CISA adds two PHP vulnerabilities to the KEV catalog and calls for priority fixes

What happened and what to do

The CISA advisory reports that two new PHP vulnerabilities were added to the Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-109618, a memory corruption flaw, and CVE-2026-109619, a stale internal request state issue. The agency considers this type of flaw a frequent attack vector for malicious cyber actors and calls for immediate fixes. Binding Operational Directive 26-04 requires federal civilian agencies to fix KEV-listed flaws quickly on publicly exposed assets and to check for compromise before remediation. CISA recommends that all organizations adopt risk-based vulnerability management.

In practice, a company needs to act on three fronts. First, inventory every PHP instance, including versions in servers, containers and legacy applications, and match them against the CVEs in the advisory. Second, prioritize fixes for internet-facing assets, where exploitation has the greatest impact. Third, before patching, look for signs of compromise in the logs of those assets. An inventory and version monitoring pipeline, with alerts tied to the KEV catalog, lets the company repeat this process with each new listing instead of relying on manual checks.

How the consultancy can help

Wendelmaques can assess your PHP exposure to these two flaws, mapping versions and public-facing assets. It then designs and deploys an inventory and alerting flow tied to the KEV catalog, with risk-based prioritization and compromise checks before patching.

Next step

If your company runs PHP on exposed systems, send a short description of your environment, such as the number of applications, versions in use and how they are published. You will receive a scoped proposal for diagnosis and implementation.