{ "source": "https://github.com/NCSC-NL/php2shell", "commit": "cca173c64ec5", "licence": "EUPL-1.2", "parsed_from": "software/software_list_*.md", "file": "software-list-cca173c64ec5.json", "count": 674, "by_status_109618": { "Fix": 46, "Investigation": 418, "Not vuln": 3, "Vulnerable": 206, "none": 1 }, "by_status_109619": { "Fix": 46, "Investigation": 418, "Not vuln": 3, "Vulnerable": 206, "none": 1 }, "rows": [ { "supplier": "aaPanel", "product": "aaPanel PHP Project hosting and CLI selection", "version": "aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://www.aapanel.com/docs/Function/php.html", "https://www.aapanel.com/forum/d/26249-critical-php-security-update" ] }, { "supplier": "Acquia", "product": "Acquia Cloud Platform PHP hosting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nAcquia publishes selectable PHP runtime settings for Cloud Platform environments.", "links": [ "https://docs.acquia.com/acquia-cloud-platform/configuring-php-settings" ] }, { "supplier": "Adiscon / LogAnalyzer project", "product": "Adiscon LogAnalyzer PHP web application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project identifies LogAnalyzer as a PHP syslog web application; its Composer platform value is only a resolution target.", "links": [ "https://github.com/rsyslog/loganalyzer", "https://github.com/rsyslog/loganalyzer/blob/master/composer.json" ] }, { "supplier": "Adobe", "product": "Adobe Commerce", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nAdobe separately lists PHP modules for its commercial and open-source editions, requires pcntl for parallel indexers, and publishes per-release PHP matrices.", "links": [ "https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings", "https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements" ] }, { "supplier": "Adyen", "product": "Adyen API PHP library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nAdyen's library metadata requires PHP >=7.3 and ctype, curl, json, mbstring and openssl in the calling application.", "links": [ "https://packagist.org/packages/adyen/php-api-library" ] }, { "supplier": "AfterLogic", "product": "AfterLogic WebMail Lite PHP", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor requirements were re-read: PHP >=7.4 and mysqlnd-backed database access apply to the Lite PHP webmail application, separately from its mail services and other editions.", "links": [ "https://afterlogic.com/docs/webmail-lite/system-requirements" ] }, { "supplier": "Aimeos project", "product": "Aimeos Laravel package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official package README requires PHP and adds shop/admin routes and PHP Artisan setup/jobs to Laravel.", "links": [ "https://github.com/aimeos/aimeos-laravel/blob/master/README.md" ] }, { "supplier": "Aimeos project", "product": "Aimeos TYPO3 extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official 2025.x installation guide requires PHP for its TYPO3 commerce extension.", "links": [ "https://aimeos.org/docs/2025.x/typo3/setup/" ] }, { "supplier": "Akaunting", "product": "Akaunting self-hosted application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe application's root runtime requirements explicitly declare PHP and thirteen extensions; README separates PHP from the Node asset pipeline.", "links": [ "https://github.com/akaunting/akaunting/blob/master/composer.json", "https://github.com/akaunting/akaunting" ] }, { "supplier": "Akeneo", "product": "Akeneo PIM Community Edition", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nThe official Akeneo PIM Community Edition Composer manifest declares PHP 8.1.* and required extensions.", "links": [ "https://github.com/akeneo/pim-community-dev/blob/master/composer.json" ] }, { "supplier": "Alpine Linux package maintainers", "product": "Alpine Linux v3.22 php84 package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nAlpine lists the php84 runtime and php84-common dependency, alongside musl and other upstream native libraries. The page separately lists subpackages.", "links": [ "https://pkgs.alpinelinux.org/package/v3.22/community/x86_64/php84" ] }, { "supplier": "Amazon Web Services", "product": "AWS Elastic Beanstalk PHP platform", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nAWS publishes four PHP AL2023 platform4.13.10 rows with branch-specific PHP patches and Composer2.10.3/PIE1.5.1.", "links": [ "https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html" ] }, { "supplier": "Amazon Web Services", "product": "AWS SDK for PHP v3", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nAWS SDK 3.401.2 declares PHP >=8.1 and json/pcre/simplexml. aws/aws-crt-php is required as a userland package; it does not prove ext-awscrt is loaded.", "links": [ "https://packagist.org/packages/aws/aws-sdk-php", "https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_installation.html" ] }, { "supplier": "Amazon Web Services; third-party/customer PHP runtime publisher", "product": "AWS Lambda customer PHP custom-runtime option", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nBref explains that its PHP runtime names resolve to provided.al2023 plus a PHP layer, rather than native AWS PHP support.", "links": [ "https://bref.sh/docs/runtimes", "https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html" ] }, { "supplier": "AMPHP project", "product": "AMP asynchronous PHP framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nAMP is a PHP asynchronous programming library with a PHP runtime constraint and a separate event-loop dependency.", "links": [ "https://packagist.org/packages/amphp/amp" ] }, { "supplier": "Antagonist", "product": "Antagonist DirectAdmin PHP hosting selector", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nAntagonist documents a PHP selector covering all sites in one hosting package, per-version modules and extended support.", "links": [ "https://help.antagonist.nl/hc/nl/articles/8523972848401-Wat-kan-ik-met-de-PHP-selector-in-DirectAdmin" ] }, { "supplier": "Apache Friends", "product": "XAMPP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nApache Friends explicitly lists PHP in its Apache/MariaDB/Perl native bundles. The browser/Endor environment is separated into its own delivery record.", "links": [ "https://www.apachefriends.org/download.html", "https://www.apachefriends.org/index.html" ] }, { "supplier": "APCu / PHP extension maintainers", "product": "APCu native PHP user-cache extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official catalogue identifies APCu as APC User Cache and declares its selected release PHP requirement.", "links": [ "https://pecl.php.net/package/apcu" ] }, { "supplier": "API Platform project", "product": "API Platform Core", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe API framework core declares PHP and runtime Symfony components; Laravel/Doctrine and tooling entries in require-dev are not automatically mandatory production dependencies.", "links": [ "https://packagist.org/packages/api-platform/core" ] }, { "supplier": "Arch Linux package maintainers", "product": "Arch Linux Extra PHP package", "version": "8.5.12-1", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Arch Linux php 8.5.12-1\nArch Linux states that php versions before 8.5.12 are affected by both CVEs; the current Extra package page lists php 8.5.12-1.", "links": [ "https://archlinux.org/packages/extra/x86_64/php/", "https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/" ] }, { "supplier": "Arch Linux package maintainers", "product": "Arch Linux Extra php-legacy package", "version": "8.3.36-1", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Arch Linux Extra php-legacy 8.3.36-1\nArch Linux states that php-legacy versions before 8.3.36 are affected by both CVEs; the current Extra package page lists php-legacy 8.3.36-1.", "links": [ "https://archlinux.org/packages/extra/x86_64/php-legacy/", "https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/" ] }, { "supplier": "Artefactual Systems / AtoM project", "product": "AtoM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 2.9 manual requires PHP for archival description software and distinguishes PHP modules from Elasticsearch, ImageMagick and other external services/tools.", "links": [ "https://accesstomemory.org/en/docs/2.9/admin-manual/installation/requirements/" ] }, { "supplier": "Ascensio System SIA / ONLYOFFICE", "product": "ONLYOFFICE integration for Nextcloud", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe vendor connector manifest requires PHP; the repository separately describes a required ONLYOFFICE Document Server.", "links": [ "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/blob/master/composer.json", "https://github.com/ONLYOFFICE/onlyoffice-nextcloud" ] }, { "supplier": "Auth0", "product": "Auth0 PHP SDK", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe SDK requires PHP ^8.2, json, mbstring, openssl and PSR HTTP implementations. Cache/event-dispatcher implementations are suggested.", "links": [ "https://packagist.org/packages/auth0/auth0-php" ] }, { "supplier": "Automattic / WordPress.com", "product": "WordPress.com plugin-enabled PHP hosting environment", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nWordPress.com publishes PHP8.3/8.4 and a module environment for plugin-enabled hosting plans.", "links": [ "https://wordpress.com/support/php-environment/" ] }, { "supplier": "AWS SDK Common Runtime team", "product": "AWS Common Runtime native PHP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPublisher requirements distinguish UNIX and Windows PHP minima and document OpenSSL-linked builds versus an AWS-LC build option.", "links": [ "https://pecl.php.net/package/awscrt/1.2.7", "https://github.com/awslabs/aws-crt-php" ] }, { "supplier": "AWS SDK Common Runtime team", "product": "AWS Common Runtime PHP userland binding package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe Composer package declares PHP >=5.5 and suggests ext-awscrt while explicitly stating that the native extension is needed to use its functionality.", "links": [ "https://packagist.org/packages/aws/aws-crt-php" ] }, { "supplier": "Backdrop CMS project", "product": "Backdrop CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nBackdrop requires PHP and documents a Drupal 7 upgrade path; OpenSSL is recommended and required by Update Manager.", "links": [ "https://docs.backdropcms.org/documentation/system-requirements", "https://backdropcms.org/" ] }, { "supplier": "bbPress community / WordPress project", "product": "bbPress", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official plugin listing gives PHP and WordPress requirements for the optional server-side forum plugin.", "links": [ "https://wordpress.org/plugins/bbpress/" ] }, { "supplier": "Behat project", "product": "Behat behavior-driven test framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for behat/behat v4.0.0 declares PHP >=8.2 <8.6 for this tool/library.", "links": [ "https://packagist.org/packages/behat/behat" ] }, { "supplier": "Belnet", "product": "Belnet FileSender research/education service", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nBelnet documents a FileSender service for federation members.", "links": [ "https://belnet.be/nl/communities-diensten/alle-diensten/identity-mobility-federation/filesender", "https://docs.filesender.org/filesender/v3.0/install/" ] }, { "supplier": "Ben Ramsey / Ramsey project", "product": "Ramsey UUID", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PHP UUID package uses PHP math/collection dependencies and suggests native modules only for selected acceleration or generator paths.", "links": [ "https://packagist.org/packages/ramsey/uuid" ] }, { "supplier": "Beyond Code in partnership with Laravel", "product": "Laravel Herd managed native PHP environment", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nHerd describes a native PHP stack without containers; Windows documentation distinguishes shipped tools from downloaded PHP binaries.", "links": [ "https://herd.laravel.com/", "https://herd.laravel.com/docs/windows/advanced-usage/directories-and-files" ] }, { "supplier": "Blackfire / Platform.sh SAS doing business as Upsun", "product": "Blackfire deterministic PHP Probe native extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nOfficial docs identify the deterministic PHP probe as a C extension, separate from the agent and browser client.", "links": [ "https://docs.blackfire.io/changelogs/php-probe", "https://docs.blackfire.io/academy/getting-started/installation", "https://docs.blackfire.io/up-and-running/update" ] }, { "supplier": "Blackfire / Platform.sh SAS doing business as Upsun", "product": "Blackfire PHP SDK client library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe publisher registry identifies a PHP SDK with separate suggested ext-blackfire and ext-zlib capabilities.", "links": [ "https://packagist.org/packages/blackfire/php-sdk", "https://docs.blackfire.io/php/integrations/sdk" ] }, { "supplier": "Bolt CMS project", "product": "Bolt CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nBolt 5.2 documentation explicitly requires PHP and lists core and optional PHP modules.", "links": [ "https://docs.boltcms.io/5.2/getting-started/requirements" ] }, { "supplier": "BookStack project", "product": "BookStack", "version": "Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStack code alone is insufficient.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://www.bookstackapp.com/docs/admin/installation/", "https://www.bookstackapp.com/blog/php-security-release-critical/" ] }, { "supplier": "Box / Humbug project", "product": "Box PHAR build and packaging tool", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for humbug/box 4.7.0 declares PHP ^8.2 for this tool/library.", "links": [ "https://packagist.org/packages/humbug/box" ] }, { "supplier": "BoxBilling project", "product": "BoxBilling", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe archived project explicitly identifies PHP/MySQL runtime requirements and directs readers to the separately maintained FOSSBilling fork.", "links": [ "https://github.com/boxbilling/boxbilling" ] }, { "supplier": "Bref project", "product": "Bref PHP Lambda runtime layers", "version": "Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded\nBref confirms patched Bref 3 and Bref 2 PHP Lambda layers are published in all regions; update selected layer versions and redeploy.", "links": [ "https://bref.sh/docs/runtimes", "https://github.com/brefphp/bref/issues/2222", "https://bref.sh/news/06-php-security-release-october-2026" ] }, { "supplier": "Bref project", "product": "Bref PHP serverless application adapter", "version": "bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://packagist.org/packages/bref/bref", "https://github.com/brefphp/bref/blob/master/composer.json", "https://bref.sh/news/06-php-security-release-october-2026" ] }, { "supplier": "Bref project", "product": "Bref v2 PHP Docker images", "version": "Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched\nBref confirms published patched v2 Docker images for PHP 8.2 through 8.4; rebuild derived images with fresh base layers and redeploy.", "links": [ "https://bref.sh/docs/runtimes", "https://github.com/brefphp/bref/issues/2222", "https://bref.sh/news/06-php-security-release-october-2026" ] }, { "supplier": "BuddyPress community / WordPress project", "product": "BuddyPress", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nTrac r14231 bumps the 14.0 branch to 14.5.2 while retaining the PHP 5.6 declaration. The current plugin listing frames 7.4 as a hosting recommendation, clarifying the earlier apparent floor conflict.", "links": [ "https://buddypress.trac.wordpress.org/changeset/14231", "https://wordpress.org/plugins/buddypress/" ] }, { "supplier": "bunq", "product": "bunq PHP API SDK", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe vendor SDK declares PHP compatibility, curl/json/mbstring, Guzzle and a Composer plugin API constraint.", "links": [ "https://packagist.org/packages/bunq/sdk_php" ] }, { "supplier": "Cachet project", "product": "Cachet", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official Cachet repository requires PHP 8.3 or later for the self-hosted status page system, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/cachethq/cachet", "https://api.github.com/repos/cachethq/cachet/dependency-graph/sbom" ] }, { "supplier": "CakePHP project", "product": "CakePHP framework", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nCakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages.", "links": [ "https://packagist.org/packages/cakephp/cakephp" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Bionic php7.2-fpm binary package", "version": "7.2.24-0ubuntu0.18.04.17+esm14", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14\nUbuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 with Ubuntu Pro.", "links": [ "https://ubuntu.com/security/notices/USN-8948-2" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Focal php7.4-fpm binary package", "version": "7.4.3-4ubuntu2.29+esm5", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5\nUbuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 with Ubuntu Pro.", "links": [ "https://ubuntu.com/security/notices/USN-8948-2" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Jammy php8.1-fpm binary package", "version": "8.1.2-1ubuntu2.28", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28\nUbuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Jammy php8.1-fpm 8.1.2-1ubuntu2.28.", "links": [ "https://ubuntu.com/security/notices/USN-8948-1" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Noble php8.3-fpm binary package", "version": "8.3.6-0ubuntu0.24.04.13", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13\nUbuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13.", "links": [ "https://packages.ubuntu.com/noble-updates/php8.3-fpm", "https://ubuntu.com/security/notices/USN-8948-1" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu optional PHP package and SAPI family", "version": "Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows.\nUSN-8948-1 supplies fixes for the listed Ubuntu Apache-module, CGI, CLI and FPM packages; separately inventoried FPM rows also retain USN-8948-2 release and entitlement scope.", "links": [ "https://ubuntu.com/server/docs/how-to/web-services/install-php/", "https://packages.ubuntu.com/noble-updates/php8.3-fpm", "https://ubuntu.com/security/notices/USN-8948-1", "https://ubuntu.com/security/notices/USN-8948-2" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Resolute php8.5-fpm binary package", "version": "8.5.4-0ubuntu1.5", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5\nUbuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Resolute php8.5-fpm 8.5.4-0ubuntu1.5.", "links": [ "https://ubuntu.com/security/notices/USN-8948-1" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Stonking php8.5-fpm binary package", "version": "8.5.9-0ubuntu2.1", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1\nUbuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Stonking php8.5-fpm 8.5.9-0ubuntu2.1.", "links": [ "https://ubuntu.com/security/notices/USN-8948-1" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Trusty php5-fpm binary package", "version": "5.5.9+dfsg-1ubuntu4.29+esm18", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18\nUbuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 with Ubuntu Pro Legacy Support.", "links": [ "https://ubuntu.com/security/notices/USN-8948-2" ] }, { "supplier": "Canonical / Ubuntu package maintainers", "product": "Ubuntu Xenial php7.0-fpm binary package", "version": "7.0.33-0ubuntu0.16.04.16+esm22", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22\nUbuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 with Ubuntu Pro Legacy Support.", "links": [ "https://ubuntu.com/security/notices/USN-8948-2" ] }, { "supplier": "CaptainHook / Sebastian Feldmann and contributors", "product": "CaptainHook PHP Git-hook manager", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for captainhook/captainhook 5.29.2 declares PHP >=8.0 for this tool/library.", "links": [ "https://packagist.org/packages/captainhook/captainhook" ] }, { "supplier": "CarbonPHP project", "product": "Carbon date/time library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nCarbon is a PHP DateTime API library with translation, clock and polyfill dependencies.", "links": [ "https://packagist.org/packages/nesbot/carbon" ] }, { "supplier": "Catalyst IT / Mahara project", "product": "Mahara", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement.", "links": [ "https://manual.mahara.org/en/26.04/administration/config_php.html", "https://mahara.org/interaction/forum/topic.php?id=10051&post38023=" ] }, { "supplier": "Centreon", "product": "Centreon Web and central-server PHP interface", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor installation procedure explicitly enables PHP 8.2 for the central web environment.", "links": [ "https://docs.centreon.com/docs/installation/installation-of-a-central-server/using-packages/", "https://github.com/centreon/centreon-collect" ] }, { "supplier": "Chamilo Association / Chamilo project", "product": "Chamilo", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced.", "links": [ "https://docs.chamilo.org/administration-guide/admin-guide/installation/server-requirements" ] }, { "supplier": "Checkmk GmbH", "product": "Checkmk Appliance", "version": "1.7.25", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update\nCheckmk's appliance 1.7.25 release manifest upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release for both php2shell CVEs.", "links": [ "https://checkmk.com/werks?product=cma", "https://download.checkmk.com/appliance/1.7.25/ChangedPackages", "https://www.php.net/archive/2026.php#2026-10-21-5" ] }, { "supplier": "CIRCL, Luxembourg", "product": "CIRCL-operated MISP threat-sharing service", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nCIRCL publicly states it operates multiple MISP instances; MISP's server PHP relationship is independently documented.", "links": [ "https://www.circl.lu/services/misp-malware-information-sharing-platform/", "https://www.circl.lu/doc/misp/requirements/" ] }, { "supplier": "CircleCI", "product": "CircleCI cimg/php CI runtime image family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nCircleCI states each cimg/php tag contains PHP and Composer for CI jobs.", "links": [ "https://circleci.com/developer/images/image/cimg/php", "https://github.com/CircleCI-Public/cimg-php/blob/main/README.md" ] }, { "supplier": "Citrix / NetScaler", "product": "NetScaler ADC", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\n14.1 pooled notice includes PHP; separate guide identifies administration PHP controller. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.", "links": [ "https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf", "https://prod-docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/signatures/signature-auto-update" ] }, { "supplier": "CiviCRM project", "product": "CiviCRM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nPublisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release's direct manifest.", "links": [ "https://packagist.org/packages/civicrm/civicrm-core", "https://docs.civicrm.org/installation/en/latest/requirements/" ] }, { "supplier": "ClassicPress project", "product": "ClassicPress", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files.", "links": [ "https://www.classicpress.net/requirements/", "https://docs.classicpress.net/user-guides/installing-classicpress/" ] }, { "supplier": "Clever Cloud fork of Caucho Technology Quercus", "product": "Quercus CleverCloud development branch", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe branch maintainer identifies a Java PHP implementation copied from Caucho Quercus/Resin.", "links": [ "https://github.com/CleverCloud/Quercus" ] }, { "supplier": "Clientexec", "product": "Clientexec", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nOfficial Clientexec system requirements list PHP runtime support for Clientexec 6.x and 7.x plus required extensions and ionCube Loader versions.", "links": [ "https://docs.clientexec.com/en/article/system-requirements-yl750s/" ] }, { "supplier": "Cloudflare", "product": "Cloudflare Pages v1 legacy PHP build image", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe build-image page retains a legacy PHP row and separately dates v1 migration to v3 before this retrieval.", "links": [ "https://developers.cloudflare.com/pages/configuration/build-image/" ] }, { "supplier": "CloudLinux", "product": "CloudLinux legacy ea-PHP extended-support packages", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately\nCloudLinux identifies ea-php as affected by both CVEs and says patched ea-php74 through ea-php85 packages are scheduled for EasyApache4 v25.91; release is not yet confirmed.", "links": [ "https://docs.cloudlinux.com/cloudlinuxos/alt-ea_packages/", "https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability", "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5" ] }, { "supplier": "CloudLinux / TuxCare", "product": "CloudLinux Alt-PHP / PHP Selector runtime family", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected family: CloudLinux Alt-PHP; scoped fixed alt-php74 and alt-php80 platform rows are recorded separately\nCloudLinux identifies Alt-PHP as affected by both CVEs and reports fixed alt-php74 builds for several Linux platforms plus alt-php80 for Alpine Linux 3.23; broader family coverage is still in progress.", "links": [ "https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/", "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability" ] }, { "supplier": "CloudLinux / TuxCare", "product": "CloudLinux Alt-PHP 7.4 fixed package set", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04\nCloudLinux reports fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, 18.04, 22.04, 24.04 and 26.04.", "links": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5" ] }, { "supplier": "CloudLinux / TuxCare", "product": "CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23\nCloudLinux reports a fixed alt-php80 release for Alpine Linux 3.23.", "links": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5" ] }, { "supplier": "Code LTS / William Desportes and contributors", "product": "Doctum PHP API documentation generator", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for code-lts/doctum v5.6.0 declares PHP ^8.1 for this tool/library.", "links": [ "https://packagist.org/packages/code-lts/doctum" ] }, { "supplier": "Codeception / Michael Bodnarchuk and contributors", "product": "Codeception PHP test framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for codeception/codeception 5.3.7 declares PHP ^8.2 for this tool/library.", "links": [ "https://packagist.org/packages/codeception/codeception" ] }, { "supplier": "CodeIgniter Foundation", "product": "CodeIgniter 4 framework", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific.", "links": [ "https://packagist.org/packages/codeigniter4/framework" ] }, { "supplier": "Combodo", "product": "iTop", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official application manifest declares a bounded PHP runtime requirement separately from development packages.", "links": [ "https://github.com/Combodo/iTop/blob/develop/composer.json" ] }, { "supplier": "Composer / Packagist project", "product": "Packagist.org open-source web application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation.", "links": [ "https://github.com/composer/packagist/blob/main/composer.json", "https://github.com/composer/packagist/blob/main/README.md" ] }, { "supplier": "Composer / Satis maintainers", "product": "Satis Composer repository generator", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for composer/satis 1.0.0 legacy tag declares PHP ^5.6 \\", "links": [] }, { "supplier": "Composer / Satis maintainers", "product": "Satis official PHP container build recipe", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official Dockerfile uses a Composer build stage and PHP8.4 CLI final runtime.", "links": [ "https://github.com/composer/satis/blob/main/Dockerfile" ] }, { "supplier": "Composer project", "product": "Composer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nComposer itself runs on PHP, while its platform model describes PHP, ext-* and lib-* requirements separately from the project packages it manages.", "links": [ "https://getcomposer.org/doc/articles/composer-platform-dependencies.md", "https://getcomposer.org/doc/00-intro.md" ] }, { "supplier": "Composer project / Docker Official Images", "product": "Composer default Docker runtime image", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe pinned recipe installs Composer 2.10.3 into a PHP8 Alpine runtime stage, makes default inherit it, and separately defines a scratch standalone-binary stage.", "links": [ "https://github.com/composer/docker/blob/a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1/latest/Dockerfile", "https://github.com/docker-library/official-images/blob/master/library/composer", "https://github.com/docker-library/docs/blob/master/composer/README.md" ] }, { "supplier": "Concrete CMS / PortlandLabs", "product": "Concrete CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nConcrete states that it is primarily written in PHP and gives a per-release PHP compatibility table.", "links": [ "https://documentation.concretecms.org/9-x/developers/introduction/system-requirements" ] }, { "supplier": "Contao project", "product": "Contao CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions.", "links": [ "https://docs.contao.org/5.x/manual/en/installation/system-requirements/" ] }, { "supplier": "Contao project", "product": "Contao Manager", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nContao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation.", "links": [ "https://docs.contao.org/5.x/manual/en/installation/contao-manager/" ] }, { "supplier": "Coolify", "product": "Coolify", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official Coolify Composer manifest declares PHP ^8.4 for the self-hostable PaaS, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/coollabsio/coolify/blob/main/composer.json", "https://api.github.com/repos/coollabsio/coolify/dependency-graph/sbom" ] }, { "supplier": "Corporation for Digital Scholarship / Omeka project", "product": "Omeka Classic", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project provides version-specific PHP requirements and separately requires ImageMagick for image resizing.", "links": [ "https://omeka.org/classic/docs/Installation/System_Requirements/" ] }, { "supplier": "Corporation for Digital Scholarship / Omeka project", "product": "Omeka S", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends.", "links": [ "https://omeka.org/s/docs/user-manual/install/" ] }, { "supplier": "Couchbase, Inc.", "product": "Couchbase native PHP SDK extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nVersion 4.5.0 is a PHP client extension. Vendor notes update its native C++ core to 1.3.1 and drop PHP 8.1 support despite the registry minimum.", "links": [ "https://pecl.php.net/package/couchbase/4.5.0", "https://docs.couchbase.com/php-sdk/current/project-docs/sdk-release-notes.html", "https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html", "https://packages.couchbase.com/clients/php/couchbase-4.5.0.sha256.txt" ] }, { "supplier": "Couchbase, Inc.", "product": "Couchbase PHP Composer SDK package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe 4.5.0 userland package requires JSON; sockets is require-dev, while gRPC/Protobuf are suggestions.", "links": [ "https://packagist.org/packages/couchbase/couchbase", "https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html" ] }, { "supplier": "Couchbase, Inc.", "product": "Couchbase PHP OpenTelemetry integration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Optional PHP path; CVE match unknown\nThe integration requires PHP>=8.2, couchbase/couchbase^4.5, open-telemetry/api^1.0 and exporter-otlp^1.4.", "links": [ "https://packagist.org/packages/couchbase/couchbase-opentelemetry" ] }, { "supplier": "Craft CMS / Pixel & Tonic", "product": "Craft CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nCraft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line.", "links": [ "https://craftcms.com/docs/5.x/requirements.html" ] }, { "supplier": "Crater Invoice", "product": "Crater", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official Crater repository identifies an invoicing application and its installer config sets a minimum PHP version of 7.4.0; GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/crater-invoice-inc/crater/blob/master/config/installer.php", "https://api.github.com/repos/crater-invoice-inc/crater/dependency-graph/sbom" ] }, { "supplier": "CS-Cart", "product": "CS-Cart and Multi-Vendor", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor.", "links": [ "https://docs.cs-cart.com/latest/install/system_requirements.html" ] }, { "supplier": "CyberPanel project", "product": "CyberPanel hosted PHP / LSPHP options", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nCyberPanel's official README advertises selectable PHP families for hosted applications.", "links": [ "https://github.com/usmannasir/cyberpanel", "https://github.com/usmannasir/cyberpanel/blob/v3.0.5-dev/manage.py" ] }, { "supplier": "daloRADIUS project", "product": "daloRADIUS official Docker distribution recipe", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official Dockerfile declares an Apache PHP package stack separately from the application.", "links": [ "https://github.com/lirantal/daloradius/blob/master/Dockerfile" ] }, { "supplier": "daloRADIUS project", "product": "daloRADIUS PHP web management application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\ndaloRADIUS describes its PHP web application and current PDO database integration.", "links": [ "https://github.com/lirantal/daloradius/blob/master/README.md" ] }, { "supplier": "Dan Phillimore / Uniter project", "product": "Uniter PHP-to-JavaScript runtime stack", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nUniter combines JavaScript parser, transpiler and runtime components to run PHP code.", "links": [ "https://phptojs.com/" ] }, { "supplier": "Datadog / Blackfire integration", "product": "Blackfire PHP continuous-profiler integration using Datadog profiling extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe guide loads datadog-profiling.so from a PHP_API_VERSION-specific path, separate from the deterministic Blackfire probe.", "links": [ "https://docs.blackfire.io/continuous-profiling-cookbooks/php", "https://github.com/DataDog/dd-trace-php/releases" ] }, { "supplier": "DDEV project", "product": "DDEV PHP webserver development container", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nDDEV config defines php_version, ddev/ddev-webserver image selection and separate nginx-fpm/apache-fpm/generic modes.", "links": [ "https://docs.ddev.com/en/stable/users/configuration/config/" ] }, { "supplier": "Debian PHP Maintainers", "product": "Debian trixie PHP 8.4 FPM package", "version": "8.4.27-1~deb13u1", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Debian trixie php8.4 8.4.27-1~deb13u1\nDebian DSA-6574-1 fixes CVE-2026-109618 and CVE-2026-109619 in trixie php8.4 8.4.27-1~deb13u1.", "links": [ "https://packages.debian.org/trixie/php8.4-fpm", "https://lists.debian.org/debian-security-announce/2026/msg00489.html" ] }, { "supplier": "Deployer / Anton Medvedev and contributors", "product": "Deployer PHP deployment automation", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for deployer/deployer v8.0.5 declares PHP ^8.3 for this tool/library.", "links": [ "https://packagist.org/packages/deployer/deployer" ] }, { "supplier": "DEVSENSE / Phalanger project", "product": "Phalanger PHP 5.4 compiler for .NET/Mono", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe archived repository identifies a PHP 5.4 implementation and its PeachPie succession.", "links": [ "https://github.com/DEVSENSE/Phalanger" ] }, { "supplier": "Docker Community / Docker Official Images, not WordPress upstream image ownership", "product": "WordPress Docker Official Image distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe packaging template derives from official PHP images and installs WordPress-serving native extensions; the repository identifies Docker Community ownership.", "links": [ "https://github.com/docker-library/wordpress/blob/master/Dockerfile.template", "https://github.com/docker-library/wordpress" ] }, { "supplier": "Docker Official Images / docker-library PHP maintainers", "product": "Docker Official PHP Apache/mod_php image variant", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified\nThe official guide identifies the Apache variant as PHP loaded into Apache; the tag manifest lists Debian trixie and bookworm builds.", "links": [ "https://github.com/docker-library/docs/blob/master/php/README.md", "https://github.com/docker-library/official-images/blob/master/library/php", "https://github.com/docker-library/php/pull/1694", "https://github.com/docker-library/official-images/pull/22541" ] }, { "supplier": "Docker Official Images / docker-library PHP maintainers", "product": "Docker Official PHP CLI image variant", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified\nThe tag manifest lists patched stable CLI build directories; the selected Alpine recipe sets PHP_VERSION 8.5.12.", "links": [ "https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/alpine3.24/cli/Dockerfile", "https://github.com/docker-library/official-images/blob/master/library/php", "https://github.com/docker-library/php/pull/1694", "https://github.com/docker-library/official-images/pull/22541" ] }, { "supplier": "Docker Official Images / docker-library PHP maintainers", "product": "Docker Official PHP FPM image variant", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified\nThe immutable trixie recipe starts from debian:trixie-slim, disables CGI and enables FPM.", "links": [ "https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/fpm/Dockerfile", "https://github.com/docker-library/official-images/blob/master/library/php", "https://github.com/docker-library/php/pull/1694", "https://github.com/docker-library/official-images/pull/22541" ] }, { "supplier": "Docker Official Images / docker-library PHP maintainers", "product": "Docker Official PHP ZTS image variant", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified\nThe immutable trixie recipe enables ZTS, embed and phpdbg. The manifest groups four OS build directories under ZTS tags.", "links": [ "https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/zts/Dockerfile", "https://github.com/docker-library/official-images/blob/master/library/php", "https://github.com/docker-library/php/pull/1694", "https://github.com/docker-library/official-images/pull/22541" ] }, { "supplier": "Docker Official Images maintainers", "product": "Docker Official Image: php", "version": "", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified\nOfficial Docker PHP source definitions and official-images metadata reference patched stable PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed image digests still need verification.", "links": [ "https://github.com/docker-library/official-images/blob/master/library/php", "https://hub.docker.com/_/php", "https://github.com/docker-library/docs/blob/master/php/README.md", "https://github.com/docker-library/php/pull/1694", "https://raw.githubusercontent.com/docker-library/php/master/versions.json", "https://github.com/docker-library/official-images/pull/22541" ] }, { "supplier": "Doctrine project", "product": "Doctrine DBAL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nDBAL is a PHP database abstraction layer; official configuration documents alternative native-extension drivers and custom driver classes.", "links": [ "https://packagist.org/packages/doctrine/dbal", "https://www.doctrine-project.org/projects/doctrine-dbal/en/4.4/reference/configuration.html" ] }, { "supplier": "Doctrine project", "product": "Doctrine ORM", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PHP ORM release requires DBAL and other PHP packages; database extension choice is inherited from the chosen driver graph, not universal PDO presence.", "links": [ "https://packagist.org/packages/doctrine/orm" ] }, { "supplier": "DokuWiki project", "product": "DokuWiki official Docker distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe Dockerfile starts from php:8.4-apache, allows optional PHP_EXTENSIONS build arguments and creates the DokuWiki image.", "links": [ "https://github.com/dokuwiki/docker/blob/main/Dockerfile", "https://github.com/dokuwiki/docker" ] }, { "supplier": "DokuWiki project / splitbrain", "product": "DokuWiki", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official manifest requires PHP and suggests mbstring for performance and intl for locale-aware sorting.", "links": [ "https://github.com/dokuwiki/dokuwiki/blob/master/composer.json" ] }, { "supplier": "Dolibarr project", "product": "Dolibarr ERP CRM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official release compatibility table supplies version-specific PHP boundaries; the repository identifies a PHP web application with JavaScript enhancements.", "links": [ "https://wiki.dolibarr.org/index.php/Releases", "https://github.com/Dolibarr/dolibarr" ] }, { "supplier": "Drupal Commerce / Centarro", "product": "Drupal Commerce", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official module project explicitly depends on Drupal, separates 3.x/2.x/1.x core lineages and lists its current release.", "links": [ "https://www.drupal.org/project/commerce" ] }, { "supplier": "Drupal project", "product": "Drupal", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nThe refreshed official compatibility matrix preserves major/minor-specific PHP bands. It directs exact extension requirements to core/composer.json; that linked source rendered only a loading placeholder.", "links": [ "https://www.drupal.org/docs/getting-started/system-requirements/php-requirements", "https://www.drupal.org/project/drupal", "https://www.drupal.org/project/drupal/releases/11.4.10", "https://www.drupal.org/project/drupal/releases/10.6.19", "https://packagist.org/packages/drupal/core" ] }, { "supplier": "Drush project", "product": "Drush Drupal administration CLI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for drush/drush 13.8.0 declares PHP >=8.3 for this tool/library.", "links": [ "https://packagist.org/packages/drush/drush" ] }, { "supplier": "EasyPHP project", "product": "EasyPHP PHP Devserver Windows bundle", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe project describes a portable PHP development environment with PHP, Apache and modular PHP/version tools.", "links": [ "https://www.easyphp.org/" ] }, { "supplier": "EC-CUBE project", "product": "EC-CUBE", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe publisher registry provides PHP and direct runtime extension requirements for the explicitly alpha 4.4 sample.", "links": [ "https://packagist.org/packages/ec-cube/ec-cube", "https://github.com/EC-CUBE/ec-cube" ] }, { "supplier": "EGroupware GmbH / EGroupware project", "product": "EGroupware", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe publisher manifest declares PHP, runtime extensions, optional modules and separately versioned suite packages.", "links": [ "https://packagist.org/packages/egroupware/egroupware", "https://github.com/EGroupware/egroupware/blob/master/composer.json" ] }, { "supplier": "Elastic", "product": "Elasticsearch official PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nFresh v9.5.0 registry review corroborates PHP ^8.1 and transport ^9.0, and separates yaml/zip development dependencies from the runtime list. The broad guide still says PHP 7.4.", "links": [ "https://packagist.org/packages/elasticsearch/elasticsearch", "https://www.elastic.co/docs/reference/elasticsearch/clients/php/installation" ] }, { "supplier": "Endor; linked by Apache Friends", "product": "Endor browser LAMP sandbox / XAMPP for Browsers", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nApache Friends links its browser bundle to Endor. Endor explicitly describes a browser-run Linux/Apache/MariaDB/PHP emulator and bundled phpMyAdmin.", "links": [ "https://endor.dev/s/lamp", "https://www.apachefriends.org/download.html" ] }, { "supplier": "Enhancesoft / osTicket project", "product": "osTicket", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project installation documentation requires a PHP-capable web server and explicitly lists compatible PHP versions.", "links": [ "https://docs.osticket.com/en/latest/Getting%20Started/Installation.html" ] }, { "supplier": "EspoCRM project", "product": "EspoCRM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project explicitly requires PHP and distinguishes mandatory extensions, database alternatives and optional feature modules.", "links": [ "https://docs.espocrm.com/administration/server-configuration/" ] }, { "supplier": "European Commission", "product": "EU Academy Moodle service (2023 evidence)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nAn archived 2023 EU article identifies EU Academy as Moodle-based.", "links": [ "https://interoperable-europe.ec.europa.eu/collection/digital-skills-public-sector/news/eu-academy-platform-nutshell", "https://moodledev.io/general/releases/5.3" ] }, { "supplier": "European Commission / OpenEuropa contributors", "product": "OpenEuropa Authentication Drupal module", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPublisher metadata declares PHP and Drupal; the module integrates with EU Login.", "links": [ "https://packagist.org/packages/openeuropa/oe_authentication", "https://github.com/openeuropa/oe_authentication" ] }, { "supplier": "European Commission / OpenEuropa contributors", "product": "OpenEuropa Content Drupal module", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPublisher metadata declares PHP and Drupal dependencies.", "links": [ "https://packagist.org/packages/openeuropa/oe_content" ] }, { "supplier": "European Commission / OpenEuropa contributors", "product": "OpenEuropa Task Runner", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher describes a PHP task runner and declares its PHP floor.", "links": [ "https://packagist.org/packages/openeuropa/task-runner" ] }, { "supplier": "ExpressionEngine project", "product": "ExpressionEngine", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official 7.x requirements identify a PHP/MySQL CMS, required PHP modules and optional PHP-FPM integration.", "links": [ "https://docs.expressionengine.com/latest/installation/requirements.html" ] }, { "supplier": "F5", "product": "BIG-IP APM PHP page templates", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nF5 explicitly documents PHP inside APM UI templates. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.", "links": [ "https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html", "https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/advanced-customization-using-logon-page-templates.html" ] }, { "supplier": "F5", "product": "BIG-IP TMOS platform PHP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nOfficial issue record confirms PHP in BIG-IP; administration-upload role is described in indexed vendor text. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.", "links": [ "https://cdn.f5.com/product/bugtracker/ID1270257.html", "https://my.f5.com/manage/s/article/K000133753" ] }, { "supplier": "Facebook / HHVM project", "product": "HHVM 3.30 PHP-compatible legacy line", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe 3.30 announcement identifies the final PHP-compatible release family.", "links": [ "https://hhvm.com/blog/2018/12/17/hhvm-3.30.html", "https://hhvm.com/blog/2019/02/11/hhvm-4.0.0.html", "https://hhvm.com/blog/2019/11/19/hhvm-4.32.html" ] }, { "supplier": "Facebook / HipHop project", "product": "HipHop for PHP compiler (HPHPc)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nFacebook describes replacing its PHP-to-C++ HipHop compiler with HHVM in early 2013.", "links": [ "https://engineering.fb.com/2016/09/22/networking-traffic/redesigning-the-hhvm-jit-compiler-for-better-performance/" ] }, { "supplier": "Fedora Project PHP maintainers", "product": "Fedora PHP distribution package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official package catalogue identifies PHP and gives distinct stable, testing and Rawhide release entries.", "links": [ "https://packages.fedoraproject.org/pkgs/php/php/" ] }, { "supplier": "Feng Office", "product": "Feng Office Community Edition", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official Community repository explicitly requires a PHP/MySQL web-server environment and documents application installation/cron setup.", "links": [ "https://github.com/fengoffice/fengoffice" ] }, { "supplier": "FileCloud", "product": "FileCloud Server PHP installation and maintenance", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial upgrade instructions invoke the XAMPP php.exe post-upgrade script and identify PHP web-install and multi-tenant administration files.", "links": [ "https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only" ] }, { "supplier": "FileGator project", "product": "FileGator", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project requires a PHP web server and ZIP; its sample distro installation also installs mbstring, DOM and XML packages.", "links": [ "https://docs.filegator.io/install.html" ] }, { "supplier": "FileRun", "product": "FileRun", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor identifies FileRun as PHP software and separates installation-blocking modules from feature-dependent additions.", "links": [ "https://docs.filerun.com/requirements" ] }, { "supplier": "FileSender project", "product": "FileSender", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 3.x installation guide requires PHP, identifies web/CLI paths and a separately installed SimpleSAMLphp authentication dependency.", "links": [ "https://docs.filesender.org/filesender/v3.0/install/", "https://filesender.org/software/" ] }, { "supplier": "Firefly III project", "product": "Firefly III", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official Firefly III repository identifies a self-hosted personal finance manager with a PHP application tree, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/firefly-iii/firefly-iii", "https://api.github.com/repos/firefly-iii/firefly-iii/dependency-graph/sbom" ] }, { "supplier": "Flarum project / Flarum Foundation", "product": "Flarum", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial 2.x documentation distinguishes PHP, database drivers and CLI/Composer maintenance; 1.x has a separate compatibility scope.", "links": [ "https://docs.flarum.org/install/", "https://docs.flarum.org/1.x/install/" ] }, { "supplier": "Fly.io; customer runtime-image publisher", "product": "Fly.io customer Laravel/PHP Machines deployment", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nFly.io documents Laravel detection, generated nginx/php-fpm container configuration and PHP CLI job/release processes.", "links": [ "https://fly.io/laravel/" ] }, { "supplier": "Forma LMS project", "product": "Forma LMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project mirror README explicitly lists a PHP server, required extensions and web-based installation.", "links": [ "https://github.com/formalms/formalms" ] }, { "supplier": "Fortinet", "product": "FortiADC", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\n7.4.8 vendor CLI example shows PHP-FPM; web-interface role is corroborated by indexed troubleshooting text. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.", "links": [ "https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/db39ff41-6283-11f0-a9d0-d2b0d2e22f7d/fortiadc-v7.4.8-cli-reference-guide.pdf", "https://docs2.fortinet.com/document/fortiadc/7.4.11/handbook/406890/solutions-by-issue-type" ] }, { "supplier": "FOSSBilling project", "product": "FOSSBilling", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe current requirements identify PHP and distinguish mandatory modules, recommended media/cache support and the Plesk-only SimpleXML requirement.", "links": [ "https://docs.fossbilling.org/getting-started/requirements/", "https://github.com/boxbilling/boxbilling" ] }, { "supplier": "FrankenPHP", "product": "FrankenPHP static builds", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed\nPHP names FrankenPHP among web-serving installations at risk from both CVEs; maintainers state builds are prepared but fixed artifact release is not yet confirmed.", "links": [ "https://frankenphp.dev/docs/static/", "https://www.php.net/archive/2026.php#2026-10-21-1", "https://github.com/php/frankenphp/issues/2732" ] }, { "supplier": "FreeBSD Project / ports maintainers", "product": "FreeBSD PHP port and mod_php package integration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe maintained port relationship now has a dated 2026Q3 commit and advertised source checksum, beyond the handbook PHP 7.4 example.", "links": [ "https://lists.freebsd.org/archives/dev-commits-ports-branches/2026-August/014722.html", "https://docs.freebsd.org/en/books/handbook/network-servers/" ] }, { "supplier": "FreeScout project", "product": "FreeScout", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project describes a PHP/Laravel helpdesk and documents both web and CLI requirements.", "links": [ "https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide/393b7d2751835e7ef272f4b09ba5e38a14804ff0", "https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide", "https://github.com/freescout-help-desk/freescout" ] }, { "supplier": "FreshRSS project", "product": "FreshRSS", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nOfficial FreshRSS server requirements state that current releases are PHP web applications requiring PHP 8.1+.", "links": [ "https://freshrss.github.io/FreshRSS/en/admins/02_Prerequisites.html" ] }, { "supplier": "FrontAccounting project", "product": "FrontAccounting", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official project mirror explicitly requires PHP for the accounting application and explains PHP session/web-server configuration.", "links": [ "https://github.com/FrontAccountingERP/FA" ] }, { "supplier": "Froxlor Team", "product": "Froxlor control panel PHP branches", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe main manifest declares PHP^8.5 and Laravel13, while the separately scoped 2.0 migration guide documents older PHP requirements and PHP CLI helpers.", "links": [ "https://github.com/froxlor/froxlor/blob/main/composer.json", "https://docs.froxlor.org/v2/general/migration-guide.html" ] }, { "supplier": "FusionDirectory", "product": "FusionDirectory", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe versioned manual identifies a PHP identity-management web application with an independently operated LDAP server.", "links": [ "https://fusiondirectory-user-manual.readthedocs.io/en/1.4/fusiondirectory/prerequisite/prerequisite.html" ] }, { "supplier": "FusionDirectory", "product": "FusionDirectory Orchestrator", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor manual identifies Orchestrator as a PHP web application with its own version requirements and a separate FusionDirectory/LDAP dependency.", "links": [ "https://fusiondirectory-user-manual.readthedocs.io/en/latest/fusiondirectory-orchestrator/prerequisite/prerequisite.html" ] }, { "supplier": "FusionPBX project", "product": "FusionPBX PHP management application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nFusionPBX publishes a PHP CLI/FPM installation recipe with version-specific package choices.", "links": [ "https://github.com/fusionpbx/fusionpbx-install.sh/blob/master/debian/resources/php.sh" ] }, { "supplier": "Gentoo PHP maintainers", "product": "Gentoo dev-lang/php runtime package family", "version": "dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://packages.gentoo.org/packages/dev-lang/php", "https://security.gentoo.org/glsa/202610-02" ] }, { "supplier": "GLPI / Teclib", "product": "GLPI", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official release catalogue and pinned version-bump diff establish GLPI 12.0.0 final. The installation guide still covers only 10/11 PHP minima; the 12 release Composer manifest read was denied.", "links": [ "https://glpi-install.readthedocs.io/en/latest/prerequisites.html", "https://github.com/glpi-project/glpi-agent", "https://github.com/glpi-project/glpi/releases/tag/12.0.0", "https://github.com/glpi-project/glpi/commit/cd812fbc82eaa8d0356d0fb650842069c1c18f4e" ] }, { "supplier": "Google", "product": "Google APIs Client Library for PHP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe PHP API client requires PHP ^8.1, generated API service classes and Google Auth, with PHP HTTP/JWT dependencies.", "links": [ "https://packagist.org/packages/google/apiclient" ] }, { "supplier": "Google", "product": "Google Auth Library for PHP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nPublisher metadata declares PHP ^8.1 for OAuth/JWT credential and HTTP client support. phpseclib is suggested for some signing/token paths.", "links": [ "https://packagist.org/packages/google/auth" ] }, { "supplier": "Google", "product": "Google Cloud Firestore PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nFirestore client metadata requires ext-grpc and PHP ^8.2, while ext-protobuf is suggested to improve throughput over pure-PHP serialization.", "links": [ "https://packagist.org/packages/google/cloud-firestore" ] }, { "supplier": "Google", "product": "Google Cloud Storage PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe client requires PHP ^8.2 and google/cloud-core. Pub/Sub notifications and phpseclib signing are suggestions, not universal requirements.", "links": [ "https://packagist.org/packages/google/cloud-storage" ] }, { "supplier": "Google / googleapis contributors", "product": "Google Cloud PHP client monolith", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nPublisher metadata declares PHP ^8.2 and PHP RPC/serialization dependencies. The project recommends individual client packages and distinguishes optional versus required gRPC transports.", "links": [ "https://packagist.org/packages/google/cloud" ] }, { "supplier": "Google / Protocol Buffers project", "product": "Protocol Buffers native PHP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PECL release declares PHP >=8.2.0 for the native extension. Firestore's independent metadata suggests it for throughput rather than requiring it.", "links": [ "https://pecl.php.net/package/protobuf/5.36.2" ] }, { "supplier": "Google / Protocol Buffers project", "product": "Protocol Buffers PHP userland runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PHP runtime declares PHP >=8.2.0 and suggests bcmath for JSON deserialization. It is separate from the native protobuf extension and protoc generator.", "links": [ "https://packagist.org/packages/google/protobuf" ] }, { "supplier": "Google Cloud", "product": "Google App Engine Flexible PHP runtime", "version": "App Engine Flexible PHP runtimes not redeployed onto patched supported images", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding with fixed PHP; unsupported runtimes remain exposed.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.cloud.google.com/appengine/docs/flexible/php/runtime", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619" ] }, { "supplier": "Google Cloud", "product": "Google App Engine Standard PHP runtime", "version": "PHP 8.2+ supported runtimes", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically\nGoogle documents its managed Standard PHP runtime, PHP-FPM serving and automatic patch updates within the selected runtime family.", "links": [ "https://docs.cloud.google.com/appengine/docs/standard/php-gen2/runtime", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619" ] }, { "supplier": "Google Cloud; customer image publisher", "product": "Google Cloud Run customer PHP container option", "version": "Cloud Run customer containers with unpatched PHP on their respective branches", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.cloud.google.com/run/docs/quickstarts/build-and-deploy/deploy-php-service", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619" ] }, { "supplier": "Grav project", "product": "Grav CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe current 2.x guide requires PHP 8.3.11+ and describes flat-file storage without a database.", "links": [ "https://learn.getgrav.org/2/basics/requirements", "https://learn.getgrav.org/17/basics/requirements" ] }, { "supplier": "Grokability / Snipe-IT project", "product": "Snipe-IT", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor distinguishes required PHP extensions from LDAP and alternative image-processing requirements.", "links": [ "https://snipe-it.readme.io/docs/requirements" ] }, { "supplier": "grommunio GmbH", "product": "grommunio Web", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project separates its PHP server from JavaScript/CSS, requires the Gromox MAPI extension and says released packages contain a built tree.", "links": [ "https://github.com/grommunio/grommunio-web" ] }, { "supplier": "gRPC project", "product": "gRPC native PHP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPECL identifies a stable PHP extension release. The Windows catalogue distinguishes PHP versions, TS/NTS and x86/x64 builds; quickstart requires it for PHP client calls.", "links": [ "https://pecl.php.net/package/gRPC/1.83.1", "https://pecl.php.net/package/gRPC/1.83.1/windows", "https://grpc.io/docs/languages/php/quickstart/", "https://grpc.io/docs/languages/php/basics/" ] }, { "supplier": "gRPC project", "product": "gRPC PHP Composer support library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe Composer mirror contains PHP support files and declares PHP >=7.1.0. Official quickstart separately requires the native grpc extension for PHP clients.", "links": [ "https://packagist.org/packages/grpc/grpc", "https://grpc.io/docs/languages/php/quickstart/", "https://grpc.io/docs/languages/php/basics/" ] }, { "supplier": "Guzzle project", "product": "Guzzle HTTP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nGuzzle declares a PHP HTTP client with promises and PSR-7 packages; cURL is a chosen-handler requirement rather than an unconditional root runtime requirement.", "links": [ "https://packagist.org/packages/guzzlehttp/guzzle" ] }, { "supplier": "Heroku / Salesforce", "product": "Heroku PHP buildpack and application runtime", "version": "Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://devcenter.heroku.com/articles/php-support", "https://devcenter.heroku.com/changelog-items/3845" ] }, { "supplier": "Hestia Control Panel project", "product": "HestiaCP hestia-php internal runtime", "version": "Unpatched HestiaCP bundled hestia-php runtime; fix still being built", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: HestiaCP's maintainer explicitly confirms its bundled hestia-php remains vulnerable while a fix is prepared. This is distinct from patched distribution PHP serving hosted websites; INI changes are not a complete fix.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://github.com/hestiacp/hestiacp/releases/tag/1.10.5", "https://hestiacp.com/docs/contributing/building", "https://hestiacp.com/docs/server-administration/configuration", "https://github.com/hestiacp/hestiacp/commit/7d617fd1c5fd3be86458c7f53a6dad4a444b0a82", "https://forum.hestiacp.com/t/hestia-1-10-5-release/22209", "https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423" ] }, { "supplier": "Hestia Control Panel project", "product": "HestiaCP hosted-site PHP-FPM / MultiPHP option", "version": "HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://hestiacp.com/install", "https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423" ] }, { "supplier": "HikaShop project", "product": "HikaShop Joomla component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official guide describes PHP installation scripts inside the Joomla administrator component and PHP configuration handling.", "links": [ "https://www.hikashop.com/support/documentation/hikashop/installation-configuration" ] }, { "supplier": "HippyVM contributors", "product": "HippyVM RPython PHP implementation", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe project implements PHP using RPython and lists php5-cli among its build prerequisites.", "links": [ "https://github.com/hippyvm/hippyvm" ] }, { "supplier": "Homebrew maintainers", "product": "Homebrew PHP formula and bottles", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official formula page lists stable 8.5.11, php-fpm service commands and Apache module configuration.", "links": [ "https://formulae.brew.sh/formula/php" ] }, { "supplier": "Horde Project", "product": "Horde Groupware Webmail Edition 5", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official legacy Webmail manifest identifies the PHP groupware/webmail bundle and its Horde dependency.", "links": [ "https://github.com/horde/webmail/blob/master/composer.json" ] }, { "supplier": "HostBill / HostBillApp", "product": "HostBill", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor-hosted requirements distinguish mandatory PHP modules and ionCube from recommended/feature-specific additions.", "links": [ "https://hostbill.atlassian.net/wiki/spaces/DOCS/pages/53745197/System%2Brequirements" ] }, { "supplier": "HumHub", "product": "HumHub", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nOfficial HumHub requirements document Apache/mod_php or PHP-FPM deployment options and a current PHP compatibility matrix.", "links": [ "https://docs.humhub.org/docs/admin/requirements/" ] }, { "supplier": "Ibexa", "product": "Ibexa DXP", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe versioned requirements page lists PHP 8.3/8.4 for DXP 5.0, PHP CLI/FPM packages and runtime extensions.", "links": [ "https://doc.ibexa.co/en/5.0/getting_started/requirements/" ] }, { "supplier": "Icinga GmbH", "product": "Icinga Certificate Monitoring", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official module guide requires Icinga Web; the release announcement explicitly identifies this PHP module and version support.", "links": [ "https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/02-Installation/", "https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates" ] }, { "supplier": "Icinga GmbH", "product": "Icinga DB Web", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe named web module has its own PHP/module requirements and is installed into Icinga Web.", "links": [ "https://icinga.com/docs/icinga-db-web/latest/doc/02-Installation/From-Source/" ] }, { "supplier": "Icinga GmbH", "product": "Icinga Director", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official module installation guide supplies PHP and extension requirements for configuration deployment and background work.", "links": [ "https://icinga.com/docs/icinga-director/latest/doc/02-Installation/From-Source/" ] }, { "supplier": "Icinga GmbH", "product": "Icinga PDF Export", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe vendor explicitly identifies the PHP PDF-export module and separates PHP libraries from its locally installed Chromium process.", "links": [ "https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates" ] }, { "supplier": "Icinga GmbH", "product": "Icinga Reporting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe module's own requirements explicitly identify PHP, mbstring and a database PDO connector.", "links": [ "https://icinga.com/docs/icinga-reporting/latest/doc/02-Installation/", "https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates" ] }, { "supplier": "Icinga GmbH", "product": "Icinga Web", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official guide explicitly separates PHP web/CLI requirements from Icinga 2 and Icinga DB monitoring services.", "links": [ "https://icinga.com/docs/icinga-web/latest/doc/02-Installation/From-Source/", "https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates" ] }, { "supplier": "igbinary project", "product": "igbinary native PHP serializer extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release is a PHP binary serializer and states its PHP requirement.", "links": [ "https://pecl.php.net/package/igbinary/3.2.16", "https://pecl.php.net/package/igbinary" ] }, { "supplier": "ILIAS Society / ILIAS project", "product": "ILIAS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official release-branch guide documents mod_php, FCGI/PHP-FPM and PHP CLI setup and cron, with separate required and feature-dependent modules.", "links": [ "https://github.com/ILIAS-eLearning/ILIAS/blob/release_11/docs/configuration/install.md", "https://github.com/ILIAS-eLearning/ILIAS/releases" ] }, { "supplier": "Imagick project", "product": "Imagick native PHP image extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release describes a native PHP wrapper for ImageMagick and declares a PHP minimum; its notes mention PHP 8.5 compilation compatibility.", "links": [ "https://pecl.php.net/package/imagick/3.8.1", "https://pecl.php.net/package/imagick" ] }, { "supplier": "iNextrix / ASTPP", "product": "ASTPP v7 PHP billing and management application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nASTPP's vendor explicitly identifies PHP8.2 in version7.", "links": [ "https://astppbilling.org/your-top-questions-from-the-astpp-v7-webinar-answered" ] }, { "supplier": "Infection project", "product": "Infection PHP mutation-testing tool", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for infection/infection 0.35.8 declares PHP ^8.3 for this tool/library.", "links": [ "https://packagist.org/packages/infection/infection" ] }, { "supplier": "Invision Community / Invision Power Services", "product": "Invision Community Classic", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor explicitly describes PHP requirements for the self-hosted Classic product and customer responsibility for server security patches and version upgrades.", "links": [ "https://invisioncommunity.com/buy/self-hosted/" ] }, { "supplier": "Invoice Ninja", "product": "Invoice Ninja self-hosted server", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe source manifest confirms the PHP server and direct extensions; the repository identifies a Laravel API/client-portal implementation.", "links": [ "https://github.com/invoiceninja/invoiceninja/blob/v5-stable/composer.json", "https://www.invoiceninja.org/getting-started/", "https://github.com/invoiceninja/invoiceninja", "https://invoiceninja.github.io/docs/self-host/self-host-installation" ] }, { "supplier": "InvoicePlane project", "product": "InvoicePlane", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe installation guide confirms PHP web/CLI use; the manifest identifies PHP libraries and a CodeIgniter 3.4 fork separately from development tools.", "links": [ "https://github.com/InvoicePlane/InvoicePlane/blob/develop/.github/docs/INSTALLATION.md", "https://github.com/InvoicePlane/InvoicePlane/blob/develop/composer.json" ] }, { "supplier": "IONOS", "product": "IONOS webhosting PHP and CLI options", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nIONOS documents per-domain PHP versions and a separate CLI version/path table.", "links": [ "https://www.ionos.com/help/hosting/managing-php-versions-in-the-control-panel/displaying-or-changing-php-versions/", "https://www.ionos.com/help/hosting/using-php-for-web-projects/executing-php-files-via-the-command-line-php-cli/" ] }, { "supplier": "ISPConfig project", "product": "ISPConfig 3 control panel UI and scripts", "version": "ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://www.ispconfig.org/blog/ispconfig-3-2-12-released/", "https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/" ] }, { "supplier": "Issabel", "product": "Issabel 5 PHP communications management", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nIssabel identifies PHP7.4 as a component of its version5 release.", "links": [ "https://www.issabel.com/en/release-of-issabel-5-innovation-and-advancement-in-unified-communications/" ] }, { "supplier": "Jakub Vrana / Adminer project", "product": "Adminer", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official site describes a database administration application shipped as a single PHP file and requiring PHP session support.", "links": [ "https://www.adminer.org/" ] }, { "supplier": "JBMC Software / DirectAdmin", "product": "DirectAdmin CustomBuild hosted PHP", "version": "CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledged.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.directadmin.com/webservices/php/multiple-php.html", "https://docs.directadmin.com/webservices/php/php-options.html", "https://forum.directadmin.com/threads/critical-php-updates.82726/page-3" ] }, { "supplier": "JetBrains", "product": "PhpStorm external PHP interpreter integration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Optional PHP path; CVE match unknown\nThe guide requires a separately installed PHP engine and configures its executable/php.ini, interpreter selection and optional Xdebug integration.", "links": [ "https://www.jetbrains.com/help/phpstorm/configuring-local-interpreter.html" ] }, { "supplier": "Joomla project", "product": "Joomla 6.x", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nThe stable/current Joomla documentation identifies version 6.1 and gives a PHP 8.3.0 minimum, PHP 8.4 recommendation and required modules.", "links": [ "https://manual.joomla.org/docs/get-started/technical-requirements/" ] }, { "supplier": "Jordi Boggiano / Monolog contributors", "product": "Monolog", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMonolog is a PHP logging library; handler-dependent modules and service clients are optional, and several integrations appear only in require-dev.", "links": [ "https://packagist.org/packages/monolog/monolog" ] }, { "supplier": "JPHP Group", "product": "JPHP JVM compiler and runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nJPHP compiles PHP source to JVM bytecode and distinguishes its own runtime library from Zend PHP.", "links": [ "https://github.com/jphp-group/jphp" ] }, { "supplier": "Juniper Networks", "product": "Junos OS J-Web (EX/SRX scope)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nJuniper-authored CVE record expressly identifies PHP in J-Web; later vendor bulletin corroborates inclusion. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.", "links": [ "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json", "https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software" ] }, { "supplier": "Kanboard project", "product": "Kanboard", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe server-side requirements distinguish PHP versions and extensions from ordinary browser/device requirements.", "links": [ "https://docs.kanboard.org/v1/admin/requirements/" ] }, { "supplier": "Kevin Papst / Kimai project", "product": "Kimai", "version": "Kimai 2.70.1 rebuilt supported Docker image tags", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP runtime update.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://packagist.org/packages/kimai/kimai", "https://github.com/kimai/kimai", "https://github.com/kimai/kimai/blob/main/composer.json", "https://www.kimai.org/documentation/installation.html", "https://github.com/kimai/kimai/releases/tag/2.70.1", "https://github.com/kimai/kimai/pull/6262#issuecomment-6322087754" ] }, { "supplier": "Kinsta", "product": "Kinsta managed WordPress PHP hosting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nKinsta's WordPress hosting guide documents selectable PHP engine families.", "links": [ "https://kinsta.com/docs/wordpress-hosting/php/" ] }, { "supplier": "Kirby CMS project", "product": "Kirby CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nKirby provides version-specific PHP support and required, recommended and optional extension lists.", "links": [ "https://getkirby.com/docs/reference/system/requirements" ] }, { "supplier": "Klemen Stirn / Hesk", "product": "Hesk Free self-hosted helpdesk", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor identifies Hesk Free as self-hosted PHP/MySQL software and publishes its version and PHP range.", "links": [ "https://www.hesk.com/download.php" ] }, { "supplier": "Kopano / Kopano-dev", "product": "Kopano WebApp", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official WebApp mirror explicitly lists PHP server dependencies and a separate native MAPI interface.", "links": [ "https://github.com/Kopano-dev/kopano-webapp" ] }, { "supplier": "Krayin", "product": "Krayin CRM", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official Krayin CRM repository requires PHP 8.3 or higher for the Laravel CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/krayin/laravel-crm", "https://api.github.com/repos/krayin/laravel-crm/dependency-graph/sbom" ] }, { "supplier": "Ladybird Web Solution / Faveo", "product": "Faveo Helpdesk Community Edition", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nEdition-labelled vendor installation instructions explicitly provision PHP for the Community helpdesk.", "links": [ "https://docs.faveohelpdesk.com/docs/installation/providers/community/ubuntu-apache/", "https://docs.faveohelpdesk.com/docs/system-requirement/requirement/" ] }, { "supplier": "Laminas Project / Linux Foundation", "product": "Laminas MVC", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe released package declares PHP and MVC application dependencies; official Laminas documentation labels MVC security-only maintenance.", "links": [ "https://packagist.org/packages/laminas/laminas-mvc", "https://docs.laminas.dev/" ] }, { "supplier": "Laminas Project / Mezzio", "product": "Mezzio", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nPublisher metadata identifies a PHP PSR-15 middleware framework with router, template and request-handler packages.", "links": [ "https://packagist.org/packages/mezzio/mezzio", "https://docs.laminas.dev/" ] }, { "supplier": "Lando project", "product": "Lando PHP service plugin images", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nLando documents an optional PHP service and custom images; its legacy warning says EOL families can run but should be considered deprecated.", "links": [ "https://docs.lando.dev/plugins/php/index.html" ] }, { "supplier": "Laragon project", "product": "Laragon Full Windows development bundle", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nLaragon explicitly calls PHP bundled, documents terminal PATH use and switching/updating PHP versions in the Full environment.", "links": [ "https://laragon.org/download" ] }, { "supplier": "Laravel", "product": "Laravel 13 framework", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nLaravel 13 deployment documentation identifies server PHP requirements and web/CLI deployment operations. The separately versioned 12 guide has a lower PHP floor.", "links": [ "https://laravel.com/framework/docs/deployment", "https://laravel.com/framework/docs/12.x/deployment" ] }, { "supplier": "Laravel", "product": "Laravel Cloud PHP runtime option", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nLaravel Cloud documents PHP runtime families and an8.5-specific pdo_sqlsrv availability limitation.", "links": [ "https://laravel.com/cloud/docs/runtimes", "https://laravel.com/cloud/docs/environments" ] }, { "supplier": "Laravel", "product": "Laravel Vapor core PHP invocation package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe published package manifest identifies Vapor's PHP invocation handlers and runtime dependencies.", "links": [ "https://packagist.org/packages/laravel/vapor-core" ] }, { "supplier": "Laravel", "product": "Laravel Vapor PHP Docker base image family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nVapor's Docker instructions name its PHP base-image family and architecture/version tag choices.", "links": [ "https://docs.vapor.build/projects/environments" ] }, { "supplier": "Laravel; AWS infrastructure", "product": "Laravel Vapor PHP serverless hosting configuration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nVapor documents separate native and Docker PHP runtime modes and their customization boundaries.", "links": [ "https://docs.vapor.build/projects/environments" ] }, { "supplier": "LDAP Account Manager project", "product": "LDAP Account Manager", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe manual requires a PHP web environment and separates optional Perl lamdaemon from the PHP application.", "links": [ "https://www.ldap-account-manager.org/static/doc/manual/ch02.html" ] }, { "supplier": "Leantime project", "product": "Leantime", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe root runtime manifest explicitly requires PHP and modules, including LDAP and process-control modules, separately from development tooling.", "links": [ "https://github.com/Leantime/leantime/blob/master/composer.json", "https://github.com/Leantime/leantime" ] }, { "supplier": "LibreNMS project", "product": "LibreNMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe root manifest requires PHP and runtime modules; the guide separately configures PHP-FPM/CLI and Python/native helper packages.", "links": [ "https://docs.librenms.org/Installation/Install-LibreNMS/", "https://github.com/librenms/librenms/blob/master/composer.json" ] }, { "supplier": "libsmbclient-php project", "product": "SMBClient native PHP Samba binding", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release provides PHP functions and smb streams using Samba's libsmbclient.", "links": [ "https://pecl.php.net/package/smbclient/1.1.2", "https://pecl.php.net/package/smbclient" ] }, { "supplier": "libvirt-php contributors / Unraid distribution", "product": "Unraid libvirt-php management binding", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nUnraid independently lists libvirt-php alongside its matching PHP package.", "links": [ "https://docs.unraid.net/unraid-os/release-notes/7.3.2/", "https://docs.unraid.net/unraid-os/release-notes/7.4.0/" ] }, { "supplier": "Lime Technology / Unraid", "product": "Unraid PHP management runtime distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nUnraid release notes identify its PHP package and PHP web GUI files.", "links": [ "https://docs.unraid.net/unraid-os/release-notes/7.3.2/", "https://docs.unraid.net/unraid-os/release-notes/7.4.0/" ] }, { "supplier": "LimeSurvey GmbH / LimeSurvey project", "product": "LimeSurvey Community Edition", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe CE installation manual binds PHP bands to major LS versions and separates conditional survey, mail, directory and archive features.", "links": [ "https://www.limesurvey.org/manual/Installation_-_LimeSurvey_CE", "https://www.limesurvey.org/manual/index.php?title=Installation_-_LimeSurvey_CE&oldid=385498" ] }, { "supplier": "LiveCodes project", "product": "LiveCodes PHP (Uniter) browser mode", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe php language mode uses Uniter in the browser and lists version 2.18.0.", "links": [ "https://livecodes.io/docs/languages/php/" ] }, { "supplier": "LiveCodes project", "product": "LiveCodes PHP (Wasm) browser mode", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe Wasm mode names its php-wasm and PHP versions separately.", "links": [ "https://livecodes.io/docs/languages/php-wasm/" ] }, { "supplier": "Lunar project", "product": "Lunar administration panel", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPublisher package metadata identifies an admin panel and requires its exact commerce-core and Filament component versions.", "links": [ "https://packagist.org/packages/lunarphp/lunar" ] }, { "supplier": "Lunar project", "product": "Lunar commerce core", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPublisher metadata declares PHP, three direct extensions and Laravel for the headless commerce core.", "links": [ "https://packagist.org/packages/lunarphp/core" ] }, { "supplier": "m0n0wall project", "product": "m0n0wall legacy PHP-CGI management appliance", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe project's facts page lists PHP-CGI; its closure announcement ends further development/releases.", "links": [ "https://m0n0.ch/wall/facts.php", "https://m0n0.ch/wall/end_announcement.php" ] }, { "supplier": "Mage-OS project", "product": "Mage-OS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official page lists PHP runtime requirements and identifies the Magento base for Mage-OS release families.", "links": [ "https://mage-os.org/get-started/system-requirements/" ] }, { "supplier": "Magento / Adobe", "product": "Magento Open Source", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nAdobe's shared PHP settings page supplies a separate Magento Open Source extension list and makes pcntl conditional on parallel indexing.", "links": [ "https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings", "https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements" ] }, { "supplier": "MailWatch project", "product": "MailWatch for MailScanner", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official repository explicitly describes a PHP web front end to the separate MailScanner system.", "links": [ "https://github.com/mailwatch/MailWatch" ] }, { "supplier": "MAMP GmbH", "product": "MAMP local server environment", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMAMP describes an installable local stack containing PHP; its downloads distinguish OS-specific installer versions.", "links": [ "https://www.mamp.info/en/mamp/mac/", "https://www.mamp.info/en/downloads/" ] }, { "supplier": "MantisBT project", "product": "MantisBT", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project's own installation requirements explicitly identify PHP for the bug tracker server.", "links": [ "https://github.com/mantisbt/mantisbt" ] }, { "supplier": "Matomo", "product": "Matomo On-Premise", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor FAQ confirms PHP web/CLI processing and upcoming beta requirements; the 5.x source root preserves a lower declared PHP floor.", "links": [ "https://matomo.org/faq/on-premise/matomo-requirements/", "https://github.com/matomo-org/matomo/blob/5.x-dev/composer.json" ] }, { "supplier": "Matomo / InnoCraft", "product": "Matomo Analytics for WordPress", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe publisher listing identifies server-side analytics processing in WordPress and version-gated PHP requirements for the coming Matomo-6 update.", "links": [ "https://wordpress.org/plugins/matomo/" ] }, { "supplier": "Matomo team", "product": "Matomo PHP tracking client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe tracking package requires PHP ^8.1 and json, and suggests curl for HTTPS tracking requests.", "links": [ "https://packagist.org/packages/matomo/matomo-php-tracker" ] }, { "supplier": "Mautic project", "product": "Mautic", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official installation guide documents PHP web settings and console execution for marketing automation.", "links": [ "https://docs.mautic.org/en/7.0/getting_started/how_to_install_mautic.html", "https://github.com/mautic/mautic/blob/7.x/composer.json" ] }, { "supplier": "MediaWiki project", "product": "MediaWiki", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nMediaWiki explicitly requires PHP, lists native modules and distinguishes recommended modules from a 32-bit arithmetic alternative.", "links": [ "https://www.mediawiki.org/wiki/Manual:Installation_requirements" ] }, { "supplier": "MessageBird", "product": "MessageBird PHP REST API client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe publisher client requires PHP >=8.0, curl/json and Firebase JWT support.", "links": [ "https://packagist.org/packages/messagebird/php-rest-api" ] }, { "supplier": "Metaways / tine project", "product": "tine groupware", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project requires PHP for the groupware server and lists mandatory and optional modules separately from browser/native clients.", "links": [ "https://docs.tine-groupware.de/main/operators/System_Requirements/" ] }, { "supplier": "Microsoft", "product": "Azure App Service PHP on Linux", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nMicrosoft documents Linux PHP workloads and explicitly says Windows PHP support ended in November2022.", "links": [ "https://learn.microsoft.com/en-us/azure/app-service/configure-language-php" ] }, { "supplier": "Microsoft Azure Storage", "product": "Microsoft Azure Storage PHP blob client package (retired)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe published blob package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.", "links": [ "https://packagist.org/packages/microsoft/azure-storage-blob", "https://github.com/Azure/azure-storage-php" ] }, { "supplier": "Microsoft Azure Storage", "product": "Microsoft Azure Storage PHP common client package (retired)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe published common package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.", "links": [ "https://packagist.org/packages/microsoft/azure-storage-common", "https://github.com/Azure/azure-storage-php" ] }, { "supplier": "Microsoft Azure Storage", "product": "Microsoft Azure Storage PHP file client package (retired)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe published file package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.", "links": [ "https://packagist.org/packages/microsoft/azure-storage-file", "https://github.com/Azure/azure-storage-php" ] }, { "supplier": "Microsoft Azure Storage", "product": "Microsoft Azure Storage PHP queue client package (retired)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe published queue package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.", "links": [ "https://packagist.org/packages/microsoft/azure-storage-queue", "https://github.com/Azure/azure-storage-php" ] }, { "supplier": "Microsoft Azure Storage", "product": "Microsoft Azure Storage PHP table client package (retired)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe published table package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.", "links": [ "https://packagist.org/packages/microsoft/azure-storage-table", "https://github.com/Azure/azure-storage-php" ] }, { "supplier": "Microsoft Graph Client Tooling", "product": "Microsoft Graph PHP SDK", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe SDK declares PHP ^8.2 and microsoft/microsoft-graph-core ^3.0.0 for caller-side Graph access.", "links": [ "https://packagist.org/packages/microsoft/microsoft-graph" ] }, { "supplier": "MISP project / CIRCL", "product": "MISP 2.5 core PHP server", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial requirements distinguish mandatory PHP extensions from recommended modules for MISP2.5.", "links": [ "https://www.circl.lu/doc/misp/requirements/", "https://github.com/MISP/MISP" ] }, { "supplier": "Mockery project", "product": "Mockery PHP test-double framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for mockery/mockery 1.6.15 declares PHP >=7.3 for this tool/library.", "links": [ "https://packagist.org/packages/mockery/mockery" ] }, { "supplier": "MODX project", "product": "MODX Revolution", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe guide says MODX is written in PHP and lists the 3.2+ PHP 8.1 floor and required modules.", "links": [ "https://docs.modx.com/3.x/en/getting-started/server-requirements" ] }, { "supplier": "Mollie", "product": "Mollie Payments for WooCommerce", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe publisher's listing requires PHP, cURL and JSON and documents merchant API keys and payment-status webhooks.", "links": [ "https://wordpress.org/plugins/mollie-payments-for-woocommerce/" ] }, { "supplier": "Mollie B.V.", "product": "Mollie API PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nMollie's PHP client declares PHP ^8.2, curl/json/openssl and PSR transport interfaces. A separate Mollie OAuth package is suggested for some endpoints.", "links": [ "https://packagist.org/packages/mollie/mollie-api-php" ] }, { "supplier": "MongoDB PHP driver team", "product": "MongoDB native PHP driver extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPECL identifies the native glue layer and native-library updates; the PHP manual supplies a version-qualified family minimum and default bundled/native options. Userland mongodb/mongodb requirements remain separate.", "links": [ "https://pecl.php.net/package/mongodb/2.5.0", "https://www.php.net/manual/en/mongodb.requirements.php" ] }, { "supplier": "MongoDB PHP driver team", "product": "MongoDB PHP userland library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe userland library requires PHP ^8.1 and ext-mongodb ^2.5; its metadata replaces mongodb/builder.", "links": [ "https://packagist.org/packages/mongodb/mongodb" ] }, { "supplier": "Monica project", "product": "Monica", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official Monica Composer manifest declares PHP ^8.3 for the personal CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/monicahq/monica/blob/main/composer.json", "https://api.github.com/repos/monicahq/monica/dependency-graph/sbom" ] }, { "supplier": "Montala / ResourceSpace", "product": "ResourceSpace", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor identifies PHP as the server language, gives per-release bands and required distro packages, and separates external media tools.", "links": [ "https://www.resourcespace.com/knowledge-base/systemadmin/general_requirements?from_rs=true" ] }, { "supplier": "Moodle project", "product": "Moodle", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial 5.3 notes specify PHP 8.3.0+, additional 8.4.x support, sodium and 64-bit PHP. The download catalogue separates the 5.3 release from weekly 5.3+ packages and publishes a release checksum.", "links": [ "https://moodledev.io/general/releases/5.3", "https://docs.moodle.org/503/en/PHP", "https://download.moodle.org/releases/latest/", "https://packaging.moodle.org/stable503/moodle-5.3.tgz.sha256" ] }, { "supplier": "Moodle project / complete-installer packagers", "product": "Moodle Windows complete installer family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMoodle publishes Windows installers containing Apache, MySQL and PHP, built using XAMPP. Its catalogue warns of component requirements mismatches and against production use.", "links": [ "https://download.moodle.org/windows/" ] }, { "supplier": "Moodle project / Ralf Krause", "product": "Moodle4Mac complete installer family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMoodle publishes MAMP-based installers containing Apache, MySQL and PHP. The linked guide restricts them to local testing/development and documents modified environment checks.", "links": [ "https://download.moodle.org/macosx/", "https://docs.moodle.org/503/en/Installation_Package_for_OS_X" ] }, { "supplier": "msgpack-php project", "product": "MessagePack native PHP serialization extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official catalogue describes a PHP MessagePack API and declares the selected 3.0.1 release minimum.", "links": [ "https://pecl.php.net/package/msgpack" ] }, { "supplier": "MyBB Group", "product": "MyBB", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official MyBB 1.8 installation requirements identify PHP and three named extensions plus a selected database driver.", "links": [ "https://docs.mybb.com/1.8/install/requirements/" ] }, { "supplier": "MyBB Group", "product": "MyBB Merge System", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official requirements name Merge System separately from the running MyBB forum and require PHP for the migration tool.", "links": [ "https://docs.mybb.com/1.8/install/requirements/" ] }, { "supplier": "N-able", "product": "Mail Assure / Spam Experts", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nN-able lists Mail Assure / Spam Experts among products receiving emergency maintenance and updates for php2shell.", "links": [ "https://www.n-able.com/blog/n-able-update-on-the-global-php-issue" ] }, { "supplier": "N-able", "product": "N-sight", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nN-able lists N-sight among products receiving emergency maintenance and updates for php2shell.", "links": [ "https://www.n-able.com/blog/n-able-update-on-the-global-php-issue" ] }, { "supplier": "N-able", "product": "Passportal", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nN-able lists Passportal among products receiving emergency maintenance and updates for php2shell.", "links": [ "https://www.n-able.com/blog/n-able-update-on-the-global-php-issue" ] }, { "supplier": "N-able", "product": "Take Control Session routing", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nN-able scoped emergency php2shell maintenance to Take Control session routing rather than the whole Take Control product family.", "links": [ "https://www.n-able.com/blog/n-able-update-on-the-global-php-issue" ] }, { "supplier": "Nagios Enterprises", "product": "Nagios Fusion web component subsystem", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor explains how PHP component files are included during Fusion application instantiation and register web-page callbacks.", "links": [ "https://assets.nagios.com/downloads/nagiosfusion/guides/developer/components.php" ] }, { "supplier": "Nagios Enterprises", "product": "Nagios XI web configuration-wizard subsystem", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official development guide identifies PHP scripts and callback functions loaded by the XI configuration-wizard interface.", "links": [ "https://assets.nagios.com/downloads/nagiosxi/docs/Writing-Custom-Wizards-2024.pdf" ] }, { "supplier": "Neos project", "product": "Neos CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nNeos publishes a Neos/Flow/PHP matrix and requires matching web and CLI PHP versions for class precompilation.", "links": [ "https://docs.neos.io/guide/installation-development-setup/system-requirements" ] }, { "supplier": "Netgate / pfSense", "product": "pfSense management components", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nNetgate explicitly identifies the legacy GUI as PHP, the new Plus GUI as Go, and continued availability of both during transition. Nexus controller options are separately enabled.", "links": [ "https://www.netgate.com/blog/the-new-gui-for-pfsense-plus", "https://docs.netgate.com/pfsense/en/latest/development/additional-php-modules.html", "https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html", "https://docs.netgate.com/pfsense/en/latest/releases/26-07.html", "https://docs.netgate.com/pfsense/en/latest/nexus/options.html" ] }, { "supplier": "Netlify", "product": "Netlify PHP build environment and Composer integration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nNetlify documents PHP_VERSION for building a site and Composer handling when composer.json is present.", "links": [ "https://docs.netlify.com/build/configure-builds/manage-dependencies/" ] }, { "supplier": "Nette community", "product": "Nette Application", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMVC kernel and application request dispatch are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/application" ] }, { "supplier": "Nette community", "product": "Nette Assets", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP-side asset mapping, versioning and storage integration are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/assets" ] }, { "supplier": "Nette community", "product": "Nette Bootstrap", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP application bootstrap and configuration loading are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/bootstrap" ] }, { "supplier": "Nette community", "product": "Nette Caching", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP caching abstractions and selected storage are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/caching" ] }, { "supplier": "Nette community", "product": "Nette Command Line", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP command-line interface utilities are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/command-line" ] }, { "supplier": "Nette community", "product": "Nette Database", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP database access and abstraction are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/database" ] }, { "supplier": "Nette community", "product": "Nette DI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP dependency injection and container compilation are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/di" ] }, { "supplier": "Nette community", "product": "Nette Forms", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nServer PHP form handling and validation are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/forms" ] }, { "supplier": "Nette community", "product": "Nette HTTP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP requests, uploaded-file handling, URLs and sessions are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/http" ] }, { "supplier": "Nette community", "product": "Nette Mail", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP mail construction and sending are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/mail" ] }, { "supplier": "Nette community", "product": "Nette PHP Generator", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPHP source generation and optional source-body parsing are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/php-generator" ] }, { "supplier": "Nette community", "product": "Nette RobotLoader", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP class discovery, source analysis, autoloading and cache are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/robot-loader" ] }, { "supplier": "Nette community", "product": "Nette SafeStream", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP safe/atomic file stream handling are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/safe-stream" ] }, { "supplier": "Nette community", "product": "Nette Security", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP authentication, authorization and ACL handling are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/security" ] }, { "supplier": "Nette community", "product": "Nette Utils", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP utility functions and selected image/string/JSON helpers are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/nette/utils" ] }, { "supplier": "Nette community / Latte", "product": "Latte template engine", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP template compilation and rendering are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/latte/latte" ] }, { "supplier": "Nette community / Tracy", "product": "Tracy debugger", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPHP debugging, diagnostics and error handling are implemented in this independently identifiable PHP package.", "links": [ "https://packagist.org/packages/tracy/tracy" ] }, { "supplier": "Nette Foundation / Nette community", "product": "Nette framework metapackage", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nNette 3.3.0 is a metapackage with a finite seventeen-name direct runtime package list; each name was independently checked for PHP use.", "links": [ "https://packagist.org/packages/nette/nette" ] }, { "supplier": "Nextcloud", "product": "Nextcloud Office integration app", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official integration app has PHP runtime dependencies distinct from its development tools and the external document-editing server.", "links": [ "https://github.com/nextcloud/richdocuments/blob/main/composer.json" ] }, { "supplier": "Nextcloud", "product": "Nextcloud Server", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image\nNextcloud confirms that deployments using affected PHP are at risk and points operators to fixed PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.", "links": [ "https://github.com/nextcloud/server/wiki/Releases-and-PHP-versions/d90292c6b2f2d0707fc61571364185fa311525bb", "https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html", "https://docs.nextcloud.com/server/stable/admin_manual/installation/php_configuration.html", "https://github.com/nextcloud/server/releases", "https://github.com/nextcloud/server/commit/ba900af933e61ffa005315b09d6454bfbbcbcc81", "https://github.com/nextcloud/server/issues/65754" ] }, { "supplier": "Nextcloud", "product": "Nextcloud Talk server app", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official application manifest contains a production PHP namespace/autoload tree and runtime dependencies, distinct from development tools.", "links": [ "https://github.com/nextcloud/spreed/blob/main/composer.json" ] }, { "supplier": "Nextcloud Calendar project", "product": "Nextcloud Calendar server app", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe prior release-publisher version pin is retained. A dated official FreeBSD ports commit independently records Calendar 6.6.2 and its advertised source-archive checksum; it does not supply the missing app/core PHP compatibility pair.", "links": [ "https://lists.freebsd.org/archives/dev-commits-ports-main/2026-October/215291.html", "https://github.com/nextcloud/calendar/blob/main/composer.json", "https://github.com/nextcloud/calendar/blob/main/README.md", "https://github.com/nextcloud-releases/calendar/releases", "https://github.com/nextcloud-releases/calendar/commit/1b34383d4cb89ae1f2312caad20677e5c7797285", "https://github.com/nextcloud/calendar/releases" ] }, { "supplier": "Nextcloud Collectives project", "product": "Nextcloud Collectives server app", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official manifest separates PHP runtime requirements and collaboration libraries from development-only DOM and test tools.", "links": [ "https://github.com/nextcloud/collectives/blob/main/composer.json" ] }, { "supplier": "Nextcloud Contacts project", "product": "Nextcloud Contacts server app", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official app manifest declares its PHP runtime constraint separately from development dependencies and the Composer platform target.", "links": [ "https://github.com/nextcloud/contacts/blob/main/composer.json" ] }, { "supplier": "Nextcloud Deck project", "product": "Nextcloud Deck", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official repository explicitly documents PHP dependency installation and PHP tooling for the Deck app.", "links": [ "https://github.com/nextcloud/deck", "https://github.com/nextcloud/deck/blob/main/composer.json" ] }, { "supplier": "Nextcloud Docker community volunteers / Docker Official Images", "product": "Nextcloud community Docker image distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe repository distinguishes community maintenance from Nextcloud GmbH AIO, and explicitly bases its FPM variant on php-fpm.", "links": [ "https://github.com/nextcloud/docker" ] }, { "supplier": "Nextcloud GmbH / Nextcloud AIO maintainers", "product": "Nextcloud AIO Nextcloud application container", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; fixed AIO image release not yet confirmed\nNextcloud AIO maintainers confirm affected PHP base images and report that rebuilt images depend on upstream PHP image publication; a fixed AIO release is not yet confirmed.", "links": [ "https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile", "https://github.com/nextcloud/all-in-one/issues/8876" ] }, { "supplier": "Nextcloud Mail project", "product": "Nextcloud Mail server app", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe app manifest declares PHP and OpenSSL plus separate mail-processing libraries; its README requires a Nextcloud server and PHP dependency management.", "links": [ "https://github.com/nextcloud/mail/blob/main/composer.json" ] }, { "supplier": "Nextcloud Notes project", "product": "Nextcloud Notes", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official Notes manifest confirms PHP development tooling and distinguishes require-dev from a Composer resolution target.", "links": [ "https://github.com/nextcloud/notes/blob/main/composer.json" ] }, { "supplier": "Nextcloud Snap maintainers", "product": "Nextcloud Snap bundled PHP runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe Snap recipe has an explicit PHP autotools part with FPM enabled and separate Redis6.3.0/APCu5.1.28 extension builds.", "links": [ "https://github.com/nextcloud-snap/nextcloud-snap/blob/master/snap/snapcraft.yaml" ] }, { "supplier": "NextcloudPi project / Nextcloud community", "product": "NextcloudPi turnkey PHP stack", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe NextcloudPi feature list explicitly includes PHP 8.1, Apache, APCu and Zend OPcache file cache.", "links": [ "https://github.com/nextcloud/nextcloudpi" ] }, { "supplier": "Nikita Popov / PHP-Parser contributors", "product": "PHP-Parser userland parser", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPHP-Parser is implemented in PHP and declares native tokenizer/json requirements for parsing source into an abstract syntax tree.", "links": [ "https://packagist.org/packages/nikic/php-parser" ] }, { "supplier": "NixOS / Nixpkgs maintainers", "product": "Nixpkgs PHP runtime environments", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nNixpkgs documents a minimal PHP base wrapped with selected extensions and generated php.ini; PHP-built tools inherit their owning runtime.", "links": [ "https://nixos.org/manual/nixpkgs/stable/", "https://wiki.nixos.org/w/index.php?title=PHP&oldid=33628" ] }, { "supplier": "Observium Limited / Observium project", "product": "Observium", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official installation guide explicitly provisions both the PHP web SAPI and command-line runtime.", "links": [ "https://docs.observium.org/install_debian/" ] }, { "supplier": "October CMS project", "product": "October CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 4.x guide explicitly calls October a PHP web application and requires PHP 8.2 with named modules.", "links": [ "https://docs.octobercms.com/4.x/setup/installation.html" ] }, { "supplier": "Open eClass project / GUnet", "product": "Open eClass", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 4.1 installation page requires PHP and names modules; it explicitly says the current package does not include phpMyAdmin.", "links": [ "https://docs.openeclass.org/en/4.1/install" ] }, { "supplier": "Open Social project", "product": "Open Social Drupal installation profile", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official repository manifest identifies a drupal-profile and explicitly declares PHP ^8.3 and Drupal core dependencies.", "links": [ "https://github.com/goalgorilla/open_social/blob/main/composer.json" ] }, { "supplier": "Open Web Analytics project", "product": "Open Web Analytics", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official analytics application manifest explicitly requires PHP and a Composer merge plugin for module requirements.", "links": [ "https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/master/composer.json" ] }, { "supplier": "OpenBSD ports maintainers / PHP documentation team", "product": "OpenBSD optional PHP package and ports family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP documentation confirms split optional OpenBSD packages; dated7.9 release notes list four PHP source-version families.", "links": [ "https://www.php.net/manual/en/install.unix.openbsd.php", "https://www.openbsd.org/79.html" ] }, { "supplier": "OpenCart project", "product": "OpenCart", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nPublisher package metadata for 4.1.0.4 explicitly requires PHP >=8.1.0. The official repository describes the PHP server and runtime modules.", "links": [ "https://packagist.org/packages/opencart/opencart", "https://github.com/opencart/opencart/blob/master/docs/getting-started/system-requirements.md" ] }, { "supplier": "OpenConext / SURF", "product": "OpenConext EngineBlock SAML proxy", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe SAML proxy manifest declares PHP ^8.5 and runtime extensions.", "links": [ "https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json", "https://github.com/OpenConext/OpenConext-engineblock", "https://github.com/OpenConext/OpenConext-engineblock/releases", "https://openconext.org/openconext-building-blocks/" ] }, { "supplier": "OpenDocMan project", "product": "OpenDocMan", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe source manifest requires PHP, while official README and website requirements show different generations of guidance.", "links": [ "https://github.com/opendocman/opendocman/blob/master/composer.json", "https://github.com/opendocman/opendocman", "https://www.opendocman.com/documentation/" ] }, { "supplier": "OpenEMR project", "product": "OpenEMR", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nThe official OpenEMR Composer manifest pins its platform runtime to PHP 8.3 and lists required PHP extensions.", "links": [ "https://github.com/openemr/openemr/blob/master/composer.json" ] }, { "supplier": "OpenMage project", "product": "OpenMage", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial requirements establish PHP and intl. Publisher registry metadata separately identifies OpenMage as a Magento-1 fork.", "links": [ "https://docs.openmage.org/users/requirements/", "https://packagist.org/packages/openmage/magento-lts" ] }, { "supplier": "openmediavault project", "product": "openmediavault PHP management backend", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official web GUI deployment state configures a dedicated PHP-FPM pool running as openmediavault-webgui.", "links": [ "https://github.com/openmediavault/openmediavault/blob/master/deb/openmediavault/srv/salt/omv/deploy/phpfpm/10webgui.sls" ] }, { "supplier": "OpenSearch Contributors; inherited Elastic client lineage", "product": "OpenSearch PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe PHP client declares PHP ^8.2, curl/json and PSR HTTP implementations. AWS SDK is suggested for the signing decorator and appears in require-dev.", "links": [ "https://packagist.org/packages/opensearch-project/opensearch-php" ] }, { "supplier": "OpenSwoole project", "product": "OpenSwoole native PHP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release declares PHP >=8.3 and documents its native Zend Fiber integration.", "links": [ "https://pecl.php.net/package/openswoole/26.2.0" ] }, { "supplier": "OpenWrt packages feed maintainers", "product": "OpenWrt selectable PHP8 package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nOpenWrt recipe separates configuration, runtime binaries, startup integration and extension modules, rather than bundling an interpreter in every php8 package.", "links": [ "https://github.com/openwrt/packages/blob/master/lang/php8/Makefile" ] }, { "supplier": "OPNsense / Deciso", "product": "OPNsense WebGUI and API", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nVersioned release entries distinguish the PHP8.5.11/Phalcon5.22.1 declaration in26.7.6 from the newer26.7.7 release identity; no patch payload is inferred from absence of a changed-package line.", "links": [ "https://docs.opnsense.org/releases/CE_26.7.html", "https://docs.opnsense.org/development/frontend/routing.html" ] }, { "supplier": "OrangeHRM Inc.", "product": "OrangeHRM Starter", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe edition-labelled Starter repository links to vendor prerequisites that explicitly install the PHP web environment.", "links": [ "https://starterhelp.orangehrm.com/hc/en-us/articles/6187572000540-Prerequisites-for-installing-OrangeHRM-Starter-in-Linux", "https://github.com/orangehrm/orangehrm" ] }, { "supplier": "Oro Inc.", "product": "OroCommerce", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor separates server PHP/CLI and extension requirements from client-side browsers, cookies and JavaScript.", "links": [ "https://doc.oroinc.com/backend/setup/system-requirements/" ] }, { "supplier": "Oro, Inc.", "product": "OroCRM Community Edition application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe product-specific package metadata confirms PHP for the CRM Community application and distinguishes it from Enterprise, Commerce and Platform distributions.", "links": [ "https://packagist.org/packages/oro/crm-application", "https://github.com/oroinc/crm-application/blob/master/composer.json" ] }, { "supplier": "osCommerce", "product": "osCommerce 4", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor explicitly states that its V4 commerce platform uses PHP 8.3 and also supports older PHP from 7.4.", "links": [ "https://www.oscommerce.com/" ] }, { "supplier": "osCommerce legacy project", "product": "osCommerce Online Merchant 2.3", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe archived v2.3 manual requires a PHP-enabled web server and describes compatibility with PHP 4/5.", "links": [ "https://library.oscommerce.com/Online&en&oscom_2_3&getting_started&requirements" ] }, { "supplier": "OVHcloud", "product": "OVHcloud webhosting PHP / .ovhconfig runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nOVHcloud documents PHP hosting families, environment/architecture boundaries and provider versus website-owner responsibilities.", "links": [ "https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/configure-your-web-hosting" ] }, { "supplier": "ownCloud / Kiteworks", "product": "ownCloud Classic 11", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor's 11.0 guide confirms that supported Docker installations include PHP 8 and Apache and replace native Linux installation.", "links": [ "https://doc.owncloud.com/server/11.0/admin_manual/installation/installing_with_docker.html" ] }, { "supplier": "ownCloud / Kiteworks", "product": "ownCloud Server 10", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe versioned vendor requirements identify PHP 7.4 for the classic server branch.", "links": [ "https://doc.owncloud.com/server/10.16/admin_manual/installation/system_requirements.html" ] }, { "supplier": "OXID eSales", "product": "OXID eShop", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 7.3 vendor requirements name PHP 8.2-8.4 and required modules for the documented eShop editions.", "links": [ "https://docs.oxid-esales.com/eshop/de/7.3/installation/neu-installation/server-und-systemvoraussetzungen.html" ] }, { "supplier": "Palo Alto Networks", "product": "PAN-OS", "version": "All PAN-OS versions listed affected; fixed releases not yet announced", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing", "https://security.paloaltonetworks.com/CVE-2025-0108", "https://security.paloaltonetworks.com/CVE-2026-109618" ] }, { "supplier": "Palo Alto Networks", "product": "Panorama", "version": "All Panorama versions listed affected; fixed releases not yet announced", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing", "https://docs.paloaltonetworks.com/panorama/getting-started/panorama-overview/about-panorama", "https://security.paloaltonetworks.com/CVE-2026-109618" ] }, { "supplier": "Pantheon", "product": "Pantheon managed PHP application runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nPantheon documents current PHP families and separately describes legacy7.4 availability.", "links": [ "https://docs.pantheon.io/guides/php", "https://docs.pantheon.io/release-notes/2026/09/php-82-83-84-85-security-updates" ] }, { "supplier": "ParaTest / Brian Scaturro, Filippo Tessarotto and contributors", "product": "ParaTest parallel PHPUnit runner", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for brianium/paratest v7.27.2 declares PHP ~8.4.0 \\", "links": [] }, { "supplier": "Part-DB project", "product": "Part-DB server", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official server manifest declares PHP and direct native modules; README separates server execution from Node/yarn browser-asset building.", "links": [ "https://github.com/Part-DB/Part-DB-server/blob/master/composer.json", "https://github.com/Part-DB/Part-DB-server" ] }, { "supplier": "Passbolt SA", "product": "Passbolt API server", "version": "Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in progress.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://www.passbolt.com/docs/hosting/install/ce/from-source/", "https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2" ] }, { "supplier": "PayPal", "product": "PayPal Server SDK for PHP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe PHP Server SDK requires curl/json and APIMatic support packages. Its README names five supported controller groups.", "links": [ "https://packagist.org/packages/paypal/paypal-server-sdk" ] }, { "supplier": "PCOV / Joe Watkins and contributors", "product": "PCOV PHP native code-coverage driver", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official release catalogue requires PHP for PCOV; upstream documents enabled versus disabled executor hooks.", "links": [ "https://pecl.php.net/package/pcov", "https://github.com/krakjoe/pcov", "https://github.com/krakjoe/pcov/blob/develop/INSTALL.md" ] }, { "supplier": "PeachPie / iolevel", "product": "PeachPie PHP compiler and .NET runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nPeachPie compiles PHP programs to assemblies using its reimplemented .NET runtime.", "links": [ "https://docs.peachpie.io/about/", "https://www.peachpie.io/blog/2024/08/22/peachpie-1110/" ] }, { "supplier": "PeachPie / WpDotNet project", "product": "WpDotNet compiled WordPress on PeachPie", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe release announcement describes WpDotNet executing compiled WordPress without a php executable.", "links": [ "https://www.peachpie.io/blog/2024/08/22/peachpie-1110/" ] }, { "supplier": "PEAR project / PHP Group", "product": "PEAR Base System", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nThe official PEAR package page identifies the installer/base PHP error-handling classes and published version/runtime dependencies.", "links": [ "https://pear.php.net/package/PEAR", "https://github.com/pear/pear-core", "https://pecl.php.net/" ] }, { "supplier": "PECL XHProf / longxinH and contributors", "product": "XHProf native PHP collection extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release page separates a C data-collection extension from an all-PHP reporting layer.", "links": [ "https://pecl.php.net/package/xhprof/2.3.10" ] }, { "supplier": "PECL XHProf / longxinH and contributors", "product": "XHProf PHP reporting and navigation UI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nThe publisher explicitly states that XHProf reporting/UI is PHP, distinct from the native collector.", "links": [ "https://pecl.php.net/package/xhprof/2.3.10" ] }, { "supplier": "PestPHP / Nuno Maduro and contributors", "product": "Pest PHP testing framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for pestphp/pest v5.3.2 declares PHP ^8.4 for this tool/library.", "links": [ "https://packagist.org/packages/pestphp/pest", "https://pestphp.com/docs/installation" ] }, { "supplier": "Phalcon project", "product": "Phalcon framework PHP extension", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial installation guides describe Phalcon as a compiled PHP extension, with distinct web/CLI loading and feature-specific companion modules.", "links": [ "https://docs.phalcon.io/5.23/installation/", "https://docs.phalcon.io/5.9/installation/", "https://pecl.php.net/" ] }, { "supplier": "PHAR.io / Arne Blankerts, Sebastian Heuer and contributors", "product": "Phive PHAR installation and verification tool", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phar-io/phive 0.16.0 declares PHP ^8.0 for this tool/library.", "links": [ "https://packagist.org/packages/phar-io/phive" ] }, { "supplier": "Phillips Data / Blesta", "product": "Blesta billing platform", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nVersioned vendor requirements explicitly identify PHP, encoded-code loader and native extensions for the billing platform.", "links": [ "https://docs.blesta.com/installation/" ] }, { "supplier": "Phing project / Michiel Rook and contributors", "product": "Phing PHP build system", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phing/phing 3.1.2 declares PHP >=8.1 for this tool/library.", "links": [ "https://packagist.org/packages/phing/phing" ] }, { "supplier": "PHP CS Fixer project", "product": "PHP CS Fixer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nThe selected fixer release declares PHP and direct modules; official docs distinguish Composer/shim, PHAR and image use.", "links": [ "https://packagist.org/packages/friendsofphp/php-cs-fixer", "https://cs.symfony.com/doc/installation.html" ] }, { "supplier": "PHP CS Fixer project", "product": "PHP CS Fixer official PHP container image family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe installation guide documents PHP-version-qualified fixer images for local, GitHub and GitLab CI use.", "links": [ "https://cs.symfony.com/doc/installation.html" ] }, { "supplier": "PHP Depend project", "product": "PHP Depend source-metrics analyzer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for pdepend/pdepend 3.0.0 declares PHP >=8.1 with php-64bit capability for this tool/library.", "links": [ "https://packagist.org/packages/pdepend/pdepend" ] }, { "supplier": "PHP Ev extension project", "product": "Ev native PHP libev binding", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release exposes libev event-loop functionality to PHP and declares a PHP minimum.", "links": [ "https://pecl.php.net/package/ev/1.2.3", "https://pecl.php.net/package/ev" ] }, { "supplier": "PHP Event extension project", "product": "Event native PHP libevent binding", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release exposes native libevent scheduling APIs. The PHP manual makes OpenSSL conditional on OpenSSL features.", "links": [ "https://pecl.php.net/package/event/3.1.6", "https://pecl.php.net/package/event", "https://www.php.net/manual/en/event.requirements.php" ] }, { "supplier": "PHP Gearman extension project", "product": "Gearman native PHP client and worker extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSelected 2.2.1 exposes libgearman clients/workers and declares PHP 7.2.0 through 8.6.99.", "links": [ "https://pecl.php.net/package/gearman/2.2.1", "https://www.php.net/manual/en/gearman.requirements.php" ] }, { "supplier": "PHP gnupg extension project", "product": "GnuPG native PHP GPGME binding", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSelected release identifies a GPGME binding and fixes PHP 8.5 and GPGME 2.0 build compatibility.", "links": [ "https://pecl.php.net/package/gnupg/1.5.4", "https://www.php.net/manual/en/gnupg.requirements.php", "https://www.gnupg.org/software/gpgme/index.html" ] }, { "supplier": "PHP Mailparse extension project", "product": "Mailparse native PHP MIME parser extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release parses RFC822/MIME messages and still lists mbstring. The official installation manual requires mbstring to load first.", "links": [ "https://pecl.php.net/package/mailparse/3.2.0", "https://pecl.php.net/package/mailparse", "https://www.php.net/manual/en/mailparse.installation.php" ] }, { "supplier": "PHP OAuth extension project", "product": "OAuth native PHP consumer extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release identifies an OAuth consumer extension and requires hash, now part of PHP core.", "links": [ "https://pecl.php.net/package/oauth/2.0.10", "https://pecl.php.net/package/oauth" ] }, { "supplier": "PHP SSH2 extension project", "product": "SSH2 native PHP client binding", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release provides PHP bindings to libssh2 for SSH2 and declares a PHP minimum.", "links": [ "https://pecl.php.net/package/ssh2/1.5.0", "https://pecl.php.net/package/ssh2" ] }, { "supplier": "PHP YAML extension project", "product": "YAML native PHP parser and emitter extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release provides YAML 1.1 parsing/emission using LibYAML. The catalogue names date but does not render required/optional classification.", "links": [ "https://pecl.php.net/package/yaml/2.3.0", "https://pecl.php.net/package/yaml", "https://packagist.org/packages/pecl/yaml" ] }, { "supplier": "php-amqp project", "product": "AMQP native PHP messaging client extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release provides AMQP 0-9-1 client APIs. The official project documents native librabbitmq requirements separately from the test broker.", "links": [ "https://pecl.php.net/package/amqp/2.2.0", "https://pecl.php.net/package/amqp", "https://github.com/php-amqp/php-amqp" ] }, { "supplier": "PHP-FIG", "product": "PSR logging interfaces package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe package distributes PHP interfaces/classes/traits for PSR-3 and explicitly does not provide a logger implementation.", "links": [ "https://packagist.org/packages/psr/log" ] }, { "supplier": "php-memcached project", "product": "Memcached native PHP client extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPECL identifies the libmemcached-based PHP client. The official 3.x README explicitly makes igbinary/msgpack serializer support optional, despite the flat PECL dependency list.", "links": [ "https://pecl.php.net/package/memcached/3.4.0", "https://pecl.php.net/package/memcached", "https://github.com/php-memcached-dev/php-memcached" ] }, { "supplier": "PHP-PM project", "product": "PHP-PM process manager", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release declares PHP and pcntl and describes retaining application bootstraps in worker processes.", "links": [ "https://packagist.org/packages/php-pm/php-pm" ] }, { "supplier": "php-rdkafka project", "product": "rdkafka native PHP Kafka client extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected stable release is a librdkafka-based PHP client. The catalogue separately lists 7.0.0alpha1 with a higher PHP minimum.", "links": [ "https://pecl.php.net/package/rdkafka/6.0.5", "https://pecl.php.net/package/rdkafka" ] }, { "supplier": "Phpactor project", "product": "Phpactor PHP language server and refactoring tool", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPhpactor's manifest requires PHP ^8.2, mbstring, posix and tokenizer. Its README describes language-server/refactoring functionality and Linux/macOS or WSL.", "links": [ "https://packagist.org/packages/phpactor/phpactor" ] }, { "supplier": "phpBB Limited / phpBB project", "product": "phpBB", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe publisher package declares PHP and direct extensions for its displayed 4.0 alpha release, with separate runtime and development dependencies.", "links": [ "https://packagist.org/packages/phpbb/phpbb" ] }, { "supplier": "PHPBench / Daniel Leech and contributors", "product": "PHPBench benchmarking framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpbench/phpbench 1.7.0 declares PHP ^8.2 for this tool/library.", "links": [ "https://packagist.org/packages/phpbench/phpbench" ] }, { "supplier": "PHPCSStandards / PHP_CodeSniffer project", "product": "PHP_CodeSniffer and PHP Code Beautifier/Fixer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for squizlabs/php_codesniffer 4.0.4 declares PHP >=7.2.0 for this tool/library.", "links": [ "https://packagist.org/packages/squizlabs/php_codesniffer", "https://packagist.org/packages/phpcsstandards/php_codesniffer" ] }, { "supplier": "phpDocumentor project", "product": "phpDocumentor documentation generator", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpdocumentor/phpdocumentor v3.10.0 declares PHP ^8.1 for this tool/library.", "links": [ "https://packagist.org/packages/phpdocumentor/phpdocumentor" ] }, { "supplier": "phpIPAM project", "product": "phpIPAM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project supplies branch-specific PHP ranges and separately documents PHP modules and optional CLI functions.", "links": [ "https://github.com/phpipam/phpipam", "https://phpipam.net/documents/installation/" ] }, { "supplier": "phpLDAPadmin / leenooks project", "product": "phpLDAPadmin", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe current source manifest explicitly requires PHP and LDAP-related extensions for the directory administration web application.", "links": [ "https://github.com/leenooks/phpLDAPadmin/blob/master/composer.json", "https://github.com/leenooks/phpLDAPadmin" ] }, { "supplier": "phpList project", "product": "phpList", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official requirements explicitly identify PHP and warn that some functionality/modules and plugin requirements are conditional.", "links": [ "https://resources.phplist.com/system/start" ] }, { "supplier": "PHPMailer project", "product": "PHPMailer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PHP mail creation/transport class declares three direct extension requirements and feature-specific mail/encoding integrations.", "links": [ "https://packagist.org/packages/phpmailer/phpmailer" ] }, { "supplier": "PHPMD project", "product": "PHPMD PHP Mess Detector", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpmd/phpmd 3.0.0 declares PHP ^8.1 for this tool/library.", "links": [ "https://packagist.org/packages/phpmd/phpmd" ] }, { "supplier": "phpMyAdmin project", "product": "phpMyAdmin", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nRegistry metadata provides a release-specific PHP/module subset while the development manual separates optional archive/media/authentication features.", "links": [ "https://docs.phpmyadmin.net/en/latest/require.html", "https://packagist.org/packages/phpmyadmin/phpmyadmin" ] }, { "supplier": "phpMyFAQ project", "product": "phpMyFAQ", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nThe official phpMyFAQ Composer manifest declares PHP >=8.4.0, and the release process documents signed CycloneDX SBOM publication.", "links": [ "https://github.com/thorsten/phpMyFAQ/blob/main/composer.json", "https://github.com/thorsten/phpMyFAQ/blob/main/docs/release.md" ] }, { "supplier": "phpPgAdmin project", "product": "phpPgAdmin", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official application manifest explicitly declares PHP and the PostgreSQL PHP extension.", "links": [ "https://github.com/phppgadmin/phppgadmin/blob/master/composer.json" ] }, { "supplier": "PhpRedis project / Michael Grunder and contributors", "product": "PhpRedis native PHP client extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe develop build declarations make native compression conditional. The installation guide distinguishes optional serializer builds from the feature-limited initial Windows PIE binaries.", "links": [ "https://pecl.php.net/package/redis/6.3.0", "https://github.com/phpredis/phpredis/blob/develop/INSTALL.md", "https://github.com/phpredis/phpredis/blob/develop/config.m4" ] }, { "supplier": "PHPro / GrumPHP contributors", "product": "GrumPHP Git quality-check orchestration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpro/grumphp v2.26.0 declares PHP ~8.2.0 \\", "links": [] }, { "supplier": "phpseclib project", "product": "phpseclib", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe library implements cryptography and secure communications in PHP; native crypto acceleration and XML-key features are optional.", "links": [ "https://packagist.org/packages/phpseclib/phpseclib" ] }, { "supplier": "PhpSpec project", "product": "PhpSpec specification test runner", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpspec/phpspec 9.0.0-rc.4.4 declares PHP 8.3.* \\", "links": [] }, { "supplier": "PHPStan / Ondrej Mirtes and contributors", "product": "PHPStan static analyzer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpstan/phpstan 2.3.1 declares PHP ^7.4\\", "links": [] }, { "supplier": "PHPStan project", "product": "PHPStan PHPDoc parser library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpstan/phpdoc-parser 2.3.6 declares PHP ^7.4 \\", "links": [] }, { "supplier": "PHPUnit project", "product": "PHPUnit test framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPHPUnit is a PHP CLI test runner; release-specific metadata refines broad manual requirements.", "links": [ "https://packagist.org/packages/phpunit/phpunit", "https://docs.phpunit.de/en/12.5/installation.html", "https://docs.phpunit.de/en/13.4/installation.html" ] }, { "supplier": "PHPUnit project / Sebastian Bergmann", "product": "PHPUnit PHP code-coverage library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpunit/php-code-coverage 14.4.1 declares PHP >=8.4 for this tool/library.", "links": [ "https://packagist.org/packages/phpunit/php-code-coverage" ] }, { "supplier": "phpVirtualBox project", "product": "phpVirtualBox server-side administration application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project describes a PHP web administration interface for VirtualBox.", "links": [ "https://github.com/phpvirtualbox/phpvirtualbox" ] }, { "supplier": "Pi-hole project", "product": "Pi-hole v5 legacy PHP web interface", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nPi-hole's version6 announcement explicitly removes the former lighttpd/PHP dependency.", "links": [ "https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/" ] }, { "supplier": "Pimcore project", "product": "Pimcore Platform", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nVersioned platform requirements list PHP 8.5+ for 2026.2; the 2025.1 page specifies PHP 8.3/8.4.", "links": [ "https://docs.pimcore.com/platform/2026.2/Getting_Started/Installation/System_Requirements/", "https://docs.pimcore.com/platform/2025.1/Pimcore/Installation_and_Upgrade/System_Requirements/" ] }, { "supplier": "Plesk", "product": "Plesk for Linux", "version": "All shipped PHP versions", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: all PHP versions shipped with Plesk\nPlesk confirms that all PHP versions shipped with Plesk for Linux are affected; patched versions are pending a PHP vendor fix.", "links": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ] }, { "supplier": "Plesk", "product": "Plesk for Windows", "version": "All shipped PHP versions", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: all PHP versions shipped with Plesk\nPlesk confirms that all PHP versions shipped with Plesk for Windows are affected; patched versions are pending a PHP vendor fix.", "links": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ] }, { "supplier": "Plesk", "product": "Plesk Obsidian hosted-site PHP", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected hosted Plesk PHP in aggregate: Linux PHP 7.4, 8.0 and 8.1 plus Windows PHP 8.2-8.5 remain affected; fixed Linux PHP 8.2-8.5 builds are available\nPlesk confirms hosted PHP remains affected in aggregate: Linux fixes are available for PHP 8.2-8.5, while Linux EOL branches and Windows builds remain affected.", "links": [ "https://docs.plesk.com/release-notes/obsidian/change-log/", "https://docs.plesk.com/en-US/obsidian/administrator-guide/web-hosting/php-management/installing-php.75153/", "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ] }, { "supplier": "Plesk", "product": "Plesk plesk-engine internal PHP management runtime for Windows", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4\nPlesk confirms that all versions of the Windows internal UI engine component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.", "links": [ "https://docs.plesk.com/release-notes/obsidian/change-log/", "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ] }, { "supplier": "Plesk", "product": "Plesk sw-engine internal PHP management runtime", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4\nPlesk confirms that all versions of the Linux sw-engine internal UI component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.", "links": [ "https://docs.plesk.com/release-notes/obsidian/change-log/", "https://support.plesk.com/hc/en-us/articles/31743316866071-The-sw-engine-process-causes-high-CPU-usage-on-a-Plesk-server", "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ] }, { "supplier": "PluXml project", "product": "PluXml 5.8 documented branch", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe PluXml 5.8 installation guide requires a PHP interpreter and GD for images.", "links": [ "https://wiki.pluxml.org/docs/install/install.html" ] }, { "supplier": "PmWiki project", "product": "PmWiki", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project requires PHP on the web server and describes its PHP compatibility range.", "links": [ "https://www.pmwiki.org/wiki/PmWiki/Requirements" ] }, { "supplier": "PostfixAdmin project", "product": "PostfixAdmin", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project identifies a PHP-capable web application used to administer virtual users for a separate Postfix mail server.", "links": [ "https://github.com/postfixadmin/postfixadmin" ] }, { "supplier": "Predis project / Till Kruss and contributors", "product": "Predis PHP Redis and Valkey client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nPredis declares PHP compatibility and a PSR message interface; Relay is suggested as an optional faster connection implementation.", "links": [ "https://packagist.org/packages/predis/predis" ] }, { "supplier": "PrestaShop project", "product": "PrestaShop", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe version-9 requirements identify PHP, required modules and separate compatibility bands for 9.0 and 9.1.", "links": [ "https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/" ] }, { "supplier": "PrivateBin project", "product": "PrivateBin", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official manifest requires PHP; the project separately states that paste encryption/decryption occurs in the browser.", "links": [ "https://github.com/PrivateBin/PrivateBin/blob/master/composer.json", "https://github.com/PrivateBin/PrivateBin" ] }, { "supplier": "ProcessWire project", "product": "ProcessWire CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial requirements list PHP 8.x as recommended, PHP 7.x compatibility, and image-processing support.", "links": [ "https://processwire.com/about/requirements/", "https://processwire.com/docs/front-end/include/" ] }, { "supplier": "ProjectSend project", "product": "ProjectSend", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe current source installation guide lists PHP web/CLI requirements; LDAP is required even without configured LDAP use.", "links": [ "https://github.com/projectsend/projectsend/blob/main/INSTALL.md", "https://docs.projectsend.org/about/installation/requirements" ] }, { "supplier": "Prophecy / PhpSpec project", "product": "Prophecy PHP mocking library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for phpspec/prophecy v1.26.1 declares PHP 8.2.* \\", "links": [] }, { "supplier": "Psalm project / Daniil Gentili", "product": "Psalm official custom-PHP container image", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPsalm's official installation guide describes an image containing a custom PHP build and its analyzer.", "links": [ "https://psalm.dev/docs/running_psalm/installation/" ] }, { "supplier": "Psalm project / Matthew Brown, Daniil Gentili and contributors", "product": "Psalm PHP static analyzer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for vimeo/psalm 7.0.0-rc2 declares PHP ~8.1.31 \\", "links": [] }, { "supplier": "PsySH / Justin Hileman and contributors", "product": "PsySH interactive PHP shell", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for psy/psysh v0.12.24 declares PHP ^8.0 \\", "links": [] }, { "supplier": "Pterodactyl project", "product": "Pterodactyl Panel PHP application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe Panel manifest declares PHP, Laravel and required PHP extensions for the management application.", "links": [ "https://github.com/pterodactyl/panel/blob/1.0-develop/composer.json", "https://github.com/pterodactyl/wings/blob/develop/go.mod" ] }, { "supplier": "Public Knowledge Project (PKP)", "product": "Open Journal Systems", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official OJS README requires PHP and supplies a platform-check example while warning that its sample version numbers are not minimum versions.", "links": [ "https://github.com/pkp/ojs/blob/main/README.md" ] }, { "supplier": "Public Knowledge Project (PKP)", "product": "Open Monograph Press", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official OMP README requires PHP and distinguishes PHP platform requirements from illustrative module version numbers.", "links": [ "https://github.com/pkp/omp" ] }, { "supplier": "Public Knowledge Project (PKP)", "product": "Open Preprint Systems", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official OPS README requires PHP for the preprint server and identifies web-versus-CLI configuration differences.", "links": [ "https://github.com/pkp/ops" ] }, { "supplier": "Pydio", "product": "Pydio 8 Enterprise Distribution", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor's legacy Enterprise guide explicitly requires PHP, modules and ionCube, and recommends a PHP CLI path.", "links": [ "https://docs.pydio.com/pydio-v8/admin-guide/installation-guide/pydio-requirements/", "https://github.com/pydio/cells" ] }, { "supplier": "QloApps", "product": "QloApps", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official QloApps repository identifies a hotel management and reservation platform with PHP application code, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/Qloapps/QloApps", "https://api.github.com/repos/Qloapps/QloApps/dependency-graph/sbom" ] }, { "supplier": "QNAP", "product": "QNAP PHP7.4 optional application before5.2 migration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nQNAP documents a separate PHP7.4 application and its firmware-transition disablement.", "links": [ "https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520" ] }, { "supplier": "QNAP", "product": "QNAP QTS built-in PHP runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPrior built-in firmware mappings are retained. A separate QNAP FAQ documents retirement/disablement of the optional PHP7.4 application after5.1.x->5.2.0; this is not a replacement built-in PHP version table.", "links": [ "https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520", "https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero" ] }, { "supplier": "QNAP", "product": "QNAP QuTS hero built-in PHP runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPrior built-in firmware mappings are retained. A separate QNAP FAQ documents retirement/disablement of the optional PHP7.4 application after5.1.x->5.2.0; this is not a replacement built-in PHP version table.", "links": [ "https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520", "https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero" ] }, { "supplier": "Quest Software", "product": "KACE Systems Management Appliance", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nQuest published KB 4385046 in the KACE Systems Management Appliance support feed as a response to CVE-2026-109618 and CVE-2026-109619.", "links": [ "https://support.quest.com/kace-systems-management-appliance/kb/4385046/4385046", "https://support.quest.com/kace-systems-management-appliance/rss" ] }, { "supplier": "RainLoop Team", "product": "RainLoop Webmail", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor requirements explicitly specify PHP and distinguish optional contact-database support from the mail UI.", "links": [ "https://www.rainloop.net/docs/system-requirements/", "https://github.com/RainLoop/rainloop-webmail" ] }, { "supplier": "RaspAP project", "product": "RaspAP PHP network-management web GUI", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nRaspAP's manual installation configures a PHP-CGI web management interface.", "links": [ "https://docs.raspap.com/get-started/manual/" ] }, { "supplier": "ReactPHP project", "product": "ReactPHP EventLoop", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nReactPHP provides a PHP event loop with a stream_select default that works without installing a separate event-loop extension.", "links": [ "https://packagist.org/packages/react/event-loop" ] }, { "supplier": "Rector project", "product": "Rector automated PHP refactoring tool", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for rector/rector 2.7.0 declares PHP ^7.4\\", "links": [] }, { "supplier": "Red Hat", "product": "Red Hat Enterprise Linux 9 PHP RPM/AppStreams", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected: Red Hat lists the RHEL 9 PHP component family as affected; scoped php:8.2 fix recorded separately\nRed Hat's CVE pages mark the RHEL 9 PHP component family affected; RHSA-2026:87072 separately fixes the scoped php:8.2 module row.", "links": [ "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages", "https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle", "https://access.redhat.com/security/cve/cve-2026-109618", "https://access.redhat.com/security/cve/cve-2026-109619" ] }, { "supplier": "Red Hat", "product": "Red Hat Enterprise Linux 9 php:8.2 module", "version": "8.2.35-1.module+el9.8.0+25111+a1450321", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321\nRed Hat RHSA-2026:87072 provides fixed RHEL 9 php:8.2 module packages for CVE-2026-109618 and CVE-2026-109619.", "links": [ "https://access.redhat.com/errata/RHSA-2026:87072" ] }, { "supplier": "Render; customer/base-image publisher", "product": "Render customer PHP Docker hosting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nRender's PHP deployment guide uses Docker and nginx/php-fpm for a Laravel application.", "links": [ "https://render.com/docs/deploy-php-laravel-docker", "https://render.com/docs/docker" ] }, { "supplier": "RoadRunner PHP community", "product": "RoadRunner common PHP worker package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe common worker declares PHP and extension requirements; the old Composer name is replaced.", "links": [ "https://packagist.org/packages/roadrunner/worker", "https://packagist.org/packages/spiral/roadrunner-worker" ] }, { "supplier": "RoadRunner project", "product": "RoadRunner configured PHP worker-pool integration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Optional PHP path; CVE match unknown\nThe documented pool starts PHP CLI processes and applies only to six named plugin paths.", "links": [ "https://docs.roadrunner.dev/docs/php-worker/pool" ] }, { "supplier": "Roave", "product": "Roave backward-compatibility checker", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for roave/backward-compatibility-check 8.23.0 declares PHP ~8.4.0 \\", "links": [] }, { "supplier": "Roundcube project", "product": "Roundcube Webmail", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nThe official project identifies a PHP/JavaScript webmail server with an internal IMAP library; registry supplies a named release and bounded PHP range.", "links": [ "https://github.com/roundcube/roundcubemail", "https://packagist.org/packages/roundcube/roundcubemail", "https://github.com/roundcube/roundcubemail/blob/master/composer.json" ] }, { "supplier": "Roundcube project", "product": "Roundcube Webmail Docker image family", "version": "Unrebuilt Roundcube Docker variants using pre-fix PHP 8.4 base images", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Roundcube's maintainer confirms that image rebuilds are needed after patched PHP base images arrive and reports build failures. No complete set of published fixed Roundcube tags is confirmed in the reviewed thread.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://github.com/roundcube/roundcubemail-docker", "https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744" ] }, { "supplier": "SalesAgility / SuiteCRM project", "product": "SuiteCRM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nVersion-specific SuiteCRM 7 and 8 compatibility tables explicitly identify the PHP server runtime.", "links": [ "https://docs.suitecrm.com/8.x/admin/compatibility-matrix/", "https://docs.suitecrm.com/admin/compatibility-matrix/" ] }, { "supplier": "Sangoma", "product": "PBXact 17 PHP management edition", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSangoma describes PBXact17 as its commercial FreePBX-based system with PHP8.2.", "links": [ "https://www.freepbx.org/pbxact-17-general-availability-announcement/" ] }, { "supplier": "Sangoma / FreePBX project", "product": "FreePBX 17 management framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFreePBX17 documents PHP8.2 as its supported tested platform, distinct from its installer minimum guard.", "links": [ "https://sangomakb.atlassian.net/wiki/spaces/FP/pages/279052296", "https://github.com/FreePBX/framework/blob/release/17.0/install.php" ] }, { "supplier": "Scalingo", "product": "Scalingo PaaS", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nScalingo's php2shell bulletin says PHP applications hosted on Scalingo may be affected and lists patched PHP releases.", "links": [ "https://doc.scalingo.com/security/bulletins/ssb-2026-005" ] }, { "supplier": "Scalingo", "product": "Scalingo PHP buildpack", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nScalingo says applications using its PHP buildpack must rebuild and redeploy to receive the updated PHP runtime and workaround.", "links": [ "https://doc.scalingo.com/security/bulletins/ssb-2026-005" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "php-cgi-wasm package (Sean Morris)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe publisher lists php-cgi-wasm as a separate package.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "php-cli-wasm package (Sean Morris)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe publisher lists php-cli-wasm as a separate package.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "php-cloud-wasm package (Sean Morris)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe publisher lists php-cloud-wasm as a separate package.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "php-dbg-wasm package (Sean Morris)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe publisher lists php-dbg-wasm as a separate package.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "php-sdl-wasm package (Sean Morris)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe publisher lists php-sdl-wasm as a separate package.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "php-wasm-builder package (Sean Morris)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe publisher lists php-wasm-builder as a separate package.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Sean Morris / php-wasm project", "product": "Sean Morris php-wasm runtime package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe project documents embedded PHP WebAssembly packages.", "links": [ "https://github.com/seanmorris/php-wasm" ] }, { "supplier": "Securepoint GmbH", "product": "Securepoint Resellerportal", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown\nSecurepoint's live Resellerportal login HTML exposes Laravel application markers and a Securepoint resellerportal session cookie.", "links": [ "https://my.securepoint.de/", "https://laravel.com/framework/docs/deployment" ] }, { "supplier": "Semantic MediaWiki project", "product": "Semantic MediaWiki", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe publisher manifest declares PHP and mbstring and explicitly requires MediaWiki and its dependencies.", "links": [ "https://packagist.org/packages/mediawiki/semantic-media-wiki" ] }, { "supplier": "Sendy", "product": "Sendy self-hosted application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor describes Sendy as a PHP-hosted application and separately identifies Amazon SES for sending mail.", "links": [ "https://sendy.co/", "https://sendy.co/get-started" ] }, { "supplier": "Serendipity project", "product": "Serendipity Blog System", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project calls Serendipity a PHP web application and specifies PHP 7.3+, cookie/session support and extensions.", "links": [ "https://docs.s9y.org/docs/users/getting-started/fresh-installation.html" ] }, { "supplier": "Shaarli community", "product": "Shaarli", "version": "Shaarli Docker distribution awaiting a patched Alpine base at review time", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Shaarli's maintainer confirms that its Docker distribution needs the Alpine PHP security fix and that a new release is pending. This finding is scoped to the container runtime, not a Shaarli application-code defect.\nOfficial vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://github.com/shaarli/Shaarli/blob/master/composer.json", "https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435" ] }, { "supplier": "Shivam Mathur / setup-php project", "product": "setup-php GitHub Action external PHP provisioning", "version": "Patched setup-php v2-provisioned PHP builds announced 2026-10-21", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require update=true, and pre-installed disables updates.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://github.com/shivammathur/setup-php/blob/main/action.yml", "https://github.com/shivammathur/setup-php/issues/1139" ] }, { "supplier": "Shlink project", "product": "Shlink", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial package metadata identifies a PHP URL-shortening application with CLI/REST interfaces and direct runtime modules.", "links": [ "https://packagist.org/packages/shlinkio/shlink", "https://github.com/shlinkio/shlink" ] }, { "supplier": "Shopify", "product": "Shopify API Library for PHP deprecated line", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nPublished metadata identifies the PHP client and its extension subset. The README marks it deprecated and directs users to shopify/shopify-app-php.", "links": [ "https://packagist.org/packages/shopify/shopify-api" ] }, { "supplier": "Shopify", "product": "Shopify App PHP package", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe app package declares PHP >=8.2 with Firebase JWT and Guzzle dependencies for PHP Shopify app integration.", "links": [ "https://packagist.org/packages/shopify/shopify-app-php" ] }, { "supplier": "Shopware 5 project / shopware AG lineage", "product": "Shopware 5", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe v5.7.20 package declares PHP and its extension requirements. The project README says active maintenance is no longer guaranteed.", "links": [ "https://packagist.org/packages/shopware/shopware" ] }, { "supplier": "shopware AG", "product": "Shopware 6", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official 6.7 update guide requires PHP 8.2/8.3/8.4 and separately describes the Vue/Vite administration frontend.", "links": [ "https://docs.shopware.com/en/shopware-6-en/update-guides/update-guide-shopware-67", "https://developer.shopware.com/docs/v6.6/guides/installation/requirements.html" ] }, { "supplier": "Silverstripe CMS project", "product": "Silverstripe CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 6.x manual requires a PHP web server, PHP 8.3-8.5 and specific extensions.", "links": [ "https://docs.silverstripe.org/en/6/getting_started/server_requirements/" ] }, { "supplier": "Simple Machines / SMF project", "product": "Simple Machines Forum", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official application manifest declares a PHP runtime constraint separately from PHP-CS-Fixer and PHPUnit development dependencies.", "links": [ "https://github.com/SimpleMachines/SMF/blob/release-3.0/composer.json" ] }, { "supplier": "SimpleRisk", "product": "SimpleRisk PHP GRC application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nSimpleRisk publishes PHP version and extension requirements plus supported Apache/nginx execution modes.", "links": [ "https://support.simplerisk.com/kb/01-01-system-requirements" ] }, { "supplier": "SimpleSAMLphp project", "product": "SimpleSAMLphp", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nSimpleSAMLphp is a PHP SAML service-provider/identity-provider application with explicit PHP and extension requirements.", "links": [ "https://packagist.org/packages/simplesamlphp/simplesamlphp" ] }, { "supplier": "Slim project", "product": "Slim framework", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nSlim is a PHP HTTP microframework; its package requires a separately chosen PSR-7 implementation and identifies XML parser modules as optional.", "links": [ "https://packagist.org/packages/slim/slim" ] }, { "supplier": "SnappyMail project", "product": "SnappyMail", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project documents PHP for its server-side webmail implementation and identifies its RainLoop lineage.", "links": [ "https://github.com/the-djmaze/snappymail" ] }, { "supplier": "SolidWorx / SolidInvoice project", "product": "SolidInvoice application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official runtime manifest requires PHP and native extensions; source and binary installation methods have different packaging boundaries.", "links": [ "https://github.com/SolidInvoice/SolidInvoice/blob/3.2.x/composer.json", "https://github.com/SolidInvoice/SolidInvoice" ] }, { "supplier": "SolidWorx / SolidInvoice project", "product": "SolidInvoice self-contained binary", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe vendor explicitly documents a bundled PHP runtime and FrankenPHP worker controls; no separately installed host PHP is required.", "links": [ "https://solidinvoice.co/docs/installation-guide/quick-install/" ] }, { "supplier": "Sophos", "product": "MyUTM portal", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nSophos says its legacy MyUTM portal ran an affected PHP version and was taken offline for update, while stating that Sophos products themselves are not affected.", "links": [ "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ] }, { "supplier": "SPIP project", "product": "SPIP", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official configuration table gives PHP compatibility and extension requirements separately for SPIP 4.4, 4.3 and 4.2.", "links": [ "https://www.spip.net/en_article6659.html" ] }, { "supplier": "Spryker Systems GmbH", "product": "Spryker Commerce OS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor documents PHP-backed commerce and marketplace applications; its upgrade guide distinguishes the 8.3 floor from the 8.5 recommendation.", "links": [ "https://docs.spryker.com/docs/dg/dev/system-requirements/latest/system-requirements.html", "https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/upgrade-to-php-85" ] }, { "supplier": "SquirrelMail project", "product": "SquirrelMail legacy documented webmail", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe old official installation manual explicitly requires a PHP-capable web server for the webmail application.", "links": [ "https://www.squirrelmail.org/docs/admin/admin-3.html" ] }, { "supplier": "Statamic project", "product": "Statamic CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nStatamic describes itself as a PHP application installed as a Laravel package and lists PHP 8.3+ requirements.", "links": [ "https://statamic.dev/getting-started/requirements" ] }, { "supplier": "Statamic project", "product": "Statamic static-site generator", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nThe official guide installs statamic/ssg, invokes PHP/Artisan during the build and publishes storage/app/static.", "links": [ "https://statamic.dev/getting-started/deploying/netlify" ] }, { "supplier": "Stripe and contributors", "product": "Stripe PHP client library", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe displayed beta release requires PHP >=7.4.0 and curl, json and mbstring extensions in the PHP caller.", "links": [ "https://packagist.org/packages/stripe/stripe-php" ] }, { "supplier": "SugarAI / SugarCRM", "product": "Sugar application server", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor's supported-platforms page explicitly lists PHP among application server requirements, separately from end-user browser requirements.", "links": [ "https://support.sugarai.com/resources/supported_platforms/" ] }, { "supplier": "Sulu project", "product": "Sulu CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe Sulu 3.x requirements explicitly require PHP 8.2+ and DOM/XML extensions.", "links": [ "https://docs.sulu.io/3.x/reference/requirements.html" ] }, { "supplier": "SURF", "product": "SURF Research Access Management EngineBlock proxy", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSURF's architecture names EngineBlock as the SRAM proxy.", "links": [ "https://servicedesk.surf.nl/wiki/spaces/IAM/pages/74226103/Conceptual%2Boverview%2Bof%2BSURF%2BResearch%2BAccess%2BManagement", "https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json", "https://github.com/SURFscz/SBS" ] }, { "supplier": "SURF", "product": "SURF Research Drive Nextcloud server component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSURF's domain-vision PDF identifies Research Drive among Nextcloud-based services.", "links": [ "https://www.surf.nl/files/2026-04/surf-dienstdomeinvisies-slidedeck.pdf", "https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html" ] }, { "supplier": "SURF", "product": "SURFconext OpenConext EngineBlock proxy role", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nProject showcase and architecture connect SURFconext with OpenConext's EngineBlock proxy.", "links": [ "https://openconext.org/openconext-showcases/", "https://openconext.org/openconext-building-blocks/", "https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json" ] }, { "supplier": "SURF", "product": "SURFdrive Nextcloud server component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSURF states that SURFdrive is based on Nextcloud.", "links": [ "https://www.surf.nl/diensten/opslag-datamanagement/surfdrive", "https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html" ] }, { "supplier": "SURF", "product": "SURFfilesender FileSender server component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSURF identifies FileSender as the origin of SURFfilesender.", "links": [ "https://www.surf.nl/diensten/opslag-datamanagement/surffilesender", "https://docs.filesender.org/filesender/v3.0/install/" ] }, { "supplier": "SURF / SURFnet", "product": "SURFconext Service Provider Dashboard", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe registration/management application declares PHP ^8.2 in its root manifest.", "links": [ "https://github.com/SURFnet/sp-dashboard/blob/main/composer.json", "https://github.com/SURFnet/sp-dashboard" ] }, { "supplier": "SUSE", "product": "SUSE Linux Enterprise PHP8 package families", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSUSE release notes establish PHP 8.2 availability; its published update lists versioned php8 runtime, FPM and extension packages.", "links": [ "https://documentation.suse.com/releasenotes/sles/15-SP6/index.html", "https://www.suse.com/support/update/announcement/2026/suse-su-20264651-1/" ] }, { "supplier": "SUSE", "product": "SUSE SLE BCI PHP CLI container", "version": "", "status_109618": "Not vuln", "status_109619": "Not vuln", "notes": "CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.\nOfficial vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://registry.suse.com/repositories/bci-php", "https://lists.suse.com/pipermail/sle-container-updates/2026-September/012564.html", "https://www.suse.com/security/cve/CVE-2026-109618.html", "https://www.suse.com/security/cve/CVE-2026-109619.html" ] }, { "supplier": "SUSE", "product": "SUSE SLE BCI PHP-Apache container", "version": "", "status_109618": "Not vuln", "status_109619": "Not vuln", "notes": "CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.\nOfficial vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://registry.suse.com/repositories/bci-php-apache", "https://lists.suse.com/pipermail/sle-container-updates/2026-September/012562.html", "https://www.suse.com/security/cve/CVE-2026-109618.html", "https://www.suse.com/security/cve/CVE-2026-109619.html" ] }, { "supplier": "SUSE", "product": "SUSE SLE BCI PHP-FPM 8 container", "version": "", "status_109618": "Not vuln", "status_109619": "Not vuln", "notes": "CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.\nOfficial vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://registry.suse.com/repositories/bci-php-fpm", "https://lists.suse.com/pipermail/sle-container-updates/2026-September/012563.html", "https://www.suse.com/security/cve/CVE-2026-109618.html", "https://www.suse.com/security/cve/CVE-2026-109619.html" ] }, { "supplier": "Swoole project", "product": "Swoole native PHP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe release identifies an asynchronous PHP networking engine and explicit PHP-version bounds.", "links": [ "https://pecl.php.net/package/swoole/6.2.3" ] }, { "supplier": "Sylius project", "product": "Sylius", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official prerequisites require PHP 8.2+ and five named extensions for the Symfony-based commerce application.", "links": [ "https://docs.sylius.com/public/getting-started/before-you-begin" ] }, { "supplier": "Sylvain Lassaut / NoiseByNorthwest", "product": "SPX native PHP profiling extension and built-in report UI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe maintainer README describes a loaded PHP extension with HTTP profiling/UI and CLI modes; build configuration links native zlib.", "links": [ "https://github.com/NoiseByNorthwest/php-spx/blob/master/README.md", "https://github.com/NoiseByNorthwest/php-spx/blob/master/config.m4" ] }, { "supplier": "Symfony", "product": "Symfony Console component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP command-line application framework is distributed as an independently installable PHP package.", "links": [ "https://packagist.org/packages/symfony/console" ] }, { "supplier": "Symfony", "product": "Symfony framework", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nThe current Symfony setup guide identifies PHP and six extensions; the official component catalogue and separate manifests distinguish reusable packages from the full framework.", "links": [ "https://symfony.com/doc/current/setup.html", "https://symfony.com/components", "https://packagist.org/packages/symfony/http-foundation" ] }, { "supplier": "Symfony", "product": "Symfony HttpFoundation component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP request, response, session and upload abstractions is distributed as an independently installable PHP package.", "links": [ "https://packagist.org/packages/symfony/http-foundation" ] }, { "supplier": "Symfony", "product": "Symfony HttpKernel component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP HTTP kernel and request/response conversion pipeline is distributed as an independently installable PHP package.", "links": [ "https://packagist.org/packages/symfony/http-kernel" ] }, { "supplier": "Symfony", "product": "Symfony mbstring polyfill", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PHP package provides the ext-mbstring Composer platform capability while implementing a fallback and directly requiring iconv.", "links": [ "https://packagist.org/packages/symfony/polyfill-mbstring" ] }, { "supplier": "Symfony", "product": "Symfony Process component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPHP API for invoking and managing system subprocesses is distributed as an independently installable PHP package.", "links": [ "https://packagist.org/packages/symfony/process" ] }, { "supplier": "Symplify", "product": "Easy Coding Standard PHP style tool", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for symplify/easy-coding-standard 13.3.7 declares PHP >=7.2 for this tool/library.", "links": [ "https://packagist.org/packages/symplify/easy-coding-standard" ] }, { "supplier": "Synology", "product": "Synology PHP 5.6 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP5.6/5.6.40-0131", "https://archive.synology.com/download/Package/PHP5.6" ] }, { "supplier": "Synology", "product": "Synology PHP 7.0 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP7.0/7.0.33-0131", "https://archive.synology.com/download/Package/PHP7.0" ] }, { "supplier": "Synology", "product": "Synology PHP 7.2 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP7.2/7.2.34-0131", "https://archive.synology.com/download/Package/PHP7.2" ] }, { "supplier": "Synology", "product": "Synology PHP 7.3 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP7.3/7.3.33-0173", "https://archive.synology.com/download/Package/PHP7.3" ] }, { "supplier": "Synology", "product": "Synology PHP 7.4 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP7.4/7.4.33-0140", "https://archive.synology.com/download/Package/PHP7.4" ] }, { "supplier": "Synology", "product": "Synology PHP 8.0 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP8.0/8.0.30-0121", "https://archive.synology.com/download/Package/PHP8.0" ] }, { "supplier": "Synology", "product": "Synology PHP 8.1 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP8.1/8.1.34-0110", "https://archive.synology.com/download/Package/PHP8.1" ] }, { "supplier": "Synology", "product": "Synology PHP 8.2 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP8.2/8.2.30-0170", "https://archive.synology.com/download/Package/PHP8.2" ] }, { "supplier": "Synology", "product": "Synology PHP 8.3 archived package family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official archive publishes this named PHP package family and architecture/platform-labelled SPK files.", "links": [ "https://archive.synology.com/download/Package/PHP8.3/8.3.30-0050", "https://archive.synology.com/download/Package/PHP8.3" ] }, { "supplier": "Synology", "product": "Synology PHP 8.4 package distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFresh archive metadata confirms the existing8.4 package identity. It is one of ten PHP branch families, not PHP installed by default throughout DSM.", "links": [ "https://archive.synology.com/download/Package/PHP8.4/8.4.19-0050", "https://archive.synology.com/download/Package/PHP8.4" ] }, { "supplier": "Synology", "product": "Synology Web Station optional PHP hosting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nWeb Station supports separately installed PHP backends and PHP profiles for hosted sites.", "links": [ "https://www.synology.com/en-global/dsm/7.4/software_spec/web_station" ] }, { "supplier": "TeamPass project", "product": "TeamPass", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project identifies a PHP/MySQL credential vault, lists native modules and separates the server from a browser extension.", "links": [ "https://github.com/nilsteampassnet/TeamPass", "https://github.com/nilsteampassnet/TeamPass/blob/master/composer.json" ] }, { "supplier": "TerraMaster", "product": "TerraMaster TOS6 Web Server optional PHP hosting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nThe Web Server guide documents optional PHP instances, virtual-host version selection and configurable extensions.", "links": [ "https://help.terra-master.com/docs/TOS6/application/web-server" ] }, { "supplier": "Textpattern project", "product": "Textpattern CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nTextpattern lists PHP, MySQL and required/optional PHP modules for its 4.9 line.", "links": [ "https://textpattern.com/about/system-requirements", "https://textpattern.com/weblog/textpattern-490-released-php-85-mysql-84-features-fixes-fine-tuning-and-much-more" ] }, { "supplier": "The Cacti Group", "product": "Cacti", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe source manifest and README confirm PHP for the web application and built-in poller, with differing table/develop minima.", "links": [ "https://github.com/Cacti/cacti/blob/develop/composer.json", "https://github.com/Cacti/cacti" ] }, { "supplier": "The PHP Foundation / PHP PIE project", "product": "PHP Installer for Extensions (PIE)", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nThe official README identifies a PHP-based extension installer, distinguishes its PHP execution version from the target, and points to the paginated Packagist extension catalogue.", "links": [ "https://github.com/php/pie", "https://pecl.php.net/", "https://packagist.org/extensions" ] }, { "supplier": "The PHP Group", "product": "PHP BCMath", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nBCMath: Arbitrary precision arithmetic. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP built-in development web server", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official manual documents the CLI SAPI built-in HTTP server and says it is for controlled development/testing use. The server implementation is present in the pinned CLI source.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/php_cli_server.c", "https://www.php.net/manual/en/features.commandline.webserver.php" ] }, { "supplier": "The PHP Group", "product": "PHP Bzip2", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nBzip2: Bzip2 streams, filters and compression. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Calendar", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nCalendar: Calendar and date conversions. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Clang fuzzer SAPI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nThe released fuzzer manifest declares developer harnesses for PHP parser, execution, JIT, serialization and selected extensions.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fuzzer/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP CLI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe pinned PHP source declares the cli SAPI. Built by upstream default unless --disable-cli; jobs may also run in production.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/config.m4", "https://docs.phpunit.de/en/12.5/installation.html" ] }, { "supplier": "The PHP Group", "product": "PHP COM and .NET", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nCOM and .NET: Windows COM automation and native interoperation. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/com_dotnet/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP core and Zend Engine", "version": "", "status_109618": "", "status_109619": "", "notes": "Unversioned PHP runtime family anchor for downstream dependency links; version-scoped affected and fixed runtime variants are recorded separately.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/Zend/zend.c", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/main/main.c", "https://www.php.net/supported-versions.php", "https://www.php.net/archive/2026.php#2026-10-21-5" ] }, { "supplier": "The PHP Group", "product": "PHP core and Zend Engine affected web-serving release scope", "version": ">=5.4.0 before fixed release or vendor backport; supported branches <8.2.35, <8.3.36, <8.4.27, <8.5.12", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected web-serving PHP runtime scope; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older branches require vendor backports or upgrade.\nVersion-scoped PHP runtime variant for affected web-serving releases. PHP says all PHP installations serving web requests are at risk; Calif found affected paths back to PHP 5.4.0.", "links": [ "https://www.php.net/archive/2026.php#2026-10-21-5", "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp", "https://calif.io/php2shell/" ] }, { "supplier": "The PHP Group", "product": "PHP core and Zend Engine fixed upstream releases", "version": "8.5.12, 8.4.27, 8.3.36, 8.2.35", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers\nVersion-scoped PHP runtime variant for the upstream fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.", "links": [ "https://www.php.net/archive/2026.php#2026-10-21-5", "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w", "https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp" ] }, { "supplier": "The PHP Group", "product": "PHP Ctype", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nCtype: Character classification. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP cURL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\ncURL: Outbound URL transfers via libcurl. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Date/Time", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nDate/Time: Date parsing, time zones and timelib. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config0.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP DBA", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nDBA: Database-file handlers and local key-value storage. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP dl_test", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\ndl_test: Dynamic-extension loading test fixture. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP DOM", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nDOM: XML and HTML document manipulation. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Embed SAPI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe released embed build manifest creates a shared or static PHP library for use inside a host application.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/embed/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP Enchant", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nEnchant: Spell-checking provider bridge. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Exif", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nExif: Image metadata parsing. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP FFI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFFI: Native C library and memory interface. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Fileinfo", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFileinfo: File-type and MIME identification. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Filter", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFilter: Validation and sanitization of input values. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP FTP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFTP: FTP client and optional TLS transfer. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP GD", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nGD: Image decode, transform and encode. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Gettext", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nGettext: Translation catalogues and locale messages. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP GMP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nGMP: Multiple-precision arithmetic bridge. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Hash", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nHash: Hashing and compatibility mhash APIs. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Iconv", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nIconv: Character-set conversions. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP IMAP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSelected release notes build fixes for PHP 8.4; package minimum is 8.3.0.", "links": [ "https://pecl.php.net/package/imap/1.0.3", "https://www.php.net/manual/en/migration84.removed-extensions.php", "https://www.php.net/manual/en/imap.installation.php" ] }, { "supplier": "The PHP Group", "product": "PHP Intl", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nIntl: ICU-backed internationalization. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP JSON", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nJSON: JSON parsing and serialization. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP LDAP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nLDAP: LDAP directory client. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Lexbor support bridge", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nLexbor support bridge: Internal PHP glue for HTML and URL parsing. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.w32", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/php_lexbor.c" ] }, { "supplier": "The PHP Group", "product": "PHP Libxml bridge", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nLibxml bridge: PHP integration with libxml-based parsers. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config0.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP LiteSpeed SAPI", "version": "8.5.12, 8.4.27, 8.3.36, 8.2.35", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers\nThe released source contains an LSAPI SAPI, and the PHP manual identifies LiteSpeed integration as bundled PHP.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/litespeed/config.m4", "https://www.php.net/archive/2026.php#2026-10-21-5" ] }, { "supplier": "The PHP Group", "product": "PHP Mbstring", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMbstring: Multibyte conversion and optional regex. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP MySQLi", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMySQLi: MySQL client API through mysqlnd. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Mysqlnd", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nMysqlnd: PHP-native MySQL protocol client. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config9.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP OCI8 extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nRelease states testing with PHP 8.2-8.5 and requires Oracle Client 11.2+.", "links": [ "https://pecl.php.net/package/oci8/3.4.1", "https://www.php.net/manual/en/migration84.removed-extensions.php", "https://www.php.net/manual/en/oci8.installation.php" ] }, { "supplier": "The PHP Group", "product": "PHP ODBC", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nODBC: ODBC database client. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP OPcache", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nOPcache: Bytecode caching and optimization. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.w32", "https://www.php.net/manual/en/migration85.incompatible.php#migration85.incompatible.opcache" ] }, { "supplier": "The PHP Group", "product": "PHP OPcache JIT", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe pinned OPcache manifest has a separate JIT build switch and compiles JIT sources conditionally. The runtime manual exposes opcache.jit controls.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4", "https://www.php.net/manual/en/opcache.configuration.php" ] }, { "supplier": "The PHP Group", "product": "PHP OpenSSL extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nOpenSSL extension: Cryptography and TLS stream integration. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config0.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PCNTL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPCNTL: Process control for CLI and CGI jobs. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcntl/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP PCRE", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPCRE: Regular expressions and PCRE2 integration. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config0.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO: Database API and driver abstraction. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_DBLIB", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO_DBLIB: FreeTDS/DB-Library database client for PDO. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_FIREBIRD", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO_FIREBIRD: Firebird client for PDO. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_MYSQL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO_MYSQL: MySQL client for PDO. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_OCI extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe selected release uses PDO APIs and Oracle Client 11.2+ libraries.", "links": [ "https://pecl.php.net/package/PDO_OCI/1.2.0", "https://www.php.net/manual/en/migration84.removed-extensions.php", "https://pecl.php.net/package/PDO_OCI" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_ODBC", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO_ODBC: ODBC client for PDO. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_PGSQL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO_PGSQL: PostgreSQL client for PDO. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP PDO_SQLITE", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPDO_SQLITE: SQLite-backed database operations for PDO. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Phar", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPhar: Executable and data archive handling. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP phpdbg", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe released phpdbg manifest declares a debugger SAPI; the manual documents PHP debugging and optional remote-console controls.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/phpdbg/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP POSIX", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPOSIX: POSIX identity, process and resource APIs. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/posix/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP PostgreSQL extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPostgreSQL extension: PostgreSQL client API. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Pspell extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSelected PECL release minimum is separate from the PHP 8.4 packaging transition.", "links": [ "https://pecl.php.net/package/pspell/1.0.1", "https://www.php.net/manual/en/migration84.removed-extensions.php", "https://www.php.net/manual/en/pspell.installation.php" ] }, { "supplier": "The PHP Group", "product": "PHP Random", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nRandom: Random-number generation APIs. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Readline", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nReadline: Interactive command-line input. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Reflection", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nReflection: Runtime type and symbol inspection. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Session", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSession: Session identifiers, serialization and storage handlers. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Shmop", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nShmop: Shared-memory segment access. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP SimpleXML", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSimpleXML: XML document access. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP SNMP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSNMP: Network-management protocol client. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP SOAP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSOAP: SOAP client/server and XML message processing. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Sockets", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSockets: Low-level socket API. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Sodium", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSodium: Libsodium cryptography APIs. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP SPL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSPL: Standard PHP Library objects and iterators. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP SQLite3", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSQLite3: SQLite database access. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config0.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Standard functions", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nStandard functions: Core strings, files, streams, URLs and serialization functions. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Sysvmsg", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSysvmsg: System V message queues. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvmsg/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP Sysvsem", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSysvsem: System V semaphores. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvsem/config.m4" ] }, { "supplier": "The PHP Group", "product": "PHP Sysvshm", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nSysvshm: System V shared memory. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Tidy", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nTidy: HTML repair and parsing bridge. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Tokenizer", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nTokenizer: PHP source tokenization. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP URI", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nURI: RFC 3986 and WHATWG URL parsing. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.w32", "https://www.php.net/releases/8.5/en.php" ] }, { "supplier": "The PHP Group", "product": "PHP XML parser", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nXML parser: Event-based XML parsing. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP XMLReader", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nXMLReader: Streaming XML reader. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP XMLWriter", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nXMLWriter: XML output generation. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP XSL", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nXSL: XML stylesheet transformation. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP zend_test", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nzend_test: Zend Engine test hooks and fixtures. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Zip", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nZip: Zip archive parsing and creation. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP Zlib extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nZlib extension: Compressed streams and filters. The released build manifest declares this PHP component.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config0.m4", "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config.w32" ] }, { "supplier": "The PHP Group", "product": "PHP-CGI", "version": "8.5.12, 8.4.27, 8.3.36, 8.2.35", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers\nThe pinned PHP source declares the cgi SAPI. Built by upstream default unless --disable-cgi; downstream packaging may differ.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cgi/config9.m4", "https://www.php.net/manual/en/install.php", "https://www.php.net/archive/2026.php#2026-10-21-5" ] }, { "supplier": "The PHP Group", "product": "PHP-FPM", "version": "8.5.12, 8.4.27, 8.3.36, 8.2.35", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers\nThe pinned PHP source declares the fpm SAPI. Optional --enable-fpm; not evidence of FPM in every PHP build.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fpm/config.m4", "https://www.php.net/manual/en/book.fpm.php", "https://www.php.net/archive/2026.php#2026-10-21-5" ] }, { "supplier": "The PHP Group / Apache operators", "product": "Apache PHP module (mod_php)", "version": "8.5.12, 8.4.27, 8.3.36, 8.2.35", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers\nThe pinned PHP source declares the apache2handler SAPI. Optional --with-apxs2; Apache presence alone does not establish PHP.", "links": [ "https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/apache2handler/config.m4", "https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html", "https://www.php.net/archive/2026.php#2026-10-21-5" ] }, { "supplier": "The PHP Group / PHP Windows maintainers", "product": "Official PHP Windows binary ZIP distribution", "version": "8.5.12, 8.4.27, 8.3.36, 8.2.35", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed upstream Windows binaries are available for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35\nOfficial downloads distinguish NTS/TS roles and list four architecture/thread-safety ZIP choices; the security advisory points users to fixed Windows binaries.", "links": [ "https://www.php.net/downloads.php?os=windows", "https://www.php.net/archive/2026.php#2026-10-21-5", "https://downloads.php.net/~windows/releases/archives/php-8.5.11-nts-Win32-vs17-x64.zip.spdx.json" ] }, { "supplier": "The PHP League", "product": "Flysystem", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nFlysystem supplies a PHP storage abstraction with a separately documented adapter set and distinct require-dev integrations.", "links": [ "https://packagist.org/packages/league/flysystem" ] }, { "supplier": "Thelia project", "product": "Thelia", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official 3.0 guide requires PHP and modules; migration notes distinguish the root application from the lower-level core package floor.", "links": [ "https://doc.thelia.net/docs/3.0/getting-started/installation", "https://doc.thelia.net/docs/3.0/upgrading/migrate" ] }, { "supplier": "thirty development llc / thirty bees project", "product": "thirty bees", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe release/download page gives a PHP-specific build selection and runtime requirements; the repository identifies its PrestaShop 1.6.1.11 fork point.", "links": [ "https://thirtybees.com/download/", "https://github.com/thirtybees/thirtybees/blob/main/README.md" ] }, { "supplier": "Thunder project", "product": "Thunder Drupal distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official FAQ defines Thunder as a Drupal distribution for professional publishers, inheriting the PHP application runtime.", "links": [ "https://www.thunder.org/frequently-asked-questions" ] }, { "supplier": "Tideways / open-source fork contributors", "product": "Tideways XHProf archived native extension fork", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nMaintainer archive notice directs users to PECL XHProf and says this fork is not compatible with the commercial Tideways service.", "links": [ "https://github.com/tideways/php-xhprof-extension" ] }, { "supplier": "Tideways GmbH", "product": "Tideways commercial PHP profiling extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nVendor requirements distinguish the PHP extension from its daemon and describe separate platform and libc scopes.", "links": [ "https://support.tideways.com/documentation/compatibility-and-requirements.html", "https://tideways.com/profiler/downloads" ] }, { "supplier": "Tiki Software Community Association / Tiki project", "product": "Tiki Wiki CMS Groupware", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project documents a PHP 7.4-to-8.1 migration boundary and PHP-dependent Composer libraries.", "links": [ "https://doc.tiki.org/PHP-8" ] }, { "supplier": "Totara", "product": "Totara", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor requires a PHP server and separates supported PHP branches, mandatory modules and recommended modules.", "links": [ "https://totara.help/docs/server-system-requirements" ] }, { "supplier": "TransIP", "product": "TransIP API PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe client declares PHP, json/openssl and HTTP dependencies. A Guzzle adapter and Symfony cache are suggested separately.", "links": [ "https://packagist.org/packages/transip/transip-api-php" ] }, { "supplier": "TransIP", "product": "TransIP shared webhosting PHP option", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nTransIP states its webhosting packages include PHP and documents changing the package's selected version.", "links": [ "https://www.transip.nl/knowledgebase/5987-wil-php-versie-mijn-website-wijzigen" ] }, { "supplier": "Trend Micro", "product": "Apex Central", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nTrend Micro's hotfix readme lists PHP 8.2.33 among Apex Central third-party modules updated to prevent potential vulnerabilities.", "links": [ "https://files.trendmicro.com/documentation/readme/CP/apexcentral_win_en_criticalpatch_b7328_Readme.html" ] }, { "supplier": "Trend Micro", "product": "Apex One", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nTrend Micro's critical-patch readme states that a PHP module is used in Apex One and records an update to PHP 8.2.30.", "links": [ "https://files.trendmicro.com/documentation/readme/Apex%20One/2020/apex_one_2019_win_cp_b20105_EN_hotfix_Readme.html" ] }, { "supplier": "TurnKey Linux", "product": "TurnKey Linux LAMP appliance PHP stack", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe LAMP appliance page includes PHP, CLI tooling and an upstream Composer installation.", "links": [ "https://www.turnkeylinux.org/lamp/" ] }, { "supplier": "TurnKey Linux", "product": "TurnKey Linux LAPP appliance PHP stack", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe LAPP appliance page documents PHP and PostgreSQL client support with Debian-packaged Composer.", "links": [ "https://www.turnkeylinux.org/lapp/" ] }, { "supplier": "TuxCare / CloudLinux", "product": "TuxCare ELS PHP distribution family", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately\nCloudLinux scopes TuxCare PHP ELS as affected by both CVEs and reports several fixed ELS packages, while the broader family remains only partially remediated.", "links": [ "https://docs.tuxcare.com/els-for-runtimes/php/", "https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability", "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5" ] }, { "supplier": "TuxCare / CloudLinux", "product": "TuxCare ELS PHP package for CentOS 8.4", "version": "7.4.6", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS\nCloudLinux reports a fixed TuxCare ELS php-7.4.6 release for CentOS 8.4 ELS.", "links": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "https://docs.tuxcare.com/els-for-runtimes/php/" ] }, { "supplier": "TuxCare / CloudLinux", "product": "TuxCare ELS PHP package for CentOS 8.5", "version": "7.4.19", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS\nCloudLinux reports a fixed TuxCare ELS php-7.4.19 release for CentOS 8.5 ELS.", "links": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "https://docs.tuxcare.com/els-for-runtimes/php/" ] }, { "supplier": "TuxCare / CloudLinux", "product": "TuxCare ELS PHP package for Ubuntu 16.04", "version": "7.0.33", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS\nCloudLinux reports a fixed TuxCare ELS php-7.0.33 release for Ubuntu 16.04 ELS.", "links": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "https://docs.tuxcare.com/els-for-runtimes/php/" ] }, { "supplier": "TuxCare / CloudLinux", "product": "TuxCare ELS PHP package for Ubuntu 18.04", "version": "7.2.24-0", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS\nCloudLinux reports a fixed TuxCare ELS php-7.2.24-0 release for Ubuntu 18.04 ELS.", "links": [ "https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5", "https://docs.tuxcare.com/els-for-runtimes/php/" ] }, { "supplier": "Twig / Symfony community", "product": "Twig template engine", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nTwig compiles templates to PHP; its stable 3.x documentation and the registry default alpha describe distinct compatibility scopes.", "links": [ "https://packagist.org/packages/twig/twig", "https://twig.symfony.com/doc/3.x/intro.html" ] }, { "supplier": "Twilio API Team", "product": "Twilio PHP helper SDK", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe helper SDK declares PHP >=7.1.0; Guzzle is suggested as an HTTP client and appears separately in require-dev.", "links": [ "https://packagist.org/packages/twilio/sdk" ] }, { "supplier": "Twilio SendGrid", "product": "Twilio SendGrid PHP client", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Caller PHP runtime only; CVE match unknown\nThe client declares PHP >=7.3, five extensions, HTTP-client and ECDSA packages; it replaces the sendgrid/sendgrid-php package name.", "links": [ "https://packagist.org/packages/sendgrid/sendgrid" ] }, { "supplier": "TYPO3 project", "product": "TYPO3 13.4", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official 13.4.36 download page publishes a PHP 8.2-8.5 requirement and source-archive checksums. Versioned 13.4 documentation describes required and optional modules.", "links": [ "https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/Installation/SystemRequirements/Index.html", "https://get.typo3.org/version/13" ] }, { "supplier": "UnoPim", "product": "UnoPim", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nThe official UnoPim repository documents a Laravel PIM/DAM platform requiring PHP 8.4.1+, and GitHub exposes an SPDX dependency-graph SBOM for the repository.", "links": [ "https://github.com/unopim/unopim", "https://api.github.com/repos/unopim/unopim/dependency-graph/sbom" ] }, { "supplier": "Upsun", "product": "Upsun PHP application containers", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nUpsun documents managed PHP application runtimes and periodic patch delivery through deployment/maintenance.", "links": [ "https://developer.upsun.com/docs/languages/php" ] }, { "supplier": "Utrecht University / Yoda", "product": "Yoda v1.5 legacy PHP web portal", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nVersion 1.5 notes explicitly document the PHP portal upgrade.", "links": [ "https://utrechtuniversity.github.io/yoda/release-notes/release-1.5.html" ] }, { "supplier": "Uwe Steinmann / SeedDMS project", "product": "SeedDMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe project identifies a PHP-based document-management application with MySQL, SQLite or PostgreSQL and separately publishes two branch families.", "links": [ "https://www.seeddms.org/about/", "https://www.seeddms.org/download/" ] }, { "supplier": "Vance Lucas / Graham Campbell / phpdotenv contributors", "product": "phpdotenv", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe PHP library loads .env configuration and depends on PHP polyfill packages; boolean validation adds an optional filter requirement.", "links": [ "https://packagist.org/packages/vlucas/phpdotenv" ] }, { "supplier": "Vanderbilt University / REDCap Consortium", "product": "REDCap", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients.", "links": [ "https://projectredcap.org/software/requirements/" ] }, { "supplier": "Vardot / Varbase project", "product": "Varbase Drupal distribution", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe guide uses PHP/Composer in DDEV and describes automatic Drupal installation and recipe application.", "links": [ "https://docs.varbase.vardot.com/developers/installing-varbase" ] }, { "supplier": "Virtualmin", "product": "Virtualmin hosted PHP execution modes", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nVirtualmin documents PHP-FPM and FCGId/CGI wrapper execution for customer PHP applications.", "links": [ "https://www.virtualmin.com/docs/server-components/php-execution-modes/" ] }, { "supplier": "VirtueMart project", "product": "VirtueMart", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official description states that Joomla and VirtueMart are PHP applications and distinguishes the component from a preinstalled Joomla bundle.", "links": [ "https://virtuemart.net/component/content/article/what-is-virtuemart?Itemid=144&catid=159" ] }, { "supplier": "VitalPBX", "product": "VitalPBX 4.0 PHP management runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe vendor's4.0.0R4 announcement explicitly records a PHP8.1 upgrade.", "links": [ "https://forums.vitalpbx.org/t/vitalpbx-4-0-0-r4-is-now-available/1863/1" ] }, { "supplier": "VitalPBX", "product": "VitXi server-side PHP component", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe VitXi changelog separately documents PHP8.2 support and later Swoole integration.", "links": [ "https://vitalpbx.com/cbxchangelog/vitxi-v4-5-vitalpbx-4-5/" ] }, { "supplier": "VK / VKCOM KPHP project", "product": "KPHP compiler and native runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Independent engine; no automatic inheritance\nThe architecture separates a compiler, native runtime, HTTP server and development extension.", "links": [ "https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/", "https://vkcom.github.io/kphp/kphp-language/kphp-vs-php/kphp-vs-php-differences.html" ] }, { "supplier": "VK / VKCOM KPHP project", "product": "KPHP vkext development PHP extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nvkext exposes network and TL/RPC functions to PHP for development and is separate from the compiler.", "links": [ "https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/internals-vkext.html", "https://vkcom.github.io/kphp/kphp-basics/installation.html" ] }, { "supplier": "Vtiger", "product": "Vtiger CRM Open Source", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor's Open Source installation FAQ explicitly requires PHP and several modules.", "links": [ "https://help.vtiger.com/article/158054339-Vtiger-Open-Source-FAQs" ] }, { "supplier": "VuFind project / Villanova University", "product": "VuFind", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components.", "links": [ "https://github.com/vufind-org/vufind/blob/dev/composer.json" ] }, { "supplier": "wallabag project", "product": "wallabag", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown\nOfficial wallabag requirements state compatibility with PHP >=7.4 and require PHP-FPM plus extensions.", "links": [ "https://doc.wallabag.org/admin/installation/requirements/" ] }, { "supplier": "WampServer maintainers / Aviatechno", "product": "WampServer Windows development bundle", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe publisher distinguishes the full installer, manager updates and separately downloadable PHP add-ons; Apache/PHP and database administration tools are bundled.", "links": [ "https://wampserver.aviatechno.net/" ] }, { "supplier": "webERP project", "product": "webERP", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions.", "links": [ "https://www.weberp.org/downloads/webERP.Manual.4.15.2.2025-09-03.pdf" ] }, { "supplier": "Webkul", "product": "Bagisto", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5.", "links": [ "https://devdocs.bagisto.com/getting-started/before-you-start.html", "https://devdocs.bagisto.com/getting-started/installation" ] }, { "supplier": "Webkul / UVdesk", "product": "UVdesk Community Helpdesk", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance.", "links": [ "https://github.com/uvdesk/community-skeleton", "https://github.com/uvdesk/community-skeleton/blob/master/composer.json" ] }, { "supplier": "webonyx / GraphQL-PHP project", "product": "webonyx GraphQL-PHP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThis package implements GraphQL in PHP and declares optional AMPHP/ReactPHP integrations separately.", "links": [ "https://packagist.org/packages/webonyx/graphql-php" ] }, { "supplier": "WebPros / cPanel", "product": "cPanel EasyApache 4 / MultiPHP", "version": "EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.cpanel.net/ea4/php/about-php/", "https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/" ] }, { "supplier": "WebPros / cPanel", "product": "cPanel internal PHP for hooks and AppConfig applications", "version": "cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27", "status_109618": "Fix", "status_109619": "Fix", "notes": "CVE assessment: cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP.\nOfficial vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.", "links": [ "https://docs.cpanel.net/knowledge-base/general-systems-administration/cpanel-php/", "https://api.docs.cpanel.net/guides/guide-to-standardized-hooks/guide-to-standardized-hooks-hook-action-code", "https://docs.cpanel.net/whm/development/apps-managed-by-appconfig/", "https://docs.cpanel.net/changelogs/136-change-log/" ] }, { "supplier": "Whirl-i-Gig / CollectiveAccess project", "product": "CollectiveAccess Providence", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools.", "links": [ "https://docs.collectiveaccess.org/providence/user/setup/systemReq" ] }, { "supplier": "WHMCS Ltd.", "product": "WHMCS self-hosted application", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nThe vendor's 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches.", "links": [ "https://docs.whmcs.com/9-0/installation-guide/system-requirements/", "https://docs.whmcs.com/8-13/installation-guide/system-requirements/" ] }, { "supplier": "Wikimedia / MediaWiki Platform maintainers", "product": "Excimer native PHP interrupting timer and sampling profiler", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nPublisher PIE metadata identifies a C php-ext package; a fixed project-document revision explains the registry transition.", "links": [ "https://packagist.org/packages/wikimedia/excimer", "https://pecl.php.net/package/excimer/1.2.6", "https://www.mediawiki.org/w/index.php?oldid=8546270&title=Excimer" ] }, { "supplier": "Wikimedia / MediaWiki project", "product": "Parsoid PHP", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nParsoid is a PHP library converting wikitext and HTML; the older JavaScript implementation is explicitly historical.", "links": [ "https://www.mediawiki.org/wiki/Parsoid" ] }, { "supplier": "Wikimedia Foundation", "product": "Wikimedia MediaWiki application-server PHP tier", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nWikimedia documents MediaWiki request execution through PHP-FPM.", "links": [ "https://wikitech.wikimedia.org/wiki/Application_servers", "https://www.mediawiki.org/wiki/Compatibility/en" ] }, { "supplier": "Winter CMS project", "product": "Winter CMS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork.", "links": [ "https://wintercms.com/docs/v1.2/docs/setup/installation", "https://wintercms.com/en/", "https://wintercms.com/blog/post/we-have-forked-october-cms" ] }, { "supplier": "WoltLab GmbH", "product": "WoltLab Suite", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases.", "links": [ "https://manual.woltlab.com/en/requirements/", "https://manual.woltlab.com/en/php-compatibility/" ] }, { "supplier": "WooCommerce", "product": "WooCommerce", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe vendor distinguishes its recommended PHP stack from a still-compatible legacy floor and names optional integration requirements.", "links": [ "https://woocommerce.com/document/server-requirements/" ] }, { "supplier": "WooCommerce", "product": "WooCommerce PayPal Payments", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official plugin listing requires installed WooCommerce and PHP to connect a merchant store to PayPal.", "links": [ "https://wordpress.org/plugins/woocommerce-paypal-payments/" ] }, { "supplier": "WooCommerce", "product": "WooCommerce Stripe Payment Gateway", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe publisher-controlled plugin listing explicitly requires PHP for the WooCommerce Stripe integration.", "links": [ "https://wordpress.org/plugins/woocommerce-gateway-stripe/" ] }, { "supplier": "WooCommerce", "product": "WooPayments merchant plugin", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official develop header labels version 11.2.0 and declares PHP 7.4, alongside separate WooCommerce and WordPress prerequisites. This corroborates registry metadata, not a verified release archive.", "links": [ "https://github.com/Automattic/woocommerce-payments/blob/develop/woocommerce-payments.php", "https://wordpress.org/plugins/woocommerce-payments/", "https://github.com/Automattic/woocommerce-payments/blob/develop/readme.txt" ] }, { "supplier": "WordPress Playground contributors", "product": "PHP.wasm browser platform adapter", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe web adapter selects a browser-specific compiled PHP package.", "links": [ "https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/" ] }, { "supplier": "WordPress Playground contributors", "product": "PHP.wasm Node.js platform adapter", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe Node adapter loads version-specific compiled PHP packages.", "links": [ "https://developer.wordpress.org/playground/developers/local-development/php-wasm-node/", "https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/" ] }, { "supplier": "WordPress Playground contributors", "product": "PHP.wasm universal JavaScript API", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe universal package supplies the shared API without choosing a platform-specific PHP binary.", "links": [ "https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/" ] }, { "supplier": "WordPress Playground contributors", "product": "WordPress Playground browser and local runtime", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nPlayground uses a WebAssembly build of the PHP interpreter to run WordPress.", "links": [ "https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/" ] }, { "supplier": "WordPress Playground contributors", "product": "WordPress Playground PHP.wasm binary family", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP Wasm scope; CVE match unknown\nThe architecture compiles the PHP interpreter to WebAssembly rather than reimplementing it in JavaScript.", "links": [ "https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/", "https://github.com/WordPress/wordpress-playground/blob/trunk/packages/php-wasm/universal/src/lib/supported-php-versions.ts" ] }, { "supplier": "WordPress project", "product": "WordPress", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.\nCurrent WordPress requirements recommend PHP 8.3+ and allow legacy PHP 7.4+. The Hosting Handbook distinguishes required JSON/mysqli from recommended modules.", "links": [ "https://wordpress.org/about/requirements/", "https://make.wordpress.org/hosting/handbook/server-environment/" ] }, { "supplier": "WP Engine", "product": "WP Engine managed WordPress PHP hosting", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Hosted PHP option; CVE match unknown\nWP Engine's guide documents PHP environment selection, staged version availability and forced EOL upgrades with a legacy exception.", "links": [ "https://wpengine.com/support/php-guide/" ] }, { "supplier": "WP-CLI / WordPress project", "product": "WP-CLI WordPress administration framework", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Dev/CI/admin scope; CVE match unknown\nPublisher metadata for wp-cli/wp-cli v2.12.0 declares PHP ^5.6 \\", "links": [] }, { "supplier": "X-Cart", "product": "X-Cart 5", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe versioned developer page requires PHP 8.3-8.4, lists runtime extensions and separately recommends Xdebug for development.", "links": [ "https://developer.x-cart.com/getting_started/requirements" ] }, { "supplier": "Xdebug / Derick Rethans and contributors", "product": "Xdebug PHP Zend instrumentation extension", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nXdebug documents loading its Zend extension into the chosen PHP SAPI configuration.", "links": [ "https://xdebug.org/docs/install", "https://xdebug.org/docs/compat" ] }, { "supplier": "Xdebug / vscode-php-debug contributors", "product": "VS Code PHP Debug adapter external PHP/Xdebug integration", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Optional PHP path; CVE match unknown\nThe debug-adapter descriptor uses node and out/phpDebug.js. Official README describes Xdebug connections, PHP CLI launch and built-in PHP web-server launch.", "links": [ "https://github.com/xdebug/vscode-php-debug/blob/main/package.json", "https://github.com/xdebug/vscode-php-debug" ] }, { "supplier": "XenForo Ltd", "product": "XenForo", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nVendor documentation identifies PHP web-server requirements, GD JPEG support and a PHP CLI command interface.", "links": [ "https://docs.xenforo.com/devs" ] }, { "supplier": "XigmaNAS project", "product": "XigmaNAS bundled PHP components", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nXigmaNAS lists PHP and PHP-based administration tools among software used.", "links": [ "https://www.xigmanas.com/wiki/doku.php?id=features" ] }, { "supplier": "YetiForce S.A.", "product": "YetiForce CRM", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 7.x guide identifies PHP, mandatory modules and optional/integration-specific libraries.", "links": [ "https://doc.yetiforce.com/en/introduction/requirements/", "https://github.com/YetiForceCompany/YetiForceCRM", "https://github.com/YetiForceCompany/YetiForce" ] }, { "supplier": "Yii Software / Yii project", "product": "Yii 2 framework", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nYii 2 release metadata declares a server PHP framework and separately lists lib-pcre and browser asset packages.", "links": [ "https://packagist.org/packages/yiisoft/yii2" ] }, { "supplier": "Yii Software / Yii project", "product": "Yii Web extension abandoned prototype", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: Historical scope; current use unknown\nThe package registry explicitly marks this old PHP web extension abandoned and recommends yiisoft/yii-middleware instead.", "links": [ "https://packagist.org/packages/yiisoft/yii-web" ] }, { "supplier": "YOURLS project", "product": "YOURLS", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe official project explicitly describes PHP scripts providing self-hosted URL shortening, statistics and plugins.", "links": [ "https://github.com/YOURLS/YOURLS" ] }, { "supplier": "Zabbix", "product": "Zabbix web frontend", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nThe 7.4 guide identifies the PHP frontend, its PHP version range and conditional authentication/database modules separately from native server/proxy/agent requirements.", "links": [ "https://www.zabbix.com/documentation/7.4/en/manual/installation/frontend", "https://www.zabbix.com/documentation/7.4/en/manual/installation/requirements" ] }, { "supplier": "Zen Cart project", "product": "Zen Cart", "version": "", "status_109618": "Vulnerable", "status_109619": "Vulnerable", "notes": "CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.\nOfficial requirements distinguish core release compatibility, the 1.5.8 installer exception and extension introduction dates.", "links": [ "https://docs.zen-cart.com/user/first_steps/server_requirements/" ] }, { "supplier": "ZoneMinder project", "product": "ZoneMinder PHP web and API components", "version": "", "status_109618": "Investigation", "status_109619": "Investigation", "notes": "CVE assessment: PHP relationship confirmed; CVE match unknown\nThe official packaging spec separately declares PHP dependencies for web frontends.", "links": [ "https://github.com/ZoneMinder/zoneminder/blob/master/distros/redhat/zoneminder.spec" ] } ] }