Cybersecurity
CISA adds two PHP flaws to KEV catalog
CISA placed two PHP vulnerabilities in its exploited list after Perplexity said it had seen remote code execution against honeypots, while PHP and the PHP Foundation released fixes.
- The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on Monday.
- Adel Karimi of Perplexity said on 24 October 2026 that honeypot systems had shown successful remote code execution, with memory disclosure in the chain he described.
- PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026, and federal agencies had until 29 October 2026 to apply them.
- Censys estimated that more than 32.51 million PHP services were still running an affected version.
- On 26 October 2026, the PHP Foundation released Windows builds that addressed CVE-2026-111497 in the Brotli decoder library.
CISA added the two PHP vulnerabilities to its KEV catalog after Perplexity’s Adel Karimi said he had seen successful remote code execution against honeypot systems on 24 October 2026. He said the evidence showed memory disclosure as part of the chain, while also noting that the result came from a deliberately favourable single-worker mod_php setup.
The flaws were identified as CVE-2026-109618 and CVE-2026-109619. PHP said the issues were fixed in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which were released on 21 October 2026, and federal agencies had until 29 October 2026 to install the updates.
Censys estimated that more than 32.51 million PHP services were still running affected releases. The article also said PHP is used on about 70% of websites, and that the issue had prompted advisories from a long list of software vendors and government bodies.
The PHP Foundation said on 26 October 2026 that it had released Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 to address CVE-2026-111497 in the Brotli decoder library. It said the flaw affected Brotli versions 1.0.3 through 1.0.9, 1.1.0 and 1.2.0, and that it could be reached through cURL when automatic HTTP decompression was enabled.
Named in this story
People
- Adel Karimi
- said honeypot systems had seen successful remote code execution
Companies
- Perplexity
- employed Karimi, who led detection and response there
- Censys
- estimated how many PHP services were still running affected versions
Organisations
- PHP Foundation
- released Windows builds with fixes for a separate Brotli issue
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- confirmed active exploitation by adding the PHP flaws to its KEV catalog
Products and systems
- PHP
- the server-side language affected by the flaws
- Brotli
- the decoder library tied to the separate vulnerability
How the source tells it
The article is a straightforward security bulletin, with urgency coming from the KEV listing, exploit confirmation and patch deadline.
- urgency CISA’s KEV listing and the federal patch deadline push the story into an immediate-response frame