Critical Vulnerabilities in PHP Require Immediate Patching
MentionsApache Software Foundation
Update October 26, 2026: CISA has updated this Alert to reflect the addition of CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26, 2026. Update October 23, 2026 : CISA has updated this Alert to: (1) provide a SIGMA detection rule to help identify potentially suspicious activity; (2) incorporate partner resources; and (3) reinforce existing mitigation guidance.
Summary from CISA Advisories.
Explained
The technology and terms in this story. Learn more
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
