> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# CISA adds two PHP remote code execution flaws to its KEV list
- URL: https://stackurity.ai/blog/php-cisa-kev-cve-2026-109618-cve-2026-109619/
- Published: 2026-10-28T10:35:04.000Z
- Updated: 2026-10-30T12:23:07.000Z
- Description: Two PHP flaws, CVE-2026-109618 and CVE-2026-109619, are now in CISA's exploited catalogue. See the fixed PHP versions and how to check.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** CISA has added two PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, to its exploited vulnerabilities catalogue. Update PHP to a fixed release in your branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

## What happened

On October 26, 2026, [CISA announced](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) that two PHP vulnerabilities now sit in its Known Exploited Vulnerabilities catalogue. One is a memory corruption bug, the other a stale internal request state bug. Both allow unauthenticated remote code execution, and both carry a CISA due date of October 29, 2026 for federal agencies.

The NVD scores CVE-2026-109618 at 9.8\. It describes a case where PHP abandons a request after running out of memory but leaves part of the request memory uninitialised, and the later cleanup reads it. The second flaw leaves global state pointing at request memory after it has been freed, and a later request can read that stale state.

## Am I affected?

According to the NVD, PHP is affected before 8.2.35, before 8.3.36 on its branch, before 8.4.27 and before 8.5.12\. The first flaw is listed from 7.3.0 and the second from 5.4.0, so older end-of-life branches are affected too and have no fix listed in these records. The same entries also name some appliance products, such as Palo Alto Networks PAN-OS, so check vendor advisories for those. Check one server with `php -v`, and remember that distributions may backport fixes without changing the version number.

## How to check with Stackurity

Stackurity keeps an inventory of the packages and runtimes on your Linux servers, including runtimes installed by hand, and matches it every hour against the CISA Known Exploited Vulnerabilities catalogue and other data using each ecosystem's own version rules, so backports are not reported as false alarms. After you upgrade, a check again records whether the issue is gone. Stackurity does not inventory network appliance firmware such as PAN-OS, so use the vendor's advisory for those devices. You can [start the 14-day free trial, no card needed](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=php-cisa-kev-cve-2026-109618-cve-2026-109619).

Related: [the exploited Brotli decoder flaw, CVE-2026-111497](https://stackurity.ai/blog/brotli-cve-2026-111497-exploited-decoder-flaw/). See [which systems and package ecosystems Stackurity covers](https://stackurity.ai/docs/compatibility).