CISA Updates KEV Catalog with Critical PHP Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has officially expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding two significant security flaws impacting the PHP programming language. These additions underscore the ongoing challenge of managing software supply chain risks and the prevalence of memory-related vulnerabilities in widely deployed server-side technologies.
Understanding the New Additions
The vulnerabilities identified are CVE-2026-109618, a memory corruption vulnerability, and CVE-2026-109619, which concerns a stale internal request-state issue. Both flaws have been confirmed as actively exploited in the wild, making them high-priority targets for threat actors seeking to compromise web-based infrastructure. Given that PHP powers a substantial portion of the global web, these vulnerabilities present a broad attack surface for both public and private sector organizations.
Regulatory Context and Risk Management
The inclusion of these CVEs in the KEV Catalog triggers specific mandates for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 26-04. This directive mandates that federal agencies prioritize the remediation of vulnerabilities listed in the KEV Catalog, particularly those that grant attackers total control over an asset. The directive emphasizes a risk-based approach to vulnerability management, requiring agencies to focus on high-risk, publicly exposed assets while maintaining a clear process for evaluating potential compromise prior to patching.
Broader Implications for Security Teams
While BOD 26-04 is legally binding only for federal agencies, CISA continues to strongly advise private sector organizations to adopt the same risk-based remediation strategies. The KEV Catalog serves as an essential tool for security teams to filter the noise of thousands of disclosed vulnerabilities and focus resources on those that pose the most immediate threat to operational stability.
As part of the update, CISA has reiterated the importance of proactive threat hunting. Organizations are encouraged not only to apply patches promptly but also to conduct forensic analysis to determine if their systems were compromised before the remediation was implemented. For security professionals, this serves as a reminder that patch management is only one component of a comprehensive defensive strategy; visibility into the state of internal systems remains critical to identifying post-exploitation activity.
CISA continues to maintain the KEV Catalog as a living document, relying on evidence of active exploitation to prioritize entries. Organizations that identify similar in-the-wild exploitation of other vulnerabilities are encouraged to utilize the official CISA nomination process to ensure the broader community remains informed of emerging threats.
