CISA warns of PHP bug exploitation attempts, gives federal agencies days to patch The federal cybersecurity agency confirmed that two PHP vulnerabilities are being targeted, and ordered all civilian agencies to patch them by Thursday. The Cybersecurity and Infrastructure Security Agency (CISA) added the bugs to the Known Exploited Vulnerabilities (KEV) catalog on Monday evening but declined to answer questions about the nature of the exploitation or potential victims. Within the federal government itself, it’s unclear how many systems might use PHP. The vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — caused global alarm last Tuesday due to the ubiquity of the PHP programming language across the internet. But throughout the week and into the weekend, experts tempered concerns of…