GLOBAL WEB SERVERS — The U.S. Cybersecurity and Infrastructure Security Agency added two critical vulnerabilities in the PHP programming language to its Known Exploited Vulnerabilities Catalog on October 26. The flaws allow an attacker with no account to run code on servers that use PHP to answer web requests.
CISA assigned the entries due dates of October 29 under Binding Operational Directive 26-04. That directive requires Federal Civilian Executive Branch agencies to remediate listed flaws on publicly exposed assets that grant total control after exploitation, and to check whether a system was already compromised before or while the patch is applied.
The PHP Group, the organization that maintains the language, released fixed versions on October 21. The two flaws are CVE-2026-109618, an out-of-memory handling error that can leave request memory only partly initialized, and CVE-2026-109619, a condition in which internal request state survives after its memory is freed.
Both carry a CVSS 4.0 base score of 9.2 assigned by the PHP Group. Attack complexity is high and success depends on particular worker and memory configurations. PHP rates Apache with the mod_php module as the highest-risk deployment.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier receive no further project patches. CISA’s updated alert of October 26 directs organizations that cannot update immediately, or that still run unsupported versions, to take the PHP-based systems offline until they can be patched.
Locations Affected
Global web infrastructure: All PHP installations that serve web requests, including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. No specific geographic coordinates or named sites have been published by CISA or the PHP Group.
