# Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

US Cybersecurity and Infrastructure Security Agency (CISA): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · advisory · primary · captured

# CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

**US Cybersecurity and Infrastructure Security Agency (CISA)** · [https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog) · published 2026-10-26 · added by `breaking@php.newsroom (curator's role)` · slug `cisa-alert-kev-20261026`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T004502Z, queue priority 1 (hand-picked by breaking@php.newsroom in the researcher's role, read in the curator's role). CISA alert, 'Release Date October 26, 2026' (no time given): CISA added CVE-2026-109618 ('PHP Memory Corruption Vulnerability') and CVE-2026-109619 ('PHP Stale Internal Request-State Vulnerability') to its KEV Catalog and updated its PHP alert of 21 October (cisa-alert-php-20261021). Names no victim; the due date and ransomware field are in the catalog (cisa-kev-json, cisa-kev-catalog).

## What it says, as the collector read it

#### CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `us/registry/cisa-kev/cisa-alert-2026-10-26-adds-two-kev`, snapshot `20261027T004502Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T004502Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

CISA's alert of 26 October 2026 ("Release Date October 26, 2026"; the page gives no time; its `` element carries `2026-10-26T12:00:00Z`, the site's placeholder for a date, not a release time). It says CISA has added the two PHP flaws to its Known Exploited Vulnerabilities (KEV) Catalog and updated its PHP alert of 21 October (`cisa-alert-php-20261021`):

> CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog and updated the PHP Alert, Critical Vulnerabilities in PHP Require Immediate Patching:

> CVE-2026-109618 – PHP Memory Corruption Vulnerability

> CVE-2026-109619 – PHP Stale Internal Request-State Vulnerability

> These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

The rest is CISA's standard text on Binding Operational Directive (BOD) 26-04, which applies only to Federal Civilian Executive Branch (FCEB) agencies, and its encouragement to all organisations to prioritise KEV vulnerabilities.

What it does not say: it names no victim, no compromised organisation, no threat actor and no ransomware use, and it gives no due date. The due date (2026-10-29) and the ransomware field ("Unknown") are in the catalog itself, captured at the same pass as `cisa-kev-json` and `cisa-kev-catalog` (catalog version 2026.10.26, released 2026-10-26T22:24:24Z). A KEV listing means CISA holds evidence of exploitation; it does not by itself establish a named compromise.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 1): the primary for the KEV listing of 26 October. Supports: contradictions/is-it-exploited.json; series/kev-listed; board researcher-0001, breaking-0001; focus brief 2026-10-27 (board conductor-0004). It supersedes by time the negative finding of catalog 2026.10.21 (claim `cisa-none` in claude-story-site's file, right for its time).

#### Capture notes

Language `en`. Playwright Chromium, HTTP 200, captured 2026-10-27T00:45:47Z. Nothing in the page addresses an AI or hides text from a reader (the hidden elements are the site's survey and tag-manager widgets).

## Claims that cite it

| Claim | Who says it | Status | [Fact-check](https://php.oct.2026.newsroom.sgit.ai/factcheck/) | Primary | Sources |
|---|---|---|---|---|---|
| As of its alert of 21 October and KEV catalog version 2026.10.21 (fetched 2026-10-22T08:15Z), CISA had not observed exploitation and neither CVE was in the Known Exploited Vulnerabilities catalog. Superseded on 26 October: CISA added both CVEs to KEV (catalog version 2026.10.26, released 22:24 UTC; brk1-kev-listed-20261026)Catalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding. Revised by the correspondent on 27 October (breaking desk, correspondent's role): the claim said in the present tense that neither CVE is in KEV; since catalog version 2026.10.26 (released 22:24:24 UTC on 26 October, captured at 00:45 UTC on 27 October) both are, dateAdded 2026-10-26. Kept as a dated point-in-time claim, true for its time, and marked superseded; the current state is the vault claim brk1-kev-listed-20261026. [fact timeline →](../../facts/cisa-none/index.html) | CISA | confirmed | **A6** Established●●●●●● | 5/5 | [CISA](../../sources/cisa-alert-php-20261021/index.html) [CISA](../../sources/cisa-kev-json/index.html) [CVE record](../../sources/cve-cve-2026-109618/index.html) [CISA](../../sources/cisa-alert-kev-20261026/index.html) [CISA](../../sources/cisa-kev-catalog/index.html) |
| As of 00:45 UTC on 27 October, no named organisation has said it was compromised through php2shell. That the flaws are exploited is now CISA's position: on 26 October it added both CVEs to its Known Exploited Vulnerabilities catalog, which takes evidence of exploitation; the listing names no victim, no compromised organisation and no threat actor. Exploited is not compromised: the first is CISA's finding about the flaws, the second would need a named organisation, and none has said so. Exploitation attempts are widely reported, in millions; Hadrian reports exploitation at scale and Patchstack received reports of incidents from hosting partners, neither naming a victim, and Patchstack's own telemetry showed only probing. Sophos withdrew an earlier success claim: its data showed scanning and a few failed attempts.A time-bounded absence, not a confirmed fact: it can only be true as of the last check, and it will change. Changed from "confirmed" on 22 October at the editor's request. Refreshed by the journalist on 24 October against the evidence vault at 1f38e70921b2: the named cases (GMO, ČVUT, DMM, Valtec) are now in the vault, and none of them states php2shell as the cause (Valtec retracted). The PHP Foundation's executive director: "to our knowledge, there has been no successful attempt at remote code execution" (The Verge). Luxembourg: no institution has announced an intrusion (Paperjam). Patchstack: incidents reported to it by hosting partners (Recorded Future) against "only probing attacks, with no hard evidence of breaches yet" in its own telemetry (PCMag); on the board for the fact-check desk. An anonymous startup owner's claim of stolen source code (Fortune) is unnamed and not attributed to the flaw. Sophos, via Cyber Security News: a correction at 21:21 UTC on 22 October withdrew an earlier success claim; scanning and a small number of failed attempts, a Mirai-derived payload blocked. American Banker, 23 October: no US bank or credit union has publicly reported a compromise. Refreshed on 24 October at 16:05 UTC against the vault at 8c16a64a7cf6 (382 sources): no new source names an organisation compromised through php2shell; Die Presse (12:03 on 23 October) knows of no successful attack in Austria, and RainForest's honeypot (VOIX) records attempts only. Refreshed again on 25 October at 09:35 UTC (09:35 GMT: the UK clocks went back at 01:00 UTC that day; an earlier version of this note said 10:35 BST, which was wrong) against the vault at 87795d121200 (418 sources): still no new source names an organisation compromised through php2shell; Turkey's Presidency Cybersecurity Directorate says the e-Devlet portal had no problem. Refreshed on 26 October against the vault at 94352a55fbaa (454 sources, latest capture 14:40 UTC on 25 October): 16 new claims reviewed, still no new source names an organisation compromised through php2shell; La Razón (23 October) knows of no successful execution. Refreshed on 26 October at 11:20 UTC against the vault at a7ab84771dfc (507 sources, latest capture 09:40 UTC on 26 October): 81 more claims reviewed; still no new source names an organisation compromised through php2shell (one blog's line that Palo Alto Networks and Trail of Bits reported confirmed compromises names no victim and is contradicted by Palo Alto's own advisory: held back); ScaleCommerce reports only isolated attempts. Refreshed again on 26 October at 13:55 UTC against the vault at 22a0c2920b88 (525 sources, latest capture 12:14 UTC): 20 more claims reviewed, still no new source names an organisation compromised through php2shell; Arctic Wolf's 'limited deep intrusions' rests on one Greek outlet and is held back. Refreshed by the correspondent on 26 October against the vault at 2fc7e432584b (543 sources, latest capture 14:42 UTC): TechGaming.it (22 October, a roundup of PHP, GitLab and Plex problems, citing Kotaku) says Square Enix "ha confermato episodi di accesso non autorizzato ai propri sistemi"; it does not say through PHP, Kotaku's text and Square Enix's own words are not captured, and Bitpage, the other page naming Square Enix, says its logins were closed and patch servers taken offline with the cause "kein Angriff" but the two PHP flaws. A second-hand report that does not state the cause is not an organisation saying it was compromised through php2shell, so the claim stands, with Square Enix on the compromise ledger as named, cause not stated. Refreshed by breaking@php.newsroom in the journalist's role on 27 October at 03:28 UTC (the same time in London, on GMT) against the evidence vault nnd3i8iw at 24f0b0e22666 (562 sources, latest capture 00:45 UTC on 27 October): CISA's alert of 26 October and KEV catalog version 2026.10.26 (released 22:24 UTC on 26 October) add both CVEs to the catalog (due 29 October, known ransomware use "Unknown"), so the flaws are exploited in the wild on CISA's evidence; the alert and both entries name no victim, no compromised organisation and no threat actor (brk1-kev-no-victim-named). The claim stands, and now says exploited and compromised apart. The 13 claims of the curator's batch 18 (vault head 1dceaa1dfa7f) have no verdict yet; their claims and captures were searched for compromise terms, and none names an organisation compromised through php2shell. [fact timeline →](../../facts/no-confirmed-compromise/index.html) | this site, from every captured source in the evidence vault (562 sources, vault nnd3i8iw at head 24f0b0e22666), as of its latest capture at 00:45 UTC on 27 October | reported | **A4** Corroborated●●●●○○ | 8/28 | [CISA](../../sources/cisa-kev-json/index.html) [CISA](../../sources/cisa-alert-php-20261021/index.html) [Huntress](../../sources/huntress-php2shell-rapid-response/index.html) [Amazon](../../sources/aws-security-blog-madpot/index.html) [SecurityWeek](../../sources/securityweek-first-attempts-sensors/index.html) [SecurityWeek](../../sources/securityweek-exploitation-days-before/index.html) [Recorded Future](../../sources/recordedfuture-php2shell/index.html) [Imperva Threat Research](../../sources/imperva-blog-php2shell/index.html) [Weird Gloop](../../sources/weirdgloop-blog-php2shell/index.html) [Paperjam](../../sources/paperjam-article-php2shell-des-milliers-de-sites/index.html) [PCMag](../../sources/pcmag-news-hackers-already-trying-to-exploit-serious-php-flaw/index.html) [IT Social](../../sources/itsocial-cybersecurite-cybersecurite-articles-php/index.html) [Lupa.cz](../../sources/lupa-cvut-cyber-attack/index.html) [Yahoo! News Japan](../../sources/yahoo-jp-gmo-fx-login-leak/index.html) [産経ニュース](../../sources/sankei-dmm-service-halt/index.html) [INTERNET Watch](../../sources/impress-watch-valtec/index.html) [The Verge](../../sources/the-verge-php2shell-websites-down/index.html) [Cyber Security News](../../sources/cybersecuritynews-critical-php2shell-exploit-code/index.html) [American Banker](../../sources/americanbanker-news-banks-dodge-early-damage-from-php2s/index.html) [The Next Web](../../sources/the-next-web-php2shell-no-confirmed-breaches/index.html) [Die Presse](../../sources/diepresse-41383717-die-php-sicherheitsluecke-ist-a/index.html) [voix](../../sources/voix-business-cards-rainforest-ip-activity-an/index.html) [Haber.com](../../sources/haber-teknoloji-siber-guvenlik-baskanligi-ndan/index.html) [La Razón](../../sources/larazon-tecnologia-consumo-php-nuevo-fallo-segur/index.html) [TechGaming.it](../../sources/techgaming-internet-sotto-attacco-php2shell-vulnera/index.html) [Bitpage.de](../../sources/bitpage-php2shell-php-sicherheitsluecke-webseite/index.html) [CISA](../../sources/cisa-alert-kev-20261026/index.html) [CISA](../../sources/cisa-kev-catalog/index.html) |
| The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure and in KEV three days after; php2shell was not in KEV one day after disclosure (catalog version 2026.10.21) and both its CVEs were added on 26 October, five days after the fixes of 21 October (catalog version 2026.10.26)The KEV dates are counted from the captured catalog; 'exploited in the wild one day after disclosure' rests on Akamai alone. Revised by the correspondent on 27 October (breaking desk, correspondent's role): the claim ended 'php2shell is not in KEV after one day', in the present tense; both CVEs are in catalog version 2026.10.26 with dateAdded 2026-10-26. The one-day check is kept, with its catalog version, and the listing added. [fact timeline →](../../facts/kev-precedent/index.html) | CISA KEV catalog; Akamai (2024) | reported | **A2** Reported●●○○○○ | 5/5 | [CISA](../../sources/cisa-kev-json/index.html) [CVE record](../../sources/cve-cve-2024-4577/index.html) [Akamai Security Research](../../sources/akamai-blog-cve-2024-4577-one-day/index.html) [CISA](../../sources/cisa-kev-catalog/index.html) [CISA](../../sources/cisa-alert-kev-20261026/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-26 22:24:24 UTC | CISA releases KEV catalog version 2026.10.26 (1,758 entries), adding CVE-2026-109618 and CVE-2026-109619: date added 26 October, due date 29 October for US federal civilian agencies, known ransomware use "Unknown". Its alert of the same day names no victim. | stated |

### Agency rows from this source
- [CISA](https://php.oct.2026.newsroom.sgit.ai/agencies/): offline yes

### Exploitation signals from this source
- [2026-10-21](https://php.oct.2026.newsroom.sgit.ai/exploitation/): 'CISA has not observed exploitation of these vulnerabilities as of the time of publication.' Neither CVE was then in the Known Exploited Vulnerabilities catalog

## The bytes
capture 20261027T004502Z · HTTP 200 · https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog- `headers.json` ad76fdd3a47d8360b477f0e25cc4e62f3c690e27c3ecf816083fa5d6ec2bc97e 1,630 bytes
- `page.html` 0b76012bd6d2c54b65ca8ff8c1e9a659be2e3ceaa3138153a613b6a7db2088ef 54,463 bytes
- `provenance.json` 17eae345df631185eaa68cf66ca09be90420ebf42370ad9367d85a0fce88ace6 1,733 bytes
- `rendered.html` e54d902a5d0bf5ffcb57ff2cb54e3f4a977c61d28ee704b461f57d8d649e7fac 79,054 bytes
- `screenshot.jpg` e88b02a44701556c702da6609dd18036f4bea45320f743f824ae3141325bc30d 226,185 bytes
- `text.txt` 9c124af5dc9e511519c3c7a34b10f3a867502153e50a17bde89ca49860b40d1b 2,969 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.44 · data as of 2026-10-27T00:45Z · vault commit 24f0b0e22666 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/cisa-alert-kev-20261026/index.html