Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Fact · exploitation · confirmed

CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog

Who says it: CISA · Sources: CISA CISA CVE record

Catalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding.

Fact-check

A6 Established · State · verdict: holds

The CISA alert itself carries the dated negative and the captured KEV JSON (catalogVersion 2026.10.21, 1754 entries, counted by this desk) contains neither CVE; the CVE record's CISA ADP SSVC also says Exploitation none at 14:34Z on 21 Oct. All three are CISA, one party, but each is the authoritative record for what it says.

Capture checkedResultWhat it sayssha256 of the text read
cisa-alert-php-20261021carriesWhile CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.7bf853872a073bde
cisa-kev-jsoncarriesnothing that carries itef8fffede5c47200
cve-cve-2026-109618carriesnothing that carries itf856138e139c216e
cve-cve-2026-109618absentnothing that carries itf8705d8e0aa2a248

Open tickets: Contradiction-2, Evidence-1, Evidence-10, Evidence-6, Finding-13, Finding-63.

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on the fact-check page.

This fact over time

  1. 2026-10-21CISA publishes Critical Vulnerabilities in PHP Require Immediate Patching
  2. 2026-10-21 13:48 UTCCVE record publishes CVE-2026-109618: RCE via OOM corruption
  3. 2026-10-21 14:04 UTCCISA publishes CISA Known Exploited Vulnerabilities catalog (JSON feed)
  4. 2026-10-22 08:12 UTCSaved into the evidence vault: CVE record
  5. 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
  6. 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

What it rests on

Critical Vulnerabilities in PHP Require Immediate PatchingCISA Known Exploited Vulnerabilities catalog (JSON feed)CVE-2026-109618: RCE via OOM corruptionfact cisa-none

Where this fact appears

In the briefings for:

AlexCurious readerCaseyWebsite ownerJordanBoard member or executiveSamSecurity leadBlakeAnalyst or policy advisorRobinCISOQuinnCFOMorganData protection officerJamieHead of AppSec

And on every claim.

Every version of this fact

v1 · site v0.1.0 · 22 October 2026 · confirmed
CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog
Who says it: CISA
Status: confirmed
Topic: exploitation
Sources: cisa-alert-php-20261021, cisa-kev-json, cve-cve-2026-109618