A CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. The ID itself fixes nothing, but it is how everyone finds information about that one problem.
What is a CVE?
CVE stands for Common Vulnerabilities and Exposures. Software makers, hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. providers, security tools and site owners all refer to exactly the same problem by its ID, which ties together every advisory, patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem. and scanner warning about that one weakness.
Every CVE ID has the same format: the letters CVE, the year the ID was reserved and a sequence number. Behind that ID sits a CVE record with a short description of the vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data., the affected product, the affected versions and links to references such as the maker’s security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it..
The CVE Program is run as a shared system. Organizations called CVE Numbering Authorities (CNAs) may assign IDs and publish records for their own products or for a defined scope. Many open-source projects act as their own CNA, so the record comes straight from the people who know the code best.
What a CVE record does not tell you
A CVE record is deliberately short. It does not tell you whether attackers are using the flaw, how easy it is on your specific server, or what to do step by step. That information comes from other sources. Severity is usually expressed as a CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. score, either supplied by the CNA or added later by the NVDThe NVD is a US government database of known security weaknesses. It adds its own severity scores and extra details to the public records of each weakness.. Proof of real-world exploitation is tracked in lists such as CISA KEVCISA KEV is a list kept by the US cybersecurity agency CISA of security weaknesses that attackers are known to have used in real attacks..
How CVEs work for PHP sites
PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. itself, the PHP extensions on your server and the WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. plugins or themes you run can all receive CVEs. A CVE in PHP affects the language runtime on the server, which means every site on that PHP installation may be in scope, regardless of which CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code. it uses.
A recent example: on 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP Group published CVE-2026-109618 and CVE-2026-109619 on cve.org, and both records list 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12 as affected. The press calls this pair PHP2Shell. The CVE records give each a CVSS v4.0 score of 9.2.
The same advisory shows why the affected-versions field is not the whole story. PHP 8.1 and older no longer receive updates from the PHP project and are not listed in the records, but the PHP security team published minimal source patches for 7.4, 8.0 and 8.1, so those versions should be treated as affected too.
How to read a CVE in practice
When a new CVE appears for software you use, three questions matter most. First, which version do you run? A CVE only applies to the versions it names, so you need to know your exact PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. and the versions of your plugins. Second, is there a fixed release? The advisory linked from the record normally names the version that closes the hole. Third, can you install it safely? On a live business site that means a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update., a test and a way back.
If you do not know which PHP version your site runs, you can check your PHP version with the free tool, which reads the public headers of your site and tells you what it can see from the outside. For the current status of the October 2026 PHP vulnerabilities, with every fact sourced and timed, see the PHP2Shell page, where you can also ask for help.
When a CVE needs action from you
A CVE with a high score in software you actually run is a reason to plan an update now rather than at the next maintenance window. If your site runs a PHP version that is past end of lifeEnd of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes., new CVEs in PHP will not get an official fix for your branch at all, and every new record widens the gap. That is the moment to move to a supported version with our service to update PHP in WordPress, with a stagingA staging environment is a private copy of your website where you try updates first, so any mistakes happen there and not on the live site. test and a rollbackA rollback means going back to the last version of your website that worked, after an update has gone wrong. plan.
Frequently asked questions
Is every CVE dangerous for my website?
No. A CVE only says a vulnerability exists in a product and which versions are affected. Whether it matters to you depends on whether you run an affected version and whether the vulnerable part is reachable on your setup.
Who assigns CVE IDs?
CVE IDs are assigned by CVE Numbering Authorities (CNAs), organizations authorized by the CVE Program. Many software projects act as their own CNA. For the two PHP vulnerabilities fixed on 21 October 2026, the PHP Group published the records on cve.org.
Does a CVE mean the vulnerability is being exploited?
No. A CVE record describes the weakness, not attacks. Evidence of real-world exploitation is tracked separately, for example in the CISA Known Exploited Vulnerabilities catalog. Not being listed there does not prove that nobody is exploiting it.
Where do I look up a CVE?
Start with the record on cve.org, then read the advisory of the software maker for fixed versions and upgrade advice. The NVD adds its own analysis later, which can take some time.