Cyber Risks October 26, 2026 · CISA Advisories

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching : CVE-2026-109618 – PHP Memory Corruption Vulnerability CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Ex

Read the original at CISA Advisories ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-109618 CVE-2026-109619
Related: Siemens Building Automation and Energy Products Cyber Risks · Nov 12, 2026
Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026
Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29) Cyber Risks · Oct 29, 2026