CISA warns of PHP bug exploitation

CISA warns federal agencies of PHP vulnerability exploitation attempts and orders them to patch systems by Thursday. The agency added CVE-2026-109618 and CVE-2026-109619 to the Known Exploited Vulnerabilities catalog on Monday evening. Experts note that while mass exploitation lacks proof, dozens of companies reported thousands of failed attack attempts against the 42 million Internet-facing PHP services.