Warning Against Vulnerabilities Exploited in Actual Attacks (PHP)
Oct 28 2026
The US Cybersecurity and Infrastructure Security Agency (CISA) has released a list of vulnerabilities currently being exploited in attacks.
The affected product is PHP.
CVE-2026-109618 is a memory corruption vulnerability that occurs under memory-starved conditions.
CVE-2026-109619 is a vulnerability involving a reference to an outdated internal request state.
CISA has advised users of this product to update to the latest version.
Additionally, users are instructed to apply mitigation measures in accordance with the vendor’s guidance and to comply with CISA BOD 26-04, the Risk-Based Security Update Prioritization Guidance, and forensic classification requirements.
Cloud services must apply the BOD 26-04 guidance and, if no mitigation measures are available, must discontinue use of the product.
