# Vulnerability Briefs

Canonical: https://hackergpt.org/vulnerabilities/

Plain-language briefs on new vulnerabilities: what is affected, how the bug works, how to check your own site and what to patch first, with primary sources.

## [HTTP2Shell (CVE-2026-111497): Is Your App Affected, and What to Patch](https://hackergpt.org/blog/http2shell-brotli-cve-2026-111497/index.md)

Published: 2026-10-24 · https://hackergpt.org/blog/http2shell-brotli-cve-2026-111497/

A memory-corruption bug in the Brotli decoder, disclosed on 21 October 2026, reaches Node.js, Python HTTP clients, curl and proxies. How it works, how to check your own app in five minutes, and which versions fix it.

## [PHP2Shell (CVE-2026-109618, CVE-2026-109619): What Happened and What to Patch](https://hackergpt.org/blog/php2shell-cve-2026-109618-109619/index.md)

Published: 2026-10-24 · https://hackergpt.org/blog/php2shell-cve-2026-109618-109619/

Two unauthenticated remote code execution bugs in PHP itself sent governments offline on 21 October 2026. What went wrong inside PHP, why a third of PHP sites have no official fix, how to check your own servers, and what to do today.