CISA Adds PHP RCE Flaws CVE-2026-109618 and CVE-2026-109619 to KEV After Honeypot Confirmation

CISA confirmed active exploitation of CVE-2026-109618 out-of-memory corruption and CVE-2026-109619 stale request-state issues after Adel Karimi at Perplexity demonstrated reliable RCE chains on mod_php honeypots yielding 800 KiB memory disclosures and function pointer reuse. Patches landed in PHP 8.5.12 8.4.27 8.3.36 and 8.2.35 on October 21 with federal agencies required to remediate by October 29. Censys data shows 32.51 million exposed PHP services still on vulnerable builds while the PHP Foundation separately patched a related Brotli decoder out-of-bounds write CVE-2026-111497 reachable via cURL decompression in Windows builds. Over thirty vendors including Siemens Schneider Electric and Ivanti issued coordinated advisories indicating broad supply-chain exposure. The pattern matches prior PHP memory-safety clusters where initial crash reports preceded weaponized chains within days once public offsets circulated. No independent technical attribution ties observed traffic to any state actor; CISA listing reflects only observed exploitation volume not origin claims. Agencies and operators must prioritize single-worker mod_php instances first given Karimi's measured success profile while tracking post-patch telemetry for regression attempts or secondary Brotli abuse in HTTP/2 flows.