0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| daloRADIUS project | daloRADIUS official Docker distribution recipe | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official Dockerfile declares an Apache PHP package stack separately from the application. |
source | |
| daloRADIUS project | daloRADIUS PHP web management application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. daloRADIUS describes its PHP web application and current PDO database integration. |
source | |
| Dan Phillimore / Uniter project | Uniter PHP-to-JavaScript runtime stack | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance Uniter combines JavaScript parser, transpiler and runtime components to run PHP code. |
source | |
| Datadog / Blackfire integration | Blackfire PHP continuous-profiler integration using Datadog profiling extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The guide loads datadog-profiling.so from a PHP_API_VERSION-specific path, separate from the deterministic Blackfire probe. |
source 1 source 2 |
|
| DDEV project | DDEV PHP webserver development container | DDEV 1.25.4 AMD64 project images rebuilt with PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: DDEV confirms tested AMD64 project-image rebuilds that install fixed PHP packages, including a package upgrade for bundled PHP 8.2-8.5. This is not a claim that stock 1.25.4 images or ARM64 images are fixed, or that planned 1.25.5 has shipped. Follow DDEV's documented AMD64 PHP package-upgrade and no-cache rebuild procedure and verify the runtime. Public casual hosting and ddev share require patching; local-only exposure is treated separately by DDEV. |
source 1 source 2 |
| Debian PHP Maintainers | Debian trixie PHP 8.4 FPM package | 8.4.27-1~deb13u1 | Fix | Fix | CVE assessment: Fixed in Debian trixie php8.4 8.4.27-1 Debian DSA-6574-1 fixes CVE-2026-109618 and CVE-2026-109619 in trixie php8.4 8.4.27-1 |
source 1 source 2 |
| Delta Controls | enteliWEB building management system | enteliWEB 4.29 or newer with SecB0015 security patch applied | Fix | Fix | CVE assessment: Delta Controls publishes an enteliWEB security patch for 4.29 and newer. Versions 4.28 and older must upgrade first and then apply the patch; an unpatched 4.29 installation is not fixed. Upgrade older enteliWEB installations to 4.29 or newer, then apply the security patch. Keep exposure restrictions until patched; controller firmware is outside this product row. |
source 1 source 2 |
| Deployer / Anton Medvedev and contributors | Deployer PHP deployment automation | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for deployer/deployer v8.0.5 declares PHP ^8.3 for this tool/library. |
source | |
| DEVSENSE / Phalanger project | Phalanger PHP 5.4 compiler for .NET/Mono | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The archived repository identifies a PHP 5.4 implementation and its PeachPie succession. |
source | |
| Docker Community / Docker Official Images, not WordPress upstream image ownership | WordPress Docker Official Image distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The packaging template derives from official PHP images and installs WordPress-serving native extensions; the repository identifies Docker Community ownership. |
source 1 source 2 |
|
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP Apache/mod_php image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified The official guide identifies the Apache variant as PHP loaded into Apache; the tag manifest lists Debian trixie and bookworm builds. |
source 1 source 2 source 3 source 4 |
|
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP CLI image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified The tag manifest lists patched stable CLI build directories; the selected Alpine recipe sets PHP_VERSION 8.5.12. |
source 1 source 2 source 3 source 4 |
|
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP FPM image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified The immutable trixie recipe starts from debian:trixie-slim, disables CGI and enables FPM. |
source 1 source 2 source 3 source 4 |
|
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP ZTS image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified The immutable trixie recipe enables ZTS, embed and phpdbg. The manifest groups four OS build directories under ZTS tags. |
source 1 source 2 source 3 source 4 |
|
| Docker Official Images maintainers | Docker Official Image: php | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified Official Docker PHP source definitions and official-images metadata reference patched stable PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed image digests still need verification. |
source 1 source 2 source 3 source 4 source 5 source 6 |
|
| Doctrine project | Doctrine DBAL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown DBAL is a PHP database abstraction layer; official configuration documents alternative native-extension drivers and custom driver classes. |
source 1 source 2 |
|
| Doctrine project | Doctrine ORM | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP ORM release requires DBAL and other PHP packages; database extension choice is inherited from the chosen driver graph, not universal PDO presence. |
source | |
| DokuWiki project | DokuWiki official Docker distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The Dockerfile starts from php:8.4-apache, allows optional PHP_EXTENSIONS build arguments and creates the DokuWiki image. |
source 1 source 2 |
|
| DokuWiki project / splitbrain | DokuWiki | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official manifest requires PHP and suggests mbstring for performance and intl for locale-aware sorting. |
source | |
| Dolibarr project | Dolibarr ERP CRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official release compatibility table supplies version-specific PHP boundaries; the repository identifies a PHP web application with JavaScript enhancements. |
source 1 source 2 |
|
| Drupal Commerce / Centarro | Drupal Commerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official module project explicitly depends on Drupal, separates 3.x/2.x/1.x core lineages and lists its current release. |
source | |
| Drupal project | Drupal | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: The Drupal Association confirms that unpatched Drupal sites were exposed to both PHP CVEs and directs site owners to update PHP. The fix is in the hosting runtime, not a Drupal application release. The Drupal Association confirms that unpatched Drupal sites were exposed to both PHP CVEs and directs site owners to update PHP. The fix is in the hosting runtime, not a Drupal application release. |
source 1 source 2 source 3 source 4 source 5 source 6 |
| Drush project | Drush Drupal administration CLI | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for drush/drush 13.8.0 declares PHP >=8.3 for this tool/library. |
source |