# Fact: CISA has not observed exploitation; neither CVE is in the Known Exploited Vulner

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog Who says it, its status (confirmed), its sources, and its timeline from publication to this site.

Fact · exploitation · confirmed

# CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog

**Who says it:** CISA · **Sources:** [CISA](../../sources/cisa-alert-php-20261021/index.html) [CISA](../../sources/cisa-kev-json/index.html) [CVE record](../../sources/cve-cve-2026-109618/index.html)

Catalog version 2026.10.21 fetched 2026-10-22T08:15Z, 1,754 entries. A point-in-time negative finding.

## Fact-check

**A6** Established●●●●●● · State · verdict: **holds**

The CISA alert itself carries the dated negative and the captured KEV JSON (catalogVersion 2026.10.21, 1754 entries, counted by this desk) contains neither CVE; the CVE record's CISA ADP SSVC also says Exploitation none at 14:34Z on 21 Oct. All three are CISA, one party, but each is the authoritative record for what it says.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [cisa-alert-php-20261021](../../sources/cisa-alert-php-20261021/index.html) | carries | *While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.* | 7bf853872a073bde |
| [cisa-kev-json](../../sources/cisa-kev-json/index.html) | carries | *nothing that carries it* | ef8fffede5c47200 |
| [cve-cve-2026-109618](../../sources/cve-cve-2026-109618/index.html) | carries | *nothing that carries it* | f856138e139c216e |
| [cve-cve-2026-109618](../../sources/cve-cve-2026-109618/index.html) | absent | *nothing that carries it* | f8705d8e0aa2a248 |

Open tickets: [Contradiction-2](../../factcheck/index.html#Contradiction-2), [Evidence-1](../../factcheck/index.html#Evidence-1), [Evidence-10](../../factcheck/index.html#Evidence-10), [Evidence-6](../../factcheck/index.html#Evidence-6), [Finding-13](../../factcheck/index.html#Finding-13), [Finding-63](../../factcheck/index.html#Finding-63).

Graded in Run-1, resting on captures up to 2026-10-22 08:16 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-21CISA publishes [Critical Vulnerabilities in PHP Require Immediate Patching](../../sources/cisa-alert-php-20261021/index.html)
- 2026-10-21 13:48 UTCCVE record publishes [CVE-2026-109618: RCE via OOM corruption](../../sources/cve-cve-2026-109618/index.html)
- 2026-10-21 14:04 UTCCISA publishes [CISA Known Exploited Vulnerabilities catalog (JSON feed)](../../sources/cisa-kev-json/index.html)
- 2026-10-22 08:12 UTCSaved into the evidence vault: CVE record
- 2026-10-22 08:13 UTCSaved into the evidence vault: CISA
- 2026-10-22Enters this site as confirmed in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#cisa-none).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · confirmed
```
CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities catalog
Who says it: CISA
Status: confirmed
Topic: exploitation
Sources: cisa-alert-php-20261021, cisa-kev-json, cve-cve-2026-109618
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/cisa-none/index.html