct 2026.