Two PHP Flaws Added to CISA's Exploited Vulnerabilities List
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two recently patched PHP-related vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, marking them as under active attack in the wild, according to The Hacker News, which reported the listing on 27 October.
That designation is the strongest signal available to defenders that a flaw has moved past theoretical risk: inclusion in the KEV catalog means CISA holds credible evidence of real-world exploitation — not a working proof-of-concept or a researcher's demonstration.
Both vulnerabilities carry a CVSS base score of 9.2 and, as reported, enable unauthenticated remote code execution on affected deployments — a pairing that puts them among the more severe classes of flaws, since an attacker needs neither credentials nor user interaction to reach the vulnerable code path.
One of the pair, CVE-2026-109618, is described in the source as an out-of-memory condition. Readers should therefore treat the RCE characterisation as applying to the two flaws as reported rather than to each CVE individually, until the upstream advisory spells out the precise failure mode for each.
For remediation planning, three details still need to be pulled from primary sources rather than this report: the identifier of the second CVE, the affected and patched PHP version ranges, and any remediation deadline CISA attached to the KEV entry. All three are available directly from CISA's catalog and the upstream vendor advisory, and should be confirmed there before patch work is scoped.
It is also worth being precise about what the KEV listing does not establish. CISA has confirmed exploitation; it has not, on the basis of this listing alone, attributed the activity to a named threat actor or a specific campaign, and no such attribution should be inferred.
For teams outside the U.S. federal perimeter, KEV membership still matters. CISA's known-exploited-vulnerability requirements impose a defined remediation window on federal agencies, and that window is widely used across the industry as a practical benchmark for how quickly a flaw with confirmed in-the-wild exploitation should be patched everywhere else.
For organisations in Hong Kong and elsewhere running legacy PHP stacks, the practical checklist is straightforward:
- Identify exposure. Inventory every system running PHP, including embedded deployments, content management platforms, control panels, and container images where the runtime version may be overlooked.
- Verify the runtime version against the patched release named in the upstream advisory, and confirm the fix is actually deployed rather than merely available.
- Triage by reachability. Prioritise internet-facing services, where unauthenticated exploitation requires no foothold.
- Assume the window is short. Confirmed active exploitation compresses patch timelines; compensating controls such as egress restrictions and virtual patching at the web application firewall are interim measures, not substitutes.
- Check the KEV entry for the binding remediation date and confirm it against your own patch schedule.
The story was reported by The Hacker News on 27 October.
兩個 PHP 漏洞列入 CISA 已遭利用漏洞清單
據 The Hacker News 於 10 月 27 日報道，美國網絡安全和基礎設施安全局（CISA）已將兩個近期修補的 PHP 相關漏洞列入其已知遭利用漏洞（KEV）目錄，標示它們正遭受實戰中的主動攻擊。
此一認定是防禦方所能獲得的最強訊號，表明漏洞風險已超越理論層面：列入 KEV 目錄意味著 CISA 持有該漏洞在現實環境中遭利用的可信證據——而非僅是可行的概念驗證（proof-of-concept）或研究人員的演示。
兩個漏洞的 CVSS 基準評分均為 9.2，據報可在受影響的部署上實現未經身份驗證的遠端代碼執行（RCE）——這項組合使它們屬較為嚴重的漏洞類別，因為攻擊者既不需要憑證，也不需要用戶互動即可觸及有漏洞的代碼路徑。
其中一個漏洞 CVE-2026-109618，在原始報道中被描述為記憶體耗盡（out-of-memory）情況。因此，讀者應將 RCE 的描述理解為針對報道中的兩個漏洞整體而言，而非各別適用於每一個 CVE，直至上游安全公告明確說明每個漏洞的具體故障模式。
就修補規劃而言，仍有三項細節需從一手資料而非本報道中取得：第二個 CVE 的識別編號、受影響及已修補的 PHP 版本範圍，以及 CISA 為該 KEV 條目所設的任何修補期限。以上三項均可直接從 CISA 目錄及上游廠商安全公告查得，並應在劃定修補工作範圍前於該處核實。
同時亦須準確理解 KEV 列名並未確立的事項。CISA 已證實漏洞遭利用；但僅憑此次列名，並未將相關活動歸因於特定威脅行為者或具體攻擊行動，不應作出此類歸因推斷。
對於美國聯邦體系以外的團隊，KEV 列名同樣重要。CISA 的已知遭利用漏洞規定為聯邦機構訂明了修補期限，而該期限在業界被廣泛用作實務基準，用以衡量其他地方應在多短時間內修補已確認在實戰中遭利用的漏洞。
對於香港及其他地區運行舊版 PHP 技術堆疊的機構，實務清單如下：
- 識別暴露面。 盤點所有運行 PHP 的系統，包括嵌入式部署、內容管理平台、控制面板，以及運行時版本容易被忽略的容器鏡像（container image）。
- 核實運行時版本是否與上游安全公告所列的已修補版本相符，並確認修補程式確已部署，而非僅已提供。
- 按可達性分級處理。 優先處理面向互聯網的服務，因為此類服務的未經身份驗證利用無需任何立足點。
- 假設窗口期很短。 已確認的主動利用會壓縮修補時間表；出口流量限制（egress restriction）及在網絡應用防火牆（WAF）進行虛擬修補等補償性控制屬過渡措施，並非替代方案。
- 查閱 KEV 條目的具修補約束力的期限，並與自身的修補計劃核對。
該報道由 The Hacker News 於 10 月 27 日刊出。