# CISA Directs Agencies to Patch Exploited Flaws

CISA added two actively exploited PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known collectively as PHP2Shell, to its Known Exploited Vulnerabilities catalog on October 26, 2026, and directed federal civilian agencies to remediate them by October 29. That deadline has passed. CISA also added the Linux kernel privilege-escalation flaw Fragnesia (CVE-2026-46300), which can be chained with PHP2Shell to obtain root access. For contractors supporting federal websites, applications, hosting, and cybersecurity operations, the alerts create an immediate need to establish which systems remain exposed, complete remediation, and investigate possible compromise; the signals identify no specific solicitation or contract award.

- Contractors should inventory PHP deployments—including embedded components, containers, appliances, and third-party products—and vulnerable Linux systems, then apply available fixes or isolate systems that cannot be promptly secured.
- Agencies and their support contractors should validate remediation and review logs and systems for webshells, credential or session-token exposure, and other signs of compromise. Researchers reported a campaign affecting 25 servers across four countries, including three in a U.S. government-affiliated environment.
- Contractors handling Controlled Unclassified Information should coordinate technical response with legal and incident-response teams; the source notes that delayed remediation may create contractual, regulatory, insurance, and False Claims Act risks even without a confirmed breach.
- The alerts may drive near-term demand for asset discovery, patching and compatibility work, forensic triage, and incident response, but no related procurement opportunity or contact is specified.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 29, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Federal Civilian Executive Branch Agencies (FCEB)

### Key Quotes
> The challenge is not just patching. Teams first have to identify where the vulnerable component exists, determine whether it is externally exposed, understand the mission impact, test the fix, and validate that remediation actually worked.
> — Hemant Baidwan, Chief Information Security Officer at Knox

> The reality is that many organizations are likely running older, unsupported versions, which introduces the additional complexity of upgrading applications, addressing compatibility issues, or working with vendors to obtain supported fixes.
> — Ramy Rahman, Senior Principal Solutions Engineer at ArmorCode

> Organizations need clear answers about who owns patching for each system and how they validate that patches have been applied.
> — Travis Rosiek, Public Sector Chief Technology Officer at Rubrik

### Sources
- [CISA gives federal agencies until Thursday to address exploited PHP flaws - Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/cisa-gives-federal-agencies-until-thursday-address-exploited-php-flaws/416838) - Nextgov/FCW
- [CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks](https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks) - BleepingComputer
- [Cybersecurity Vulnerabilities and Security Updates: Why Hours Matter, What Defense Tech and Dual Use Companies Should Do Now | Wilson Sonsini Goodrich & Rosati - JDSupra](https://www.jdsupra.com/legalnews/cybersecurity-vulnerabilities-and-6533251) - JD Supra