0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Backdrop CMS project | Backdrop CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Backdrop requires PHP and documents a Drupal 7 upgrade path; OpenSSL is recommended and required by Update Manager. |
source 1 source 2 |
|
| bbPress community / WordPress project | bbPress | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official plugin listing gives PHP and WordPress requirements for the optional server-side forum plugin. |
source | |
| Behat project | Behat behavior-driven test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for behat/behat v4.0.0 declares PHP >=8.2 <8.6 for this tool/library. |
source | |
| Belnet | Belnet FileSender research/education service | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Belnet documents a FileSender service for federation members. |
source 1 source 2 |
|
| Ben Ramsey / Ramsey project | Ramsey UUID | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP UUID package uses PHP math/collection dependencies and suggests native modules only for selected acceleration or generator paths. |
source | |
| Beyond Code in partnership with Laravel | Laravel Herd managed native PHP environment | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Herd describes a native PHP stack without containers; Windows documentation distinguishes shipped tools from downloaded PHP binaries. |
source 1 source 2 |
|
| Blackfire / Platform.sh SAS doing business as Upsun | Blackfire deterministic PHP Probe native extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Official docs identify the deterministic PHP probe as a C extension, separate from the agent and browser client. |
source 1 source 2 source 3 |
|
| Blackfire / Platform.sh SAS doing business as Upsun | Blackfire PHP SDK client library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The publisher registry identifies a PHP SDK with separate suggested ext-blackfire and ext-zlib capabilities. |
source 1 source 2 |
|
| Bolt CMS project | Bolt CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Bolt 5.2 documentation explicitly requires PHP and lists core and optional PHP modules. |
source | |
| BookStack project | BookStack | Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports | Fix | Fix | CVE assessment: BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStack code alone is insufficient. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Box / Humbug project | Box PHAR build and packaging tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for humbug/box 4.7.0 declares PHP ^8.2 for this tool/library. |
source | |
| BoxBilling project | BoxBilling | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The archived project explicitly identifies PHP/MySQL runtime requirements and directs readers to the separately maintained FOSSBilling fork. |
source | |
| Bref project | Bref PHP Lambda runtime layers | Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115 | Fix | Fix | CVE assessment: Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded Bref confirms patched Bref 3 and Bref 2 PHP Lambda layers are published in all regions; update selected layer versions and redeploy. |
source 1 source 2 source 3 |
| Bref project | Bref PHP serverless application adapter | bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers | Fix | Fix | CVE assessment: Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 |
| Bref project | Bref v2 PHP Docker images | Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27 | Fix | Fix | CVE assessment: Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched Bref confirms published patched v2 Docker images for PHP 8.2 through 8.4; rebuild derived images with fresh base layers and redeploy. |
source 1 source 2 source 3 |
| Broadcom | Carbon Black App Control Server | Broadcom ESG advisory 39404 affected product scope | Vulnerable | Vulnerable | CVE assessment: Broadcom ESG advisory 39404 lists Carbon Black App Control Server under Affected Product(s) for both PHP2Shell CVEs; the umbrella advisory does not state affected or fixed releases. Broadcom ESG advisory 39404 lists Carbon Black App Control Server under Affected Product(s) for CVE-2026-109618 and CVE-2026-109619; the umbrella advisory does not state fixed releases. |
source |
| Broadcom | CloudSOC Cloud Access Security Broker (CASB) | Broadcom ESG advisory 39404 under-investigation product scope | Investigation | Investigation | CVE assessment: Broadcom ESG advisory 39404 lists CloudSOC Cloud Access Security Broker (CASB) and Content Analysis as under investigation for both PHP2Shell CVEs; affected and fixed releases are not published. Broadcom ESG advisory 39404 lists CloudSOC Cloud Access Security Broker (CASB) as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source |
| Broadcom | Content Analysis | Broadcom ESG advisory 39404 under-investigation product scope | Investigation | Investigation | CVE assessment: Broadcom ESG advisory 39404 lists CloudSOC Cloud Access Security Broker (CASB) and Content Analysis as under investigation for both PHP2Shell CVEs; affected and fixed releases are not published. Broadcom ESG advisory 39404 lists Content Analysis as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source |
| Broadcom | Symantec Endpoint Protection Manager (SEPM) | 14.3.27716.10000 / 14.4.494.0000 | Fix | Fix | CVE assessment: The maintainer accepts issue #30's reported SEPM 14.3.27716.10000 and 14.4.494.0000 updates as fixes for both PHP2Shell CVEs. The report cites Broadcom advisory 39421, which requires login and was not independently verified. Fix status applies only to these two builds. Fix status is limited to SEPM 14.3.27716.10000 and 14.4.494.0000, as reported in issue #30 and accepted by the maintainer. Product-specific advisory 39421 requires login and was not independently verified; older releases and deployed installations are not marked fixed. |
source 1 source 2 source 3 |
| BuddyPress community / WordPress project | BuddyPress | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Trac r14231 bumps the 14.0 branch to 14.5.2 while retaining the PHP 5.6 declaration. The current plugin listing frames 7.4 as a hosting recommendation, clarifying the earlier apparent floor conflict. |
source 1 source 2 |
|
| bunq | bunq PHP API SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The vendor SDK declares PHP compatibility, curl/json/mbstring, Guzzle and a Composer plugin API constraint. |
source |