Vulnerabilities: CVEs, explained
without the panic.

Write-ups of the vulnerabilities that matter for anyone running a website, an API or a server: what is affected, what an attacker can actually do, which versions fix it and what to do if you cannot patch today. Every claim is linked to its primary source.

12
Write-ups: 8
Critical: 3
Known exploited

01All write-ups, newest first

12 articles

CVE-2026-109618 · critical

PHP2Shell: CVE-2026-109618 and CVE-2026-109619 explained

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is unauthenticated PHP RCE. See the fixed build per branch, SAPI preconditions and distro backports.

10 min read

CVE-2026-15176 · high

CVE-2026-15176 and nginx's October 2026 security release

nginx 1.31.7 / 1.30.6 fixed five CVEs, led by CVE-2026-15176, an alias-plus-rewrite heap overflow. What each one needs, how to check, and how to patch.

7 min read

CVE-2026-42533 · critical

CVE-2026-42533: the NGINX map heap overflow

A heap overflow in nginx's map module when a regex capture is read before the map output. Who is affected, which config patterns to grep for, and the fix.

7 min read

CVE-2026-42945 · critical

CVE-2026-42945: the NGINX Rift rewrite overflow

A heap overflow in nginx's rewrite module from an unnamed capture plus a question mark. Who is affected, how to audit your config, and how to patch it.

8 min read

CVE-2025-55182 · critical

CVE-2025-55182 (React2Shell): RSC deserialisation RCE

React2Shell is an unauthenticated RCE in React Server Components via Flight deserialisation. Affected React and Next.js versions, fixes and how to check.

7 min read

CVE-2025-49844 · critical

RediShell (CVE-2025-49844): the Redis Lua use-after-free

RediShell is a use-after-free RCE in the Redis Lua engine. Affected and fixed versions, the companion CVEs, and hardening with ACLs and network isolation.

7 min read

CVE-2025-8671 · high

MadeYouReset: the HTTP/2 attack that bypassed Rapid Reset fixes

MadeYouReset makes the server reset HTTP/2 streams for you, bypassing Rapid Reset defences. How it works, which stacks were affected, and how to stop it.

6 min read

CVE-2025-29927 · critical

CVE-2025-29927: the Next.js middleware authorisation bypass

CVE-2025-29927 let attackers skip Next.js middleware with one header, bypassing auth placed there. Affected versions, the fix and an edge rule that helps.

7 min read

CVE-2024-6387 · high

CVE-2024-6387 (regreSSHion): the OpenSSH signal-handler race

regreSSHion is an unauthenticated remote-root flaw in OpenSSH sshd on glibc Linux. Which versions are hit, how to check, the fix and the mitigations.

7 min read

CVE-2024-3094 · critical

CVE-2024-3094: the XZ Utils backdoor

CVE-2024-3094 is a supply-chain backdoor in XZ Utils 5.6.0–5.6.1 that targeted sshd. Which distributions shipped it, how to check, and what it teaches.

7 min read