CISA Adds the PHP Remote-Code-Execution Flaws to Its Known Exploited Vulnerabilities Catalog; the Fix Deadline Binds Federal Civilian Agencies Only

CISA added CVE-2026-109618 and CVE-2026-109619, the PHP remote-code-execution flaws, to its Known Exploited Vulnerabilities catalog on Oct. 26, 2026 (catalog listing date). Both catalog entries carry a dueDate (the catalog’s remediation deadline) three days after the listing date. CISA lists a flaw in the catalog when there is “reliable evidence that execution of malicious code was performed by an actor on a system without permission of the system owner.” Its earlier alert had said CISA had not yet observed exploitation (2026-10-21–cisa-alert-urges-immediate-patching-of-php2shell-php-flaws).

The due date comes from Binding Operational Directive BOD 26-04. The directive is “a compulsory direction to federal, executive branch, departments, and agencies.” Unless a contract says otherwise, it “does not apply to contractors.” Both entries are marked for forensic triage, which under the directive means an agency must remediate “within the timeline (three days) and carry out a forensic triage.” Nothing in the directive binds a state, a county or an election vendor, so it sets no deadline for the offices running the general election.