Summary
- On 26 October CISA added CVE-2026-109618 and CVE-2026-109619 to its KEV catalogue.
- The entries carry a 29 October deadline for applicable US federal remediation under BOD 26-04.
- The designation records evidence of exploitation, not a count of production victims or a general UK compliance deadline.
The US Cybersecurity and Infrastructure Security Agency has added both critical PHP2Shell vulnerabilities to its Known Exploited Vulnerabilities catalogue, formally identifying the issues as subject to active exploitation. The 26 October action covers CVE-2026-109618 and CVE-2026-109619.
Both entries cover flaws in PHP deployments already subject to emergency software updates and widespread advisories. CISA’s new action is not a further vulnerability disclosure or a new patch. It records that the government agency regards evidence of exploitation as sufficient for inclusion in the catalogue, which helps determine the order of federal remediation work.
Research published in the preceding days showed successful command execution against instrumented honeypot systems. That evidence strengthened earlier reports of scanning and exploit attempts. It does not, by itself, establish the number of compromised production servers or the extent of data access across genuine organisations.
What a KEV listing changes
CISA’s KEV catalogue is different from a severity ranking based solely on hypothetical impact. Inclusion requires a documented vulnerability, credible evidence of exploitation, and clear mitigation guidance. CISA uses the entries to drive risk-based prioritisation for affected federal assets, including the assessment of internet exposure, the privileges an attacker could obtain, and whether forensic triage is necessary before restoring confidence in a system.
The two entries carry a 29 October 2026 remediation date in CISA’s catalogue. Applicable US federal civilian executive branch agencies must apply the requirements of Binding Operational Directive 26-04, which uses KEV entries alongside asset exposure and risk criteria, and includes forensic triage obligations in defined cases. This is not an automatic statutory deadline for UK companies.
The UK National Cyber Security Centre has separately urged organisations to locate PHP installations and apply the relevant fixes, prioritising internet-facing systems. Its public advice also highlights temporary mitigations and compromise assessment where a vulnerable installation remained exposed. The American KEV action adds an exploitation finding and a federal remediation timetable to that earlier UK operational advice. CISA’s published entries do not themselves create duties for British companies, which must follow their applicable national and sector-specific obligations.
CISA lists both CVE-2026-109618, a memory corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability, as exploited. The entry itself does not identify a common attacker, the number of production systems breached or whether the two flaws were deployed together in particular incidents. Those questions require other investigative evidence.
From threat intelligence to implementation
Operational response is complicated by the way PHP is distributed. An organisation may manage its own web runtime and update it directly, rely on a hosting platform to apply fixed builds, or use a commercial product that includes a bundled PHP installation. The same CVE identifier can therefore generate different maintenance decisions and vendor dependencies across an enterprise estate.
The KEV designation adds urgency but cannot tell an administrator which public hostname maps to a vulnerable process. That requires an inventory of services and versions, checks against vendor documentation and, where appropriate, evidence that an emergency change has reached the running workload rather than just a software repository.
An additional challenge is the difference between fixing future exploitation and identifying earlier access. Updating a vulnerable runtime prevents attacks against the corrected flaw, but it does not establish that a previously exposed server was never used by an intruder. The NCSC therefore includes compromise assessment among its recommendations for organisations whose systems remained exposed before remediation.
Previous UK warnings, vendor patch releases and security research predate CISA’s 26 October change. The catalogue listing adds a formal US federal exploitation determination and remediation timetable, without supplying an authoritative victim count.
Both vulnerabilities now appear in CISA’s KEV list with 29 October dates. Known ransomware campaign use remains recorded as unknown, and the catalogue does not establish how many production PHP environments were compromised before fixes were deployed.
