# The vulnerabilities worth stopping for.

Source: https://libwatch.com/en/cve-alerts

CVE alerts

Not a list of 300 CVEs a day: only the critical vulnerabilities in the languages, frameworks and CMSs you use, explained with the commands to check and fix them.

Critical · CVSS 9.2Exploited in the wildUpdated October 22, 2026

## PHP2Shell: two vulnerabilities in the PHP engine

CVE-2026-109618 and CVE-2026-109619 allow remote code execution without authentication. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

[Read the alert and check](/en/cve/php2shell)

AffectsPHP-FPM, mod\_php, php-cgi, FrankenPHP, LiteSpeed

AdvisoriesCERTFR-2026-ALE-014 · CISA

ExploitationSince October 17, 2026

Archive

## Previous alerts

Each alert stays online and dated: it serves as a reference when the vulnerability comes up again in an audit.

| Vulnerability | Technology | Severity | Published | Status |
| --- | --- | --- | --- | --- |
| [Ruby Regexp](/en/cve/ruby-regexp) | Ruby and GitLab | CVSS 10 | Oct 23, 2026 | Ongoing |
| [PHP2Shell](/en/cve/php2shell) | PHP engine | CVSS 9.2 | Oct 21, 2026 | Ongoing |

## Get critical vulnerabilities by email

One email every Monday morning, only in the weeks that matter: at most eight notable vulnerabilities, exploited ones first.

Our method

## How we write these alerts

1. Primary sources

2. Dated

3. Useful first