PHP: The three letters that shut down sites all over the internet today

A newly disclosed vulnerability is only a real risk to your organization once it's confirmed present and exploitable in your own environment, not every CVE applies equally to every network. Knowing the difference is exactly what a proper vulnerability assessment is for.