CISA Confirms Active Exploitation of Two Critical PHP Flaws, Orders Federal Agencies to Fix Within Three Days

The U.S. Cybersecurity and Infrastructure Security Agency confirmed that attackers are actively exploiting two critical PHP web software flaws, CVE-2026-109618 and CVE-2026-109619, which allow remote compromise over the internet without passwords. CISA ordered U.S. civilian federal agencies to fix their systems within three days. PHP patches had been released less than a week before that warning.