CISA Adds Two Known Exploited Vulnerabilities to Catalog
Summary
CISA has added two new vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities (KEV) Catalog. These vulnerabilities in PHP are described as a memory corruption vulnerability and a stale internal request-state vulnerability. CISA urges organizations to prioritize patching these and other KEV Catalog vulnerabilities.
IFF Assessment
The addition of new exploited vulnerabilities to CISA's KEV Catalog represents an increased threat landscape for defenders, highlighting actively exploited weaknesses that require immediate attention.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 29, 2026. Known ransomware use: Unknown.
Defender Context
Organizations should prioritize patching the newly added PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) as they are known to be exploited. This highlights the ongoing risk posed by actively exploited software flaws and reinforces the importance of a robust vulnerability management program, especially for publicly exposed assets.