CISA Confirms Active Exploitation of Two Critical PHP Flaws; Federal Agencies Get Three Days to Patch

Attackers are actively exploiting two critical flaws in PHP, the server-side language behind many websites, the U.S. Cybersecurity and Infrastructure Security Agency confirmed. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws allow remote compromise over the internet without passwords. CISA ordered civilian federal agencies to patch within three days, less than a week after PHP fixes were released.