CVE (Common Vulnerabilities and Exposures)

CVE stands for Common Vulnerabilities and Exposures. A CVE is a unique identifier, in the form CVE-YYYY-NNNNN, assigned to one publicly known security vulnerability in a specific piece of software. The identifier gives everyone a common name for the flaw: the project that fixes it, the distributions that ship the fix, the scanners that look for it, and the organizations that have to patch it all refer to the same CVE, so a conversation about "the PHP bug" becomes a precise reference to CVE-2026-109618.

What is a CVE?

The CVE program is run by the MITRE Corporation under sponsorship from the United States Cybersecurity and Infrastructure Security Agency. Identifiers are assigned by CVE Numbering Authorities (CNAs): MITRE itself, national agencies, software vendors, and open source projects such as the Linux kernel, each of which assigns CVEs for flaws in its own scope.

A CVE record holds the identifier, a description of the vulnerability, the affected products and versions, and references to advisories and fixes. A CNA can add a severity score, but the score isn't what makes it a CVE. Scores come from the Common Vulnerability Scoring System (CVSS), which rates a flaw from 0 to 10 based on how it is exploited and what it affects. CVSS v4.0 is the current version; the PHP2Shell flaws were rated 9.2 under it. The National Vulnerability Database (NVD) enriches CVE records with CVSS scores and product identifiers, and distribution security teams publish their own ratings, which may differ from the NVD's because the distribution's build or default configuration changes the exposure.

The year in a CVE identifier doesn't tell you when the flaw was introduced. A CVE can be reserved during a security embargo, before anything is public, so a new advisory can refer to a CVE number that has existed for months.

Why CVEs matter

CVEs are the unit of work for a security program. Vulnerability scanners report by CVE, federal directives set remediation deadlines by CVE, and distribution advisories list the CVEs each package update fixes. Without the shared identifier, none of that reconciliation would be possible.

For an Enterprise Linux estate, the CVE is also how you confirm whether a fix has been applied. The upstream version number is not enough, because distributions backport fixes into older versions without changing the version. On Rocky Linux, dnf updateinfo info --cve CVE-2026-109618 shows whether an advisory for that CVE applies to the host, and rpm -q --changelog php | grep CVE-2026-109618 shows whether the installed build lists the fix in its changelog. Community Rocky Linux publishes its advisories at errata.rockylinux.org. CIQ publishes security advisories for RLC Pro, and the CIQ knowledge base has detailed guidance for major CVEs such as PHP2Shell.

The volume of CVEs is rising

The number of CVEs published each month roughly doubled in 2026. The Google Threat Intelligence Group (GTIG) counted 5,045 disclosures in January 2026 and 10,740 in August. Part of the rise is administrative. The Linux kernel CNA assigns a CVE to any bug fix it identifies as a potential security issue, and CVEs naming the Linux kernel accounted for about 5,000 of the total from January to August, with no exploited zero-days among them. Part of it is AI-assisted research: of the vulnerabilities GTIG identified as likely found with AI, half lead to remote code execution, against 26 percent of the rest.

A raw CVE count no longer tells you much about risk. GTIG found that only 0.23 percent of vulnerabilities disclosed in 2026 were seen exploited, and it recommends threat-intelligence-driven triage over patching everything at once. In practice, that means separating the CVEs being exploited from the thousands that aren't, and patching the exploited ones first. The PHP2Shell guide applies that triage to one critical CVE.

CVE lifecycle

Stage	What happens
Reserved	A CNA sets aside an identifier, often during an embargo. The record is empty but the number exists
Published	The description, affected versions, and references go public. Under coordinated disclosure, this happens alongside the fix
Scored	NVD and vendors attach CVSS scores and, where relevant, their own severity ratings
Fixed downstream	Distributions publish advisories mapping the CVE to fixed package versions for each release and stream they ship
Known exploited	If exploitation in the wild is confirmed, CISA may add the CVE to its Known Exploited Vulnerabilities catalog, which sets remediation deadlines for United States federal agencies
Rejected	A CNA can reject a CVE that turns out to be a duplicate or not a vulnerability. A published CVE can also be marked disputed when the affected vendor contests it

CVEs and RLC Pro

For Rocky Linux from CIQ Pro (RLC Pro), CIQ engineers triage CVEs, backport fixes to the versions customers run, and publish security advisories for each release. On RLC Pro LTS, Important and Critical issues, generally those with a CVSS score of 7.0 or higher, are eligible for backported fixes for up to four years on even-numbered minor versions. CIQ Bridge remediates Critical and Important CVEs across a curated set of priority packages on CentOS 7.9, where no upstream fixes exist, while you migrate to RLC Pro or RLC Pro Hardened. For PHP2Shell, CIQ released fixed packages for RLC Pro LTS 9.6 and 9.2 about three and a half hours after the upstream fix went public. The PHP2Shell guide lists the rest of the response.