CISA Sets Oct. 29 Deadline for Federal Agencies to Fix Critical PHP Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) added two critical flaws in the PHP programming language to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 26 and gave federal civilian executive branch agencies until Oct. The vulnerabilities – CVE-2026-109618 and CVE-2026-109619 – could allow attackers to remotely execute malicious code on affected web servers without authentication.