CVE alerts

The vulnerabilities worth stopping for.

Not a list of 300 CVEs a day: only the critical vulnerabilities in the languages, frameworks and CMSs you use, explained with the commands to check and fix them.

Read with an AI .md version

Critical · CVSS 9.2 Exploited in the wild Updated October 22, 2026

PHP2Shell: two vulnerabilities in the PHP engine

CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Read the alert and check
Affects
PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed
Advisories
CERTFR-2026-ALE-014 · CISA
Exploitation
Since October 17, 2026

Archive

Previous alerts

Each alert stays online and dated: it serves as a reference when the vulnerability comes up again in an audit.

VulnerabilityTechnology SeverityPublishedStatus
Ruby Regexp Ruby and GitLab CVSS 10 Oct 23, 2026 Ongoing
PHP2Shell PHP engine CVSS 9.2 Oct 21, 2026 Ongoing

Our method

How we write these alerts

  1. Primary sources

    The vendor, CERT-FR and CISA first

    Every fact links to its source. An unconfirmed rumor doesn't make it into the alert, or appears in it as debunked.

  2. Dated

    A visible update time

    We correct the alert as soon as a fact changes: KEV catalog, EPSS score, distribution packages.

  3. Useful first

    Check and fix, even without LibWatch

    The commands are in the alert. LibWatch only comes in afterward, to monitor all your projects at once.