What is a vulnerability? A plain guide to security flaws

WindowsMaciPhoneAndroidUpdated

The UK's National Cyber Security Centre (NCSC) defines a vulnerability as "A weakness, or flaw, in software, a system or process." Its glossary adds that an attacker exploits these to, for example, gain unauthorised access to a computer system. Software makers fix them with updates, and installing those updates is what the NCSC calls patching. This guide is accurate as of 23 October 2026.

Quick answer

A vulnerability is a weakness or flaw in software, a system or a process that an attacker could take advantage of, according to the NCSC. Flaws are found by researchers and suppliers, reported to the organisation responsible, fixed, and then published with an advisory. Installing updates promptly is how the fix reaches your own devices.

What does vulnerability mean in security?

In plain terms, it's a gap that shouldn't be there. The NCSC's definition is the one above. The US National Institute of Standards and Technology (NIST) puts it more formally in its glossary: a "Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source."

Two related words come up often. The NCSC defines an exploit as the "Development of tools to take advantage of a vulnerability in a system to gain unauthorised access or produce unwanted effects". So the vulnerability is the weakness, and the exploit is the means of using it. A zero-day, in the NCSC's glossary, is a recently discovered vulnerability that hackers can exploit, where a fix or patch isn't publicly available yet.

A vulnerability on its own isn't a hack. It's a weakness that could be used, which is why the advice that follows one is about fixing it before anyone does.

How are vulnerabilities found?

The NCSC says "Security vulnerabilities are discovered all the time and people want to be able to report them directly to the organisation responsible." The US Cybersecurity and Infrastructure Security Agency (CISA) describes the people who find them as researchers, suppliers and others, who can report a suspected flaw to CISA for coordination.

The NCSC encourages organisations to make that easy. Its Vulnerability Disclosure Toolkit recommends a clear contact route, such as a secure web form, and a published policy that says what someone reporting a flaw can expect. It also describes security.txt, a small file a website can publish so that anyone who finds a problem knows who to tell.

What is coordinated disclosure?

It's the process of getting a flaw fixed and announced in an orderly way. CISA says its Coordinated Vulnerability Disclosure programme "facilitates the timely and synchronized dissemination of vulnerability information and any associated mitigations if available." It aims to get that information to everyone involved, from the person who reported the flaw to the software maker and its customers, at the same time.

CISA lists the stages it follows: the report is submitted, CISA checks it is genuine and in scope, it works with the supplier to confirm the flaw, it decides whether the flaw needs a CVE identifier, the parties agree the wording and timing of an advisory, and then it's published. If a supplier doesn't respond or won't agree a reasonable timeframe for a fix, CISA says it may disclose the flaw as early as 45 days after first trying to contact them, whether or not a patch exists.

The NCSC's toolkit covers the same process from the organisation's side. It tells organisations not to ignore a report, to thank the finder, to keep them updated if a fix takes time, and to let them know once it's fixed.

How do vulnerabilities get a name and a fix?

Many get a CVE number. CISA describes the Common Vulnerabilities and Exposures (CVE) Program as "a globally recognized system for identifying, naming, and cataloging cybersecurity vulnerabilities". That's why advisories quote codes like CVE-2026-109618. Our guide to CVE numbers and CVSS scores explains what the numbers and severity ratings mean.

The fix itself is usually a patch. The NCSC defines patching as "Installing updates to devices or software to improve security and/or enhance functionality."

Why do updates matter?

Because an update is how a fix reaches you. The NCSC's advice for individuals is to apply updates to your apps and your device's software as soon as they're available, and not to ignore a prompt to update. It calls applying updates one of the most important and quickest things you can do to stay safe online, and suggests turning on automatic updates where your device offers them.

The NCSC also warns that manufacturers eventually stop updating older devices. A device that's no longer supported won't receive security updates, and the NCSC says that leaves a phone less secure.

What does PHP2Shell show about vulnerabilities?

PHP2Shell is a recent example of the whole cycle. On 21 October 2026 the PHP project announced two critical flaws, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution without logging in, and released fixed versions the same day. Its advisory says Linux distributions and long-term support vendors received the patches in advance, and Japan's IPA notes that the security company Wiz was involved in investigating the flaws. The NCSC, CISA, JPCERT/CC and IPA then told organisations to update. As of 23 October 2026, CISA says in its alert of 21 October, revised on 23 October, that it "has not observed successful exploitation of these vulnerabilities in the wild as of the time of publication". The full story is in our hub guide, PHP2Shell explained.

More questions

What does 脆弱性 mean?

脆弱性 (zeijakusei) is the Japanese word for vulnerability. It's the term Japan's IPA and JPCERT/CC use in their security alerts, including their October 2026 alerts about the PHP flaws. The meaning is the same as in English: a weakness in software or a system that an attacker could take advantage of.

Is a vulnerability the same as a virus?

No. In the NCSC's definitions, a vulnerability is a weakness or flaw, and an exploit is a tool developed to take advantage of it. So a vulnerability is the weakness, not the attack, which is why the advice is to fix it before anyone uses it.

Does every vulnerability get fixed?

Not always quickly. CISA says that if a supplier doesn't respond or won't set a reasonable timeframe, it may disclose a flaw after 45 days whether or not a patch exists. Software that's out of support may get no fix at all: PHP 8.1 and older receive no updates from the PHP project.

What happens if my device no longer gets updates?

The NCSC says a device that's no longer supported won't receive security updates from the manufacturer, which makes it less secure. It suggests checking online whether a specific model still receives updates. The same applies to software: is PHP safe? shows how support works for PHP versions.

I've found a flaw in a website. How do I report it?

Look for the organisation's vulnerability disclosure policy or its security.txt file, which the NCSC recommends organisations publish. If the flaw is in a supplier's product rather than one organisation's site, CISA accepts reports for coordination through its VINCE-NT platform.

Sources