0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Heroku / Salesforce | Heroku PHP buildpack and application runtime | Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22 | Fix | Fix | CVE assessment: Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Hestia Control Panel project | HestiaCP hestia-php internal runtime | hestia-php security update released 2026-10-22; Ubuntu 22.04+ and Debian 11+ | Fix | Fix | CVE assessment: Fixed hestia-php packages were released on 22 October 2026 for Ubuntu 22.04+ and Debian 11+; the maintainer separately confirms Debian Bullseye publication. The notice does not identify an exact package revision. Hosted-site and system PHP remain separate update scopes. HestiaCP's maintainer confirms released hestia-php updates for Ubuntu 22.04 and newer and Debian 11 and newer. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 |
| Hestia Control Panel project | HestiaCP hosted-site PHP-FPM / MultiPHP option | HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21 | Fix | Fix | CVE assessment: HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Hewlett Packard Enterprise | HPE Networking ClearPass Policy Manager | ClearPass 6.14.1 + PHP CVE hotfix / ClearPass 6.11.16 + PHP CVE hotfix | Fix | Fix | CVE assessment: HPESBNW05171 rev.2 lists released ClearPass 6.14.1 and 6.11.16 Hotfix Patches to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619. Both base releases without the hotfix remain affected; their earlier mitigations are not full fixes. HPESBNW05171 rev.2 lists released ClearPass 6.14.1 and 6.11.16 Hotfix Patches to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619. Both base releases without the hotfix remain affected; their earlier mitigations are not full fixes. |
source |
| HikaShop project | HikaShop Joomla component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official guide describes PHP installation scripts inside the Joomla administrator component and PHP configuration handling. |
source | |
| HippyVM contributors | HippyVM RPython PHP implementation | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The project implements PHP using RPython and lists php5-cli among its build prerequisites. |
source | |
| Homebrew maintainers | Homebrew PHP formula and bottles | Homebrew php 8.5.12, revision 0; formula source SHA-256 e1fe7d4bad28b3d65b67ac83013fd0dd78d4aa1fe55ca95124e8213bc4c17ab5 | Fix | Fix | CVE assessment: Homebrew's live formula/API publishes PHP 8.5.12 and bottle metadata for the listed macOS ARM and Linux architectures, sourced from PHP's fixed 8.5.12 tarball. PHP's official advisory confirms this release fixes both CVEs. This confirmation is scoped to php 8.5.12, not EOL php@8.1 or all older bottles; binaries were not downloaded or executed. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| Horde Project | Horde Groupware Webmail Edition 5 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official legacy Webmail manifest identifies the PHP groupware/webmail bundle and its Horde dependency. |
source | |
| HostBill / HostBillApp | HostBill | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor-hosted requirements distinguish mandatory PHP modules and ionCube from recommended/feature-specific additions. |
source | |
| HumHub | HumHub | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown Official HumHub requirements document Apache/mod_php or PHP-FPM deployment options and a current PHP compatibility matrix. |
source |