0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Cachet project | Cachet | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown The official Cachet repository requires PHP 8.3 or later for the self-hosted status page system, and GitHub exposes an SPDX dependency-graph SBOM for the repository. |
source 1 source 2 |
|
| CakePHP project | CakePHP framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. CakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages. |
source | |
| Canonical / Ubuntu package maintainers | Ubuntu Bionic php7.2-fpm binary package | 7.2.24-0ubuntu0.18.04.17+esm14 | Fix | Fix | CVE assessment: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 with Ubuntu Pro. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Focal php7.4-fpm binary package | 7.4.3-4ubuntu2.29+esm5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 with Ubuntu Pro. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Jammy php8.1-fpm binary package | 8.1.2-1ubuntu2.28 | Fix | Fix | CVE assessment: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Jammy php8.1-fpm 8.1.2-1ubuntu2.28. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Noble php8.3-fpm binary package | 8.3.6-0ubuntu0.24.04.13 | Fix | Fix | CVE assessment: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13. |
source 1 source 2 |
| Canonical / Ubuntu package maintainers | Ubuntu optional PHP package and SAPI family | Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows. USN-8948-1 supplies fixes for the listed Ubuntu Apache-module, CGI, CLI and FPM packages; separately inventoried FPM rows also retain USN-8948-2 release and entitlement scope. |
source 1 source 2 source 3 source 4 |
| Canonical / Ubuntu package maintainers | Ubuntu Resolute php8.5-fpm binary package | 8.5.4-0ubuntu1.5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Resolute php8.5-fpm 8.5.4-0ubuntu1.5. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Stonking php8.5-fpm binary package | 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Stonking php8.5-fpm 8.5.9-0ubuntu2.1. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Trusty php5-fpm binary package | 5.5.9+dfsg-1ubuntu4.29+esm18 | Fix | Fix | CVE assessment: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 with Ubuntu Pro Legacy Support. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Xenial php7.0-fpm binary package | 7.0.33-0ubuntu0.16.04.16+esm22 | Fix | Fix | CVE assessment: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 with Ubuntu Pro Legacy Support. |
source |
| CaptainHook / Sebastian Feldmann and contributors | CaptainHook PHP Git-hook manager | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for captainhook/captainhook 5.29.2 declares PHP >=8.0 for this tool/library. |
source | |
| CarbonPHP project | Carbon date/time library | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Carbon is a PHP DateTime API library with translation, clock and polyfill dependencies. |
source | |
| Catalyst IT / Mahara project | Mahara | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement. |
source 1 source 2 |
|
| Centreon | Centreon Web and central-server PHP interface | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor installation procedure explicitly enables PHP 8.2 for the central web environment. |
source 1 source 2 |
|
| Chamilo Association / Chamilo project | Chamilo | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced. |
source | |
| Check Point | Check Point firewall web interfaces | Force/Cloud: R81.20, R82, R82.10, R82.20; EoS R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10. Spark: R81.10.x, R82.00.x; EoS R77.20.x, R80.20.x | Vulnerable | Vulnerable | CVE assessment: Check Point sk1000302 identifies listed Force, Spark and Cloud Firewall web interfaces as affected when specified portal or VPN features are enabled; Jumbo Hotfix fixes are planned for 2026-11-11. Check Point sk1000302 identifies both CVEs as affecting listed Force, Spark and Cloud Firewall web interfaces only when specified portal or VPN features are enabled; Check Point Portal and SaaS services are already patched. |
source |
| Checkmk GmbH | Checkmk Appliance | 1.7.25 | Fix | Fix | CVE assessment: Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update Checkmk's appliance 1.7.25 release manifest upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release for both php2shell CVEs. |
source 1 source 2 source 3 |
| CIRCL, Luxembourg | CIRCL-operated MISP threat-sharing service | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown CIRCL publicly states it operates multiple MISP instances; MISP's server PHP relationship is independently documented. |
source 1 source 2 |
|
| CircleCI | CircleCI cimg/php CI runtime image family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown CircleCI states each cimg/php tag contains PHP and Composer for CI jobs. |
source 1 source 2 |
|
| Cisco | AppDynamics On-Premises Secure Application | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | AppDynamics PHP Agent | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | AppDynamics SaaS Secure Application | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco AI Defense (hybrid on-premises deployment) | Not vuln | Not vuln | Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco AI Defense (hybrid on-premises deployment) as not vulnerable to CVE-2026-109618 and CVE-2026-109619. | source | |
| Cisco | Cisco ASR 5000 Series Software (StarOS) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Business Process Automation (BPA) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Catalyst Center (formerly DNA Center) | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists Catalyst Center (formerly DNA Center) as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco Catalyst SD-WAN Manager | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco CX Cloud | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists CX Cloud as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco Defense Orchestrator | Security Cloud Control - Firewall Management (formerly Defense Orchestrator) | Not vuln | Not vuln | CVE assessment: Cisco confirms Security Cloud Control - Firewall Management, formerly Cisco Defense Orchestrator, is not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Expressway Select Series | Expressway Select Series; affected release range not specified | Vulnerable | Vulnerable | CVE assessment: Cisco lists Expressway Select Series as vulnerable under CSCwx37062. The listed 15.5.21 fix has a TBD availability date and is not a confirmed released fix. Monitor CSCwx37062 for an available fixed release; Cisco lists no workaround. |
source |
| Cisco | Cisco Expressway Series | Expressway Series; affected release range not specified | Vulnerable | Vulnerable | CVE assessment: Cisco lists Expressway Series as vulnerable under CSCwx37062. The listed 15.5.21 fix has a TBD availability date and is not a confirmed released fix. Monitor CSCwx37062 for an available fixed release; Cisco lists no workaround. |
source |
| Cisco | Cisco Hypershield | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Identity Services Engine (ISE) | ISE; excludes separately investigated ISE Portal Builder | Not vuln | Not vuln | CVE assessment: Cisco confirms ISE is not vulnerable. ISE Portal Builder remains separately under investigation; that component is not covered by this conclusion. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Identity Services Engine (ISE) Portal Builder | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists Identity Services Engine (ISE) Portal Builder as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco IoT Control Center | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists IoT Control Center as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco Meraki Dashboard | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists Meraki Dashboard as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco Multicloud Defense | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Nexus Dashboard Insights | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Panoptica | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Investigation retained: Cisco Panoptica appeared under investigation in advisory version 1.1 but is absent from the explicit version 1.4 status lists. |
source | |
| Cisco | Cisco Policy Suite (CPS) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Secure Access | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Secure Email Threat Defense | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Ultra Cloud Core - Converged Policy and Charging | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists Ultra Packet Core - Converged Policy and Charging as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco Ultra Cloud Core - Policy Control Function | PCF / SMI scope named under Ultra Packet Core in the advisory | Not vuln | Not vuln | CVE assessment: Cisco confirms the named PCF and SMI products are not vulnerable; the advisory uses Ultra Packet Core naming for these Ultra Cloud Core components. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source 1 source 2 |
| Cisco | Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure | PCF / SMI scope named under Ultra Packet Core in the advisory | Not vuln | Not vuln | CVE assessment: Cisco confirms the named PCF and SMI products are not vulnerable; the advisory uses Ultra Packet Core naming for these Ultra Cloud Core components. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source 1 source 2 |
| Cisco | Cisco Ultra-Reliable Wireless Backhaul (URWB) | URWB; affected release range not specified | Vulnerable | Vulnerable | CVE assessment: Cisco lists URWB as vulnerable under CSCwx37073 and requires an authenticated administrator for exploitation. Release 27.1.1 is only estimated for February 2027, not an available fix. Monitor CSCwx37073 for an available fixed release; do not treat its estimated date as released software. |
source |
| Cisco | Cisco Umbrella | Not vuln | Not vuln | Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco Umbrella as not vulnerable to CVE-2026-109618 and CVE-2026-109619. | source | |
| Cisco | Cisco Unified Industrial Wireless Software | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists Unified Industrial Wireless Software as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco Vulnerability Management (formerly Kenna.VM) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco WAN Automation Engine (WAE) | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists WAN Automation Engine (WAE) as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Cisco+ Secure Connect | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Slido | Investigation | Investigation | CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability. Cisco advisory cisco-sa-php-october26-Jj384Daq lists Slido as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Cisco | Webex | Webex Meetings, Webex Teams and Webex Web SDK only | Not vuln | Not vuln | CVE assessment: Cisco explicitly confirms Webex Meetings, Teams and Web SDK are not vulnerable. This assessment is limited to those named offerings, not every Webex-branded product. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Citrix / NetScaler | Citrix NetScaler ADC and Citrix NetScaler Gateway | All supported NetScaler software versions impacted; fixed PHP package pending | Vulnerable | Vulnerable | CVE assessment: CTX697263 lists Citrix NetScaler ADC and Citrix NetScaler Gateway as impacted. NetScaler Product Security scopes the PHP exposure to the NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI, says all supported NetScaler software versions are impacted, and says a fixed PHP package is pending. Citrix NetScaler Console and NetScaler SVM are excluded. Official vendor assessment: CTX697263 lists Citrix NetScaler ADC and Citrix NetScaler Gateway as impacted by CVE-2026-109618 and CVE-2026-109619; fixed PHP package pending for the PHP-based NetScaler Management Portal. |
source 1 source 2 source 3 source 4 |
| CiviCRM project | CiviCRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Publisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release's direct manifest. |
source 1 source 2 |
|
| ClassicPress project | ClassicPress | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files. |
source 1 source 2 |
|
| Clever Cloud fork of Caucho Technology Quercus | Quercus CleverCloud development branch | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The branch maintainer identifies a Java PHP implementation copied from Caucho Quercus/Resin. |
source | |
| Clientexec | Clientexec | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown Official Clientexec system requirements list PHP runtime support for Clientexec 6.x and 7.x plus required extensions and ionCube Loader versions. |
source | |
| Cloudflare | Cloudflare Pages v1 legacy PHP build image | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The build-image page retains a legacy PHP row and separately dates v1 migration to v3 before this retrieval. |
source | |
| CloudLinux | CloudLinux ea-PHP fixed packages for CloudLinux 7-10 | ea-php52 through ea-php85: vendor fixed build matrix released 2026-10-21 20:55 UTC (EL7/8/9/10) | Fix | Fix | CVE assessment: CloudLinux confirms fixed ea-php52 through ea-php85 packages in stable for EL7/8/9/10. Use the exact vendor package revisions, not the upstream PHP number alone: for example ea-php84 8.4.26-2.elX.cloudlinux.1 contains both fixes. CL6 and other platforms are not included in this fixed scope. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| CloudLinux | CloudLinux legacy ea-PHP extended-support packages | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: CloudLinux confirms released ea-php52 through ea-php85 security builds for EL7/8/9/10, recorded in PHP-0744. The historical family includes CloudLinux 6, which is not covered by this fixed matrix. Unpatched builds remain affected; upstream PHP version numbers alone cannot identify the vendor backport. CloudLinux has released fixed ea-PHP builds for EL7/8/9/10; the historical broader platform scope is retained separately. |
source 1 source 2 source 3 |
| CloudLinux / TuxCare | CloudLinux Alt-PHP / PHP Selector runtime family | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: CloudLinux confirms fixed Alt-PHP packages for the listed CloudLinux 7-10 and Ubuntu 22.04 branch combinations; these are recorded in PHP-0743. The broad family remains Vulnerable for unpatched runtimes; the notice does not establish fixed coverage for CloudLinux 6 or every unlisted platform/branch combination. CloudLinux has released additional platform-specific Alt-PHP fixes, recorded separately without extending them to unlisted platforms. |
source 1 source 2 source 3 |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 7.4 fixed package set | Fix | Fix | CVE assessment: Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04 CloudLinux reports fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, 18.04, 22.04, 24.04 and 26.04. |
source | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23 | Fix | Fix | CVE assessment: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23 CloudLinux reports a fixed alt-php80 release for Alpine Linux 3.23. |
source | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP fixed packages for CloudLinux 7-10 and Ubuntu 22.04 | Stable security builds released 2026-10-21/22; CL8/9 PHP 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 also released 2026-10-23 | Fix | Fix | CVE assessment: CloudLinux confirms fixed alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5 for CL7/8/9; Ubuntu 22.04 covers 5.2, 5.6, 7.0-7.4 and 8.0-8.5. CL10 has fixed 5.2 in stable and other branches through ELS ALT PHP. CL8/9 also have new upstream-number builds for 8.2-8.5. CL6 and unlisted platform/branch combinations are excluded. Check backport revisions and changelogs. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| Code LTS / William Desportes and contributors | Doctum PHP API documentation generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for code-lts/doctum v5.6.0 declares PHP ^8.1 for this tool/library. |
source | |
| Codeception / Michael Bodnarchuk and contributors | Codeception PHP test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for codeception/codeception 5.3.7 declares PHP ^8.2 for this tool/library. |
source | |
| CodeIgniter Foundation | CodeIgniter 4 framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific. |
source | |
| Combodo | iTop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official application manifest declares a bounded PHP runtime requirement separately from development packages. |
source | |
| Composer / Packagist project | Packagist.org open-source web application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation. |
source 1 source 2 |
|
| Composer / Satis maintainers | Satis Composer repository generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for composer/satis 1.0.0 legacy tag declares PHP ^5.6 || ^7.0 for this tool/library. |
source 1 source 2 |
|
| Composer / Satis maintainers | Satis official PHP container build recipe | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official Dockerfile uses a Composer build stage and PHP8.4 CLI final runtime. |
source | |
| Composer project | Composer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Composer itself runs on PHP, while its platform model describes PHP, ext-* and lib-* requirements separately from the project packages it manages. |
source 1 source 2 |
|
| Composer project / Docker Official Images | Composer default Docker runtime image | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The pinned recipe installs Composer 2.10.3 into a PHP8 Alpine runtime stage, makes default inherit it, and separately defines a scratch standalone-binary stage. |
source 1 source 2 source 3 |
|
| Concrete CMS / PortlandLabs | Concrete CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Concrete states that it is primarily written in PHP and gives a per-release PHP compatibility table. |
source | |
| Contao project | Contao CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions. |
source | |
| Contao project | Contao Manager | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Contao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation. |
source | |
| Coolify | Coolify | Coolify 4.0.1 / 4.1.3 / 4.2.1 / 4.3.24 / 4.4.7 on their respective v4 lines | Fix | Fix | CVE assessment: Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| Corporation for Digital Scholarship / Omeka project | Omeka Classic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project provides version-specific PHP requirements and separately requires ImageMagick for image resizing. |
source | |
| Corporation for Digital Scholarship / Omeka project | Omeka S | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends. |
source | |
| Couchbase, Inc. | Couchbase native PHP SDK extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Version 4.5.0 is a PHP client extension. Vendor notes update its native C++ core to 1.3.1 and drop PHP 8.1 support despite the registry minimum. |
source 1 source 2 source 3 source 4 |
|
| Couchbase, Inc. | Couchbase PHP Composer SDK package | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The 4.5.0 userland package requires JSON; sockets is require-dev, while gRPC/Protobuf are suggestions. |
source 1 source 2 |
|
| Couchbase, Inc. | Couchbase PHP OpenTelemetry integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown The integration requires PHP>=8.2, couchbase/couchbase^4.5, open-telemetry/api^1.0 and exporter-otlp^1.4. |
source | |
| Craft CMS / Pixel & Tonic | Craft CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Craft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line. |
source | |
| Crater Invoice | Crater | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown The official Crater repository identifies an invoicing application and its installer config sets a minimum PHP version of 7.4.0; GitHub exposes an SPDX dependency-graph SBOM for the repository. |
source 1 source 2 |
|
| CS-Cart | CS-Cart and Multi-Vendor | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor. |
source | |
| CyberPanel project | CyberPanel hosted PHP / LSPHP options | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown CyberPanel's official README advertises selectable PHP families for hosted applications. |
source 1 source 2 |