CISA KEV additions, Oct 26 to Oct 27, 2026: what was added and how to triage

What CISA added on Oct 26 and Oct 27, 2026

CISA published two separate alerts, one on each day, and each adds two vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog. That makes four CVEs in total. This guide uses only those two alerts. They are short, and they leave several questions open, which are covered below.

The four entries are:

• CVE-2026-109618, a PHP memory corruption vulnerability (Oct 26)
• CVE-2026-109619, a PHP stale internal request-state vulnerability (Oct 26)
• CVE-2026-48356, an Adobe Commerce and Magento unrestricted file upload vulnerability (Oct 27)
• CVE-2026-111497, a Google Brotli unchecked return value vulnerability (Oct 27)

Oct 26: two PHP vulnerabilities

CISA's Oct 26 alert says it added two vulnerabilities to the KEV Catalog and updated an existing PHP alert. The alert it updated is titled "Critical Vulnerabilities in PHP Require Immediate Patching."

The alert names the two CVEs as CVE-2026-109618, a PHP memory corruption vulnerability, and CVE-2026-109619, a PHP stale internal request-state vulnerability.

The title of the linked PHP alert uses the words "Immediate Patching." The Oct 26 alert itself does not set a date, list affected PHP versions, or describe the exploitation. Security teams that run PHP should read the linked PHP alert directly for those details. It was not among the source documents for this guide.

Oct 27: Adobe Commerce, Magento and Brotli

CISA's Oct 27 alert says it added two vulnerabilities to the catalog and gives the reason for the additions.

The first entry covers Adobe Commerce and Magento. CISA lists it as an unrestricted file upload vulnerability, CVE-2026-48356.

The second entry covers Google Brotli. CISA lists it as an unchecked return value vulnerability, CVE-2026-111497.

The Oct 27 alert gives no product versions, patch references, or description of how attackers are using either flaw. Teams should take those details from the vendors' own advisories, which are outside the scope of this guide.

About "PHP2Shell"

The question asks about PHP2Shell. That name does not appear in either CISA alert. The Oct 26 alert refers only to two PHP CVEs and to the PHP alert it updated. This guide therefore does not claim that PHP2Shell maps to either CVE-2026-109618 or CVE-2026-109619. Teams that track PHP2Shell under that name should check which CVE their own sources attach to it. They should not assume it matches one of the two entries above.

How CISA says to prioritize

Both alerts carry the same guidance on prioritization, and it comes from Binding Operational Directive (BOD) 26-04. CISA describes the directive's scope in its own alert text.

CISA describes the directive's core requirement in terms of the KEV Catalog and exposed assets. Federal agencies must act first on KEV Catalog vulnerabilities on publicly exposed assets where exploitation gives total control.

Applied to these four CVEs, the order of work follows from that wording. A KEV-listed CVE comes first when the vulnerable software is on a publicly exposed asset and exploitation gives total control of that asset. CISA's alerts do not say which of the four CVEs meets that test. Each organization has to make that call from its own asset inventory and from the vendor details.

The directive also covers checking for compromise. CISA states that agencies must also meet its expectations for checking whether systems were compromised. For any of the four CVEs, this means patching alone may not close the matter if the flaw was exploitable before the patch went on. The alerts do not spell out the expectations themselves, so teams should read BOD 26-04 for the specifics.

What the alerts say about deadlines

Neither alert gives a due date for any of the four CVEs. Neither contains a remediation deadline, a number of days, or a calendar date by which to patch. The only timing language in the two documents is in the title of the PHP alert that CISA updated, "Require Immediate Patching," and in the directive's call for "rapid remediation." Neither phrase is a date.

For that reason, this guide cannot state "patch by" dates for the four CVEs, and it does not invent any. A team that needs a hard date should look at the entries in the KEV Catalog itself and at BOD 26-04. Neither was provided here.

Who the directive covers

The directive binds federal civilian agencies only, but CISA addresses everyone else as well. CISA strongly urges all organizations to follow the directive's approach. The same sentence ends with a request to prioritize remediation of KEV Catalog vulnerabilities. For organizations outside the federal civilian government, the alerts therefore set an expectation and not a requirement.

CISA also explains why it treats these flaws as a priority: this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risk.

Where the catalog goes next

CISA says it will keep adding entries. It also invites reports of exploited vulnerabilities that are not yet listed, and it sets minimum conditions for them: a report must meet the catalog's criteria for inclusion.

Summary for triage

From the two alerts alone, the position is as follows:

• Four CVEs were added across two days: two for PHP on Oct 26, and one each for Adobe Commerce and Magento and for Google Brotli on Oct 27.
• CISA's stated priority rule is KEV-listed CVEs on publicly exposed assets that give total control after exploitation.
• No patch date appears in either alert.
• The name PHP2Shell does not appear in either alert.

Everything beyond that, including affected versions, fixed versions and exact deadlines, needs to come from the vendors, the linked PHP alert, the KEV Catalog entries and BOD 26-04.