Story perspectives

CISA Orders Federal Agencies to Patch PHP Bugs by Oct. 29

By Drooid · Oct 28, 2026 · How we work

Read the story

Story summary

Summary

CISA issued a binding operational directive requiring federal agencies to patch critical PHP vulnerabilities by Oct. 29.
The two bugs were added to CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation.
Officials said agencies must locate vulnerable PHP components and assess exposure.
Officials said agencies must test fixes and validate remediation.
Experts warned many organizations run outdated PHP versions, complicating upgrades for services that power 70% of websites.

1 of 1

CISA issued a binding operational directive requiring federal agencies to patch critical PHP vulnerabilities by Oct. 29.
The two bugs were added to CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation.
Officials said agencies must locate vulnerable PHP components and assess exposure.
Officials said agencies must test fixes and validate remediation.
Experts warned many organizations run outdated PHP versions, complicating upgrades for services that power 70% of websites.