CISA adds two active PHP flaws to known exploited catalog

The Cybersecurity and Infrastructure Security Agency added two PHP flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026. CISA reported that the newly cataloged issues are CVE-2026-109618, a memory corruption vulnerability, and CVE-2026-109619, a stale internal request-state vulnerability. The agency also updated its PHP alert to emphasize that critical vulnerabilities in PHP require immediate patching. [1]

CISA stated that these types of vulnerabilities serve as frequent attack vectors for malicious actors and pose significant risks to federal networks. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize vulnerability management and remediate high-risk flaws listed in the catalog quickly, as FTMQ Security reported earlier. [1][5][6]

The additions follow previous catalog updates earlier in the month. Security Affairs and FTMQ Security both reported that CISA added a Collabora Online flaw, tracked as CVE-2026-110447, to the catalog on October 23, 2026. That issue involves an OS command injection vulnerability in the built-in CODE Server of Collabora Online. [2][5]

Earlier in October, CISA also added four vulnerabilities to its list, including CVE-2026-0322 in Palo Alto Networks PAN-OS and CVE-2026-76519 in Cisco Secure Email Gateway. Security teams must continue to remediate these vulnerabilities to fulfill federal compliance requirements established under Directive 26-04. [1][6]