This directory contains an overview of software products that may be affected by CVE-2026-109618 and CVE-2026-109619. PHP's official advisory states that all PHP installations serving web requests are at risk and identifies PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed upstream releases. Product entries should still be treated as investigation leads until they are backed by an upstream or vendor source, or by direct primary research scoped to a named product and runtime, because products may ship embedded runtimes, delayed rebuilds or vendor backports.
Please note that these vulnerabilities may also occur in custom PHP applications deployed within your organisation. Those occurrences are not registered in this overview.
The following status labels are in use:
| Status | Description |
|---|---|
| Investigation | The product may be affected and is being assessed. |
| Vulnerable | An upstream or vendor source, or direct primary research, confirms that the product is vulnerable in the stated scope. |
| Fix | An upstream or vendor source confirms that the listed version contains a fix. |
| Workaround | The product is vulnerable, but mitigation steps are available. |
| Not vuln | An upstream or vendor source confirms that the product is not vulnerable. |
The Version column in the software list relates to the status of the entry. For Vulnerable, it identifies known vulnerable versions when available. For Fix, it identifies the version in which the fix was introduced.
See software_list.md for the current list.
For upstream PHP remediation guidance, see the official PHP security advisory.
The source of truth for this overview is the JSON fragments in spdx/segments and spdx/shared. Run python tools/build_spdx_inventory.py from the repository root to compile every source JSON into spdx/PHP_Downstream_Inventory.spdx3.json. See SPDX source maintenance for the categories and editing workflow. The alphabetized Markdown pages are generated automatically from the compiled inventory using the tooling in ../tools. Status values in the current list are derived from the VEX assessment relationships in the SPDX document.
Disclaimer: No guarantees are made regarding the completeness or accuracy of this inventory. Verify entries against upstream or vendor sources before acting on them.