Federal cybersecurity authorities have formally updated the Known Exploited Vulnerabilities catalog under Binding Operational Directive 22-01, issuing an emergency patch mandate for two core web engine flaws. Unauthenticated remote adversaries actively weaponize uninitialized memory allocation routines across web application runtimes to execute arbitrary system commands under the web server daemon context.
The catalog additions cover PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619, carrying CVSS scores of 9.8. The security defects reside in internal array hash table memory allocation subroutines when handling multipart HTTP POST request streams. Threat telemetry confirms global botnet scanning arrays broadcasting automated exploit payloads to drop web shell backdoors and cryptominers across unpatched web hosting infrastructure. Federal civilian executive branch agencies face a mandatory compliance patch deadline to update affected host systems.
Subverting central web engine runtimes presents severe systemic risks to corporate web portals, e-commerce platforms, and cloud microservices. Because PHP parses request payloads before application code executes, an unauthenticated core remote code execution flaw allows threat actors to establish persistent host backdoors and exfiltrate backend database credentials.
– Upgrade production PHP environments immediately to patched maintenance releases 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
– Enforce web application firewall WAF rules to inspect and strip malformed multipart POST request bodies on non-upload endpoints.
– Inspect web server process execution trees for unauthorized shell invocations originating from PHP worker daemons.
– Isolate legacy unsupported PHP environments running version 8.1 or earlier behind strict zero trust access control proxies.
Web runtime security demands immediate patch deployment and rigid edge request filtering to ensure central web hosting infrastructure remains protected against active wild exploitation. #CodeDefence #PHP #PHP2Shell #RCE #CISA #KEV #AppSec #WebSecurity #PatchManagement #DevSecOps
/
