CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the…
Summary from CISA Advisories.
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- TechnologyPHPA programming language that powers a large share of websites, including WordPress.
- WeaknessMemory corruptionBugs that let a program write where it shouldn't in memory, often leading to code execution.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
