CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch
The Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two PHP vulnerabilities are being actively exploited and ordered all federal civilian agencies to patch them by Thursday.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were added to CISA's Known Exploited Vulnerabilities (KEV) catalog on Monday evening. The agency declined to comment on the nature of the exploitation or potential victims, though it clarified that "active exploitation" includes both attempted and successful exploitation attempts.
These bugs caused global alarm last Tuesday due to PHP's ubiquity across the internet, with estimates showing that more than 70% of all websites use the programming language. Throughout the week, experts tempered concerns about mass exploitation due to the lack of viable proof-of-concept exploits.
Exploitation Attempts
Despite limited confirmed successful exploits, dozens of cybersecurity and tech companies reported thousands of failed attempts to use the bugs in attacks. Both Sophos and Palo Alto Networks initially posted claims of successful exploitation before retracting them.
Widespread Impact
The advisory links to guidance from PHP and government cybersecurity agencies in Australia, Canada, New Zealand, the U.K. and others. In some cases, web application firewalls may provide temporary protection, CISA noted.
Experts have expressed deep concern that millions of PHP-backed websites are still running ancient versions of the language that likely cannot be updated. Censys data shows that of 42 million Internet-facing PHP services, more than 10 million have been patched since October 21.
Related
