CVEs Found

Well-known security flaws explained in plain words, with who is affected and what to do about each one.

A CVE is a public id for one known security flaw, such as CVE-2026-109618. Because the id is public, vendors, researchers and defenders all mean the same flaw when they use it.

Most flaws also get a CVSS score from 0 to 10 for how severe they are. When there is reliable evidence that attackers are using a flaw, CISA, the US government's cyber defence agency, adds it to its Known Exploited Vulnerabilities (KEV) list. US federal agencies must then fix it by a set date.

This topic takes flaws that made the news and explains each one for a reader with no background. Every article follows the same order, so you always know where to look.

An article starts with the short version and a picture of where the flaw sits, then explains how each bug works. It goes on to the timeline, the fixes, a quick check of whether you are affected and what defenders should hunt for. Terms are explained where they first appear and again in a glossary at the end, and every date, version and score links to its source.

How to Read a CVE

Every CVE entry has the same few parts. This is the record for CVE-2026-109618, the first PHP2Shell bug, with each part numbered and explained beside it.

CVE RecordCVE-2026-109618

  1. CVE IDCVE-2026-109618The public id, so that vendors, researchers and defenders all name the same flaw.
  2. NamePHP Memory Corruption VulnerabilityA short description of the flaw. This is the name CISA gives it in its KEV list, and PHP2Shell is the name the news uses for both bugs.
  3. Affected Versions8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35, and 8.1 and olderWhich versions of the product have the flaw. Find your own version here first.
  4. Fixed Versions8.5.12, 8.4.27, 8.3.36 and 8.2.35The first release on each branch with the fix. Updating to it, or to anything later on the same branch, closes the flaw.
  5. CVSS Score9.2 Critical on CVSS v4.0 from PHP, and 9.8 Critical on CVSS v3.1 from NVDHow severe the flaw is, from 0 to 10. Different scorers and versions of the scale can give different numbers, so check who gave each one.
  6. KEV StatusAdded on 26 October 2026, due on 29 October 2026Whether CISA has reliable evidence that attackers are using the flaw. The due date is when US federal agencies must have fixed it.
  7. ReferencesThe PHP advisory, the CISA KEV entry and the NVD recordWhere the facts come from. Start with the vendor's advisory, which says what to update.
The parts of a CVE entry, filled in for CVE-2026-109618 from the sources below. The article on PHP2Shell explains each value.

The Articles

Each card is one article, newest first. The ids in brackets are the CVEs that the article covers.

  • PHP2Shell (CVE-2026-109618 and CVE-2026-109619)

    Two bugs inside PHP itself let a stranger run their own code on a web server using only web requests and no password. PHP fixed them on 21 October 2026.

    • CVSS 9.2, Critical
    • Exploited, on the KEV List
    • Fixed on 21 October 2026

Sources