---
type: "post"
id: "cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05"
slug: "cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05"
title: "CISA adds PHP2Shell flaws to the Known Exploited Vulnerabilities catalog"
description: "CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 26, 2026: CVE-2026-109618, a memory-corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability."
retrieval_nugget: "CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 26, 2026: CVE-2026-109618, a memory-corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability."
published_at: "2026-10-27"
updated_at: "2026-10-27"
record_date: "2026-10-27"
date_kind: "published_at"
topics: ["security"]
entities: ["CISA","Known Exploited Vulnerabilities Catalog","PHP","CVE-2026-109618","CVE-2026-109619","Binding Operational Directive 26-04"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "CISA has now added both PHP2Shell flaws to its KEV catalog, updating its prior urgent-patching alert."
prior_refs: ["memory:fc237a5b-bcd7-8048-a76c-1cbc810c9bab","memory:df53be93-2123-8878-aa2f-83976ed65498"]
source_url: "https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog"
source_urls: ["https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05/","markdown":"https://newruntime.com/posts/cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05.md","json":"https://newruntime.com/posts/cisa-adds-php2shell-flaws-to-the-known-exploited-9f2c05.json"}
---

# CISA adds PHP2Shell flaws to the Known Exploited Vulnerabilities catalog

## Retrieval answer

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 26, 2026: CVE-2026-109618, a memory-corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability.

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 26, 2026: CVE-2026-109618, a memory-corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability. CISA also updated its PHP alert covering critical PHP vulnerabilities.

The agency says these vulnerability types are frequently used by malicious cyber actors. Under Binding Operational Directive 26-04, US Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets when exploitation grants total control of the asset. The directive also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies to federal civilian executive agencies, but CISA encourages other organizations to use risk-based vulnerability management and prioritize KEV entries. The alert does not identify affected PHP versions, available patches, specific products, observed attackers, or affected organizations.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)