Patch Tuesday vs. KEV: when to break the monthly patch cycle

What the documents cover

The question pairs a monthly vendor patch cadence with alerts that arrive on other days. Four CISA documents from October 2026 bear on it. One is an alert on critical PHP vulnerabilities, last revised October 26, 2026. The other three are Known Exploited Vulnerabilities (KEV) Catalog notices dated October 23, October 27 and October 30, 2026.

None of the four mentions Patch Tuesday or any monthly cycle. They also set no fixed deadline for out-of-cycle patching. What they do contain is CISA's reasoning about which vulnerabilities cannot wait, and that is the part this guide reports. Where it connects that reasoning to a monthly schedule, it says so.

The PHP alert: patch immediately

The PHP alert is the strongest out-of-cycle signal in the set. CISA's alert tells teams to patch the affected PHP software immediately.

The alert explains the severity. The flaws, known as "php2shell," involve remote code execution without authentication. The alert describes the scope of the affected software. The alert also lists PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.

CISA names the fixed PHP versions.

The timing matters for the question. The alert already said "immediately" before any KEV listing for these CVEs. The alert called for immediate patching before the KEV listing of these CVEs. The alert's revision history also records the later KEV addition.

So in this case CISA's call for immediate patching came before the KEV addition, and the addition came in a later revision. A team that waited for a KEV entry before leaving the monthly cycle would have started later than CISA's advice.

What CISA tells teams to do while patching

The PHP alert is specific about order of work. It starts with finding where the affected software runs. It adds a caution that the software may run as a component of other software.

CISA says to patch internet-facing systems first. That is a priority order inside an urgent patch, not a reason to delay the rest.

The alert also covers systems that cannot be updated at once. It says teams must decide how to handle those systems. A monthly cycle has no slot for that decision, and CISA's text leaves no room to wait for one.

Two further steps appear in the alert. On interim protection, it says some measures can reduce risk until patching is done. The word "some" is CISA's. On detection, it tells teams to look for signs of exploitation.

The three KEV notices

The other three documents are short KEV notices. Each says the listed items were added "based on evidence of active exploitation." They name the following entries:

• October 23, 2026: CISA added an entry to the KEV Catalog.
• October 27, 2026: CISA added two entries to the catalog.
• October 30, 2026: an Ivanti Connect Secure entry, and a second Ivanti Connect Secure entry, CVE-2026-118527.

Unlike the PHP alert, these notices carry no patch instructions, version numbers or deadlines. They are catalog announcements. A security team reading them still has to look up the vendor guidance for each product.

The three notices fell on October 23 (a Friday), October 27 (a Tuesday) and October 30 (a Friday), as the calendar for 2026 falls. The documents do not say whether any of these dates line up with a vendor's monthly release. CISA's notices treat the KEV listing as arriving on its own timetable.

BOD 26-04: how CISA ranks urgency

All three KEV notices repeat the same paragraph about Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk." This is the closest the documents come to a rule for when to leave a routine schedule. The notices say BOD 26-04 requires rapid remediation of high-risk vulnerabilities and allows lower-risk ones to be deferred.

That sentence has three conditions and one counterpart. A vulnerability is high-risk in CISA's sense when it is in the KEV Catalog, sits on a publicly exposed asset, and gives total control of the asset after exploitation. Lower-risk vulnerabilities may be deferred. The text names deferral as part of the directive, so it is not only a speed requirement.

The directive also looks backward. The notices say the directive sets expectations for agencies that patched late. The documents give no detail on those expectations. They show only that CISA treats a late patch as a possible compromise, not only as a closed gap.

On who must follow it, the notices name federal civilian agencies.

Reading a monthly cycle against these alerts

The documents support one way to reconcile the two timetables, and it follows from CISA's own wording. The risk test in BOD 26-04 is the same kind of test that the PHP alert applies informally, by asking about internet-facing exposure and remote code execution without authentication. The monthly cycle can carry what the test defers. The test decides what leaves the cycle.

Three points come straight from the documents:

• A KEV listing is not the only trigger. The PHP alert asked for immediate patching before the KEV listing on October 26, 2026.
• Exposure matters as much as the listing. BOD 26-04 ties rapid remediation to publicly exposed assets with total-control impact, and the PHP alert puts internet-facing systems first.
• Inventory comes before either. CISA's PHP actions begin with finding where the software runs, including as a component of other software.

The KEV Catalog also changes over time. The notices say a nomination requires a CVE ID and mitigation guidance. That sentence describes what CISA requires of a nomination. It also means an entry usually arrives with a CVE ID and mitigation guidance already in hand.

What the documents leave open

The documents do not say how fast a team outside the federal civilian agencies must patch a KEV entry. They give no number of days. They do not say how to treat a KEV entry on an asset that is not publicly exposed, beyond the statement that lower-risk items may be deferred. They do not say how a team should handle a vendor fix that lands on a monthly date when the KEV entry came first, or the reverse.

Any internal service-level target, emergency change process or cadence rule would be the team's own decision. CISA's October 2026 alerts supply the risk logic for that decision: KEV status, public exposure, total control after exploitation, and an explicit call to patch immediately when unauthenticated remote code execution is in play.