# Software product status update history
[About this list](README.md)

This file is generated from status-changing SPDX snapshots in the repository mainline Git history.
Rows are ordered newest first. The `Date and time` column uses `YYYY-MM-DD HH:MM:SS +/-HHMM`.

| Date and time | Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|:------------------------|:---------|:--------|:--------------------:|:----------------------:|:----------------------:|:------|------:|
|2026-10-29 13:43:09 +0100|Acquia|Acquia Cloud Platform PHP hosting|Cloud Platform 2026-10-22: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: Cloud Platform 2026-10-22: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12<br>Acquia publishes selectable PHP runtime settings for Cloud Platform environments.|[source 1](<https://docs.acquia.com/acquia-cloud-platform/configuring-php-settings>)<br>[source 2](<https://docs.acquia.com/acquia-cloud-platform/release/2026-10-22/100321-cloud-platform-october-22-2026>)<br>[source 3](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 4](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|CircleCI|CircleCI cimg/php CI runtime image family|cimg/php:8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (linux/amd64 and linux/arm64)|Fix|Fix|CVE assessment: cimg/php:8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (linux/amd64 and linux/arm64)<br>CircleCI's merged release PR specifies the patched PHP versions; its image guide explains the versioned tags. Published base-tag metadata corroborates availability for the recorded platforms.|[source 1](<https://github.com/CircleCI-Public/cimg-php/pull/324>)<br>[source 2](<https://circleci.com/developer/images/image/cimg/php>)<br>[source 3](<https://github.com/CircleCI-Public/cimg-php/commit/76fe1c8bd2ec95f65faaa71159dadbfe23c264d5>)<br>[source 4](<https://github.com/CircleCI-Public/cimg-php/blob/main/README.md>)<br>[source 5](<https://hub.docker.com/v2/repositories/cimg/php/tags/8.2.35>)<br>[source 6](<https://hub.docker.com/v2/repositories/cimg/php/tags/8.3.36>)<br>[source 7](<https://hub.docker.com/v2/repositories/cimg/php/tags/8.4.27>)<br>[source 8](<https://hub.docker.com/v2/repositories/cimg/php/tags/8.5.12>)<br>[source 9](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 10](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|Composer / Satis maintainers|Satis official PHP container build recipe|composer/satis:latest with PHP 8.4.27 (2026-10-29 digest scope)|Fix|Fix|CVE assessment: composer/satis:latest with PHP 8.4.27 (2026-10-29 digest scope)<br>Satis documentation identifies the official image and PHP runtime recipe but does not announce these fixes. Fix applies to the checked published image digest containing PHP 8.4.27, as established by registry metadata and PHP's advisories.|[source 1](<https://github.com/composer/satis/blob/main/README.md>)<br>[source 2](<https://github.com/composer/satis/blob/main/Dockerfile>)<br>[source 3](<https://hub.docker.com/v2/repositories/composer/satis/tags/latest>)<br>[source 4](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 5](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|Composer project / Docker Official Images|Composer default Docker runtime image|composer:2 with PHP 8.5.12 (2026-10-29 digest scope)|Fix|Fix|CVE assessment: composer:2 with PHP 8.5.12 (2026-10-29 digest scope)<br>The official repository and readable image page establish publisher and artifact identity. No product-specific fix announcement was found; Fix is based on the checked image's PHP 8.5.12 runtime metadata and PHP's advisories.|[source 1](<https://github.com/composer/docker>)<br>[source 2](<https://hub.docker.com/layers/library/composer/2/images/sha256-66c00f4ea1c6a01364d75460bb2837886388e1d5b2b1b6e0f22c8788eb4e73ad>)<br>[source 3](<https://github.com/composer/docker/blob/a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1/latest/Dockerfile>)<br>[source 4](<https://github.com/docker-library/official-images/blob/master/library/composer>)<br>[source 5](<https://github.com/docker-library/docs/blob/master/composer/README.md>)<br>[source 6](<https://hub.docker.com/v2/repositories/library/composer/tags/2>)<br>[source 7](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 8](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|Docker Community / Docker Official Images, not WordPress upstream image ownership|WordPress Docker Official Image distribution|7.1.4-php8.4-apache: PHP 8.4.27 (2026-10-29 digest scope)|Fix|Fix|CVE assessment: 7.1.4-php8.4-apache: PHP 8.4.27 (2026-10-29 digest scope)<br>The Docker image maintainer confirms updated WordPress tags in the critical PHP security discussion. The exact recorded 7.1.4 image digest and PHP 8.4.27 runtime remain supported by registry metadata and PHP's advisories.|[source 1](<https://github.com/docker-library/wordpress/issues/1024#issuecomment-6322989456>)<br>[source 2](<https://github.com/docker-library/wordpress/blob/master/Dockerfile.template>)<br>[source 3](<https://github.com/docker-library/wordpress>)<br>[source 4](<https://hub.docker.com/v2/repositories/library/wordpress/tags/7.1.4-php8.4-apache>)<br>[source 5](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 6](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|DokuWiki project|DokuWiki official Docker distribution|dokuwiki/dokuwiki:stable with PHP 8.4.27 (2026-10-29 digest scope)|Fix|Fix|CVE assessment: dokuwiki/dokuwiki:stable with PHP 8.4.27 (2026-10-29 digest scope)<br>DokuWiki's maintainer names both CVEs and expects the next build to contain fixed PHP. That statement alone does not confirm publication; Fix is scoped to the independently checked stable image digest containing PHP 8.4.27.|[source 1](<https://github.com/dokuwiki/docker/commit/1f796d3969553695c48a3ba594f8b8fde048fe78>)<br>[source 2](<https://github.com/dokuwiki/docker>)<br>[source 3](<https://github.com/dokuwiki/docker/blob/main/Dockerfile>)<br>[source 4](<https://hub.docker.com/v2/repositories/dokuwiki/dokuwiki/tags/stable>)<br>[source 5](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 6](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|Nextcloud Docker community volunteers / Docker Official Images|Nextcloud community Docker image distribution|35.0.2-apache / 34.0.5-fpm: PHP 8.5.12; 32-apache: PHP 8.3.36 (2026-10-29 digest scope)|Fix|Fix|CVE assessment: 35.0.2-apache / 34.0.5-fpm: PHP 8.5.12; 32-apache: PHP 8.3.36 (2026-10-29 digest scope)<br>Nextcloud's security notice and Docker maintainer response explain the issue and scheduled rebuilds. They do not confirm completion for all three recorded tags; Fix relies on their checked registry digests and PHP's advisories, not on AIO releases.|[source 1](<https://github.com/nextcloud/server/issues/65754>)<br>[source 2](<https://github.com/nextcloud/docker/issues/2605#issuecomment-6318638561>)<br>[source 3](<https://github.com/nextcloud/docker>)<br>[source 4](<https://hub.docker.com/v2/repositories/library/nextcloud/tags/35.0.2-apache>)<br>[source 5](<https://hub.docker.com/v2/repositories/library/nextcloud/tags/34.0.5-fpm>)<br>[source 6](<https://hub.docker.com/v2/repositories/library/nextcloud/tags/32-apache>)<br>[source 7](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 8](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-29 13:43:09 +0100|OpenBSD ports maintainers / PHP documentation team|OpenBSD optional PHP package and ports family|OpenBSD 8.0 amd64 packages-stable: php-8.3.36p1 / php-8.4.27p0 / php-8.5.12p0|Fix|Fix|CVE assessment: OpenBSD 8.0 amd64 packages-stable: php-8.3.36p1 / php-8.4.27p0 / php-8.5.12p0<br>PHP documentation confirms split optional OpenBSD packages; dated7.9 release notes list four PHP source-version families.|[source 1](<https://www.php.net/manual/en/install.unix.openbsd.php>)<br>[source 2](<https://www.openbsd.org/79.html>)<br>[source 3](<https://cdn.openbsd.org/pub/OpenBSD/8.0/packages-stable/amd64/>)<br>[source 4](<https://github.com/openbsd/ports/commit/f0c6a3922549ae04b3b84f57035bd179b44619e2>)<br>[source 5](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 6](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-28 16:28:09 +0100|Apache Friends|XAMPP|Windows x64 installers 8.3.36, 8.4.27 or 8.5.12|Fix|Fix|CVE assessment: Apache Friends publishes Windows installers with matching fixed PHP versions; PHP's advisory confirms both CVE fixes. This finding covers those Windows builds only; Linux, macOS and older installers are not confirmed fixed.<br>Install a listed fixed Windows bundle and ensure its PHP runtime is selected; restart the bundled services.|[source 1](<https://www.apachefriends.org/download.html>)<br>[source 2](<https://www.apachefriends.org/index.html>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-28 16:28:09 +0100|Beyond Code in partnership with Laravel|Laravel Herd managed native PHP environment|Patched PHP builds distributed through Herd after the 2026-10-21 security release|Fix|Fix|CVE assessment: Beyond Code's 2026-10-22 response confirms patched PHP builds are shipping through Herd and links the PHP Foundation's announcement covering both CVEs. Updating the Herd application alone does not update every selected PHP runtime.<br>Follow Beyond Code's instructions: update Herd, then update the PHP versions in the application and verify the runtime selected for each site.|[source 1](<https://herd.laravel.com/>)<br>[source 2](<https://herd.laravel.com/docs/windows/advanced-usage/directories-and-files>)<br>[source 3](<https://beyondco.de/blog/php-security-release>)<br>[source 4](<https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/>)|
|2026-10-28 16:28:09 +0100|Cisco|Cisco Identity Services Engine (ISE) Portal Builder||Vulnerable|Vulnerable|CVE assessment: Cisco advisory version 1.8 (Final, 2026-10-27) lists ISE Portal Builder as vulnerable and offline for remediation. It does not confirm a released fix; the separate ISE product's Not vuln assessment does not cover Portal Builder.<br>Follow Cisco's remediation status for Portal Builder. Service shutdown is not confirmation of a software fix.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-28 16:28:09 +0100|Cisco|Cisco Unified Industrial Wireless Software||Vulnerable|Vulnerable|CVE assessment: Cisco advisory version 1.8 (Final, 2026-10-27) lists Unified Industrial Wireless Software as vulnerable. Bug CSCwx37073 lists 27.1.1 for March 2027; this is a planned release, not an available fix.<br>Follow Cisco's product-specific guidance and release availability for CSCwx37073; no currently available fixed build is confirmed by this advisory.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-28 16:28:09 +0100|CyberPanel project|CyberPanel hosted PHP / LSPHP options|Ubuntu 26.04 LSPHP: 8.2.35-1+resolute, 8.3.36-1+resolute, 8.4.27-1+resolute or 8.5.12-1+resolute|Fix|Fix|CVE assessment: CyberPanel confirms fixed LiteSpeed packages for both CVEs and verifies this Ubuntu 26.04 configuration. The fix requires matching modules, refreshing the separate panel PHP copy and recycling workers. Other OS/package combinations need separate confirmation.<br>Apply the vendor's PHP package and panel-copy procedure; this is not a new CyberPanel source release or confirmation that customer installations have been patched.|[source 1](<https://github.com/usmannasir/cyberpanel>)<br>[source 2](<https://github.com/usmannasir/cyberpanel/blob/v3.0.5-dev/manage.py>)<br>[source 3](<https://cyberpanel.net/blog/php-security-october-2026-cyberpanel-response>)|
|2026-10-28 16:28:09 +0100|Juniper Networks|Junos OS J-Web (EX/SRX scope)|Junos OS J-Web on EX/SRX using affected PHP; SRX 25.2R1 no longer uses PHP|Vulnerable|Not vuln|CVE assessment: Juniper JSA112681 states Junos OS is vulnerable to CVE-2026-109618 but not exploitable; the reachable out-of-memory issue is described as harmless. SRX stops using PHP at 25.2R1.; Juniper JSA112681, updated 2026-10-27, explicitly states that Junos OS is not affected by CVE-2026-109619.<br>CVE-2026-109618 remains Vulnerable: Juniper says the issue is reachable but not exploitable. SRX stops using PHP at 25.2R1; that release boundary must not be applied to EX.|[source 1](<https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json>)<br>[source 2](<https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software>)<br>[source 3](<https://supportportal.juniper.net/s/article/2026-10-Reference-Advisory-Status-of-PHP2Shell-vulnerabilities-on-Juniper-Products-CVE-2026-109618-CVE-2026-109619>)|
|2026-10-28 16:28:09 +0100|Laragon project|Laragon Full Windows development bundle|Laragon 8.8.0 with bundled PHP 8.3.36 selected|Fix|Fix|CVE assessment: Laragon's 2026-10-22 release updates its PHP 8.3 bundle to 8.3.36 for critical security fixes. PHP upstream confirms this version fixes both CVEs. Other added or selected PHP branches are not covered by this release evidence.<br>Update Laragon and select its fixed PHP 8.3 runtime; separately update any other installed or per-project PHP runtime.|[source 1](<https://laragon.org/download>)<br>[source 2](<https://github.com/leokhoa/laragon/releases/tag/8.8.0>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-28 16:28:09 +0100|Laravel|Laravel Vapor PHP Docker base image family|Updated Vapor PHP 8.2+ Docker runtimes from the October 2026 security rollout|Fix|Fix|CVE assessment: Laravel confirms patched Vapor runtimes are live and explicitly requires a new deployment for Docker/custom runtimes. The official base-image repository also merges the PHP 8.2.35 pin. PHP 8.0/8.1 are excluded; existing deployments do not update automatically.<br>Use the updated PHP 8.2+ base image and create a new deployment; a redeploy of the existing Docker image is insufficient.|[source 1](<https://docs.vapor.build/projects/environments>)<br>[source 2](<https://laravel.com/blog/php-critical-vulnerability-response-updates>)<br>[source 3](<https://github.com/laravel/vapor-dockerfiles/pull/24>)<br>[source 4](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-28 16:28:09 +0100|MAMP GmbH|MAMP local server environment|MAMP / MAMP PRO 5.0.7 for Windows with PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 selected|Fix|Fix|CVE assessment: MAMP's 2026-10-23 Windows release adds the PHP versions identified by upstream as fixing both CVEs. The installer also retains older PHP choices; this confirmation does not cover macOS or use of an older bundled runtime.<br>Install the Windows 5.0.7 release, select one of its fixed PHP versions and restart the services.|[source 1](<https://www.mamp.info/en/mamp/mac/>)<br>[source 2](<https://www.mamp.info/en/downloads/>)<br>[source 3](<https://www.mamp.info/en/release-notes/windows/>)<br>[source 4](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-28 16:28:09 +0100|Nextcloud Snap maintainers|Nextcloud Snap bundled PHP runtime|34.0.5snap3 (bundled PHP 8.4.27)|Fix|Fix|CVE assessment: The official Nextcloud Snap release ships PHP 8.4.27, and its maintainers confirm the security update in issue 3701. PHP upstream identifies 8.4.27 as fixed for both CVEs. This finding applies to the Snap package.<br>Refresh to Nextcloud Snap 34.0.5snap3 or a later release retaining the fixed PHP runtime.|[source 1](<https://github.com/nextcloud-snap/nextcloud-snap/blob/master/snap/snapcraft.yaml>)<br>[source 2](<https://github.com/nextcloud-snap/nextcloud-snap/releases/tag/34.0.5snap3>)<br>[source 3](<https://github.com/nextcloud-snap/nextcloud-snap/issues/3701>)<br>[source 4](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-28 16:28:09 +0100|WampServer maintainers / Aviatechno|WampServer Windows development bundle|Windows x64 PHP add-ons 8.2.35.1, 8.3.36.1, 8.4.27.1 or 8.5.12.1|Fix|Fix|CVE assessment: The publisher's 2026-10-28 warning supplies these PHP security add-ons. Their PHP source versions match the upstream fixes for both CVEs. The older full installer and a Wampmanager-only update do not establish a fixed runtime.<br>Install and select a fixed PHP add-on for Apache and every FCGI VirtualHost; follow the publisher's manager-runtime and restart instructions.|[source 1](<https://wampserver.aviatechno.net/>)<br>[source 2](<https://wampserver.aviatechno.net/index.php?affiche=addons&lang=en>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-28 11:16:23 +0100|Palo Alto Networks|PAN-OS|Fixed thresholds in PAN-OS 12.2.4-h1; 12.1.4-h13 (ETA 2026-10-29), 12.1.7-h11, 12.1.10-h3 (ETA 2026-10-30); 11.2.4-h23 (ETA 2026-10-30), 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12 (ETA 2026-10-30), 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39 (ETA 2026-10-30), 10.2.10-h42 (ETA 2026-10-29), 10.2.13-h27, 10.2.16-h12, 10.2.18-h13; earlier builds affected|Fix|Fix|CVE assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed hotfix thresholds for each affected PAN-OS branch; some listed hotfixes still carry 2026-10-29/30 ETAs. The same thresholds apply to PA-Series, VM-Series and Panorama (virtual and M-Series); earlier builds remain affected. Scope is the management web interface (HTTPS web UI and XML API), and active exploitation has been observed against internet-exposed management interfaces.<br>Official vendor assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed PAN-OS hotfix thresholds; some branch hotfixes still carry 2026-10-29/30 ETAs, and earlier builds remain affected.|[source 1](<https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing>)<br>[source 2](<https://security.paloaltonetworks.com/CVE-2025-0108>)<br>[source 3](<https://security.paloaltonetworks.com/CVE-2026-109618>)|
|2026-10-28 11:16:23 +0100|Palo Alto Networks|Panorama|Fixed thresholds in Panorama 12.2.4-h1; 12.1.4-h13 (ETA 2026-10-29), 12.1.7-h11, 12.1.10-h3 (ETA 2026-10-30); 11.2.4-h23 (ETA 2026-10-30), 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12 (ETA 2026-10-30), 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39 (ETA 2026-10-30), 10.2.10-h42 (ETA 2026-10-29), 10.2.13-h27, 10.2.16-h12, 10.2.18-h13; earlier builds affected|Fix|Fix|CVE assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed hotfix thresholds for each affected PAN-OS branch; some listed hotfixes still carry 2026-10-29/30 ETAs. The same thresholds apply to PA-Series, VM-Series and Panorama (virtual and M-Series); earlier builds remain affected. Scope is the management web interface (HTTPS web UI and XML API), and active exploitation has been observed against internet-exposed management interfaces.<br>Official vendor assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed Panorama hotfix thresholds; some branch hotfixes still carry 2026-10-29/30 ETAs, and earlier builds remain affected.|[source 1](<https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing>)<br>[source 2](<https://docs.paloaltonetworks.com/panorama/getting-started/panorama-overview/about-panorama>)<br>[source 3](<https://security.paloaltonetworks.com/CVE-2026-109618>)|
|2026-10-28 10:58:25 +0100|Citrix / NetScaler|Citrix NetScaler ADC and Citrix NetScaler Gateway|Fixed in NetScaler ADC and Gateway 14.1-73.49 and later; 13.1-64.32 and later releases of 13.1; ADC 14.1-FIPS 14.1-73.49 FIPS and later; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later; earlier builds impacted|Fix|Fix|CVE assessment: CTX697263, updated 2026-10-27, lists fixed NetScaler ADC and NetScaler Gateway releases: NetScaler ADC and Gateway 14.1-73.49 and later; 13.1-64.32 and later releases of 13.1; ADC 14.1-FIPS 14.1-73.49 FIPS and later; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later. Earlier builds remain impacted. Exposure is the PHP-based management access (NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI). Citrix NetScaler Console is listed as not impacted; NetScaler Product Security also excludes NetScaler SVM.<br>Official vendor assessment: CTX697263, updated 2026-10-27, lists fixed Citrix NetScaler ADC and Citrix NetScaler Gateway releases for CVE-2026-109618 and CVE-2026-109619 (14.1-73.49, 13.1-64.32, 14.1-73.49 FIPS, 13.1.37.286 FIPS/NDcPP); earlier builds remain impacted.|[source 1](<https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf>)<br>[source 2](<https://prod-docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/signatures/signature-auto-update>)<br>[source 3](<https://support.citrix.com/external/article/CTX697263/citrix-security-advisory-for-cve20261096.html>)<br>[source 4](<https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/>)|
|2026-10-28 10:44:24 +0100|Securepoint GmbH|Securepoint Resellerportal|Patched before 2026-10-22 inventory entry; fixed release not publicly stated|Fix|Fix|CVE assessment: The maintainer accepts issue #58's Securepoint employee report that the Resellerportal was patched before this inventory entry was created. No public fixed build was independently verified.<br>Fix status is based on issue #58, where a Securepoint employee reports that the Resellerportal was patched before this inventory entry was created. The product was originally reported in PR #10; no public fixed build was independently verified.|[source 1](<https://my.securepoint.de/>)<br>[source 2](<https://laravel.com/framework/docs/deployment>)<br>[source 3](<https://github.com/NCSC-NL/php2shell/issues/58>)<br>[source 4](<https://github.com/NCSC-NL/php2shell/pull/10>)|
|2026-10-27 15:17:18 +0100|GetPageSpeed|GetPageSpeed PHP 7.2-8.4 packages for Ubuntu 18.04/20.04 and Debian 10|Known patched builds (not necessarily first fixed revisions): bionic PHP 7.2 7.2.34-66+gps1+ubuntu1804+stable.1; buster PHP 7.3 7.3.33-35+gps1+deb10+stable.1; focal PHP 7.4 1:7.4.33-31+gps1+ubuntu2004+stable.1; PHP 8.0 1:8.0.30-25+gps1+ubuntu2004+stable.1; PHP 8.1 8.1.34-9+gps1+ubuntu2004+stable.1; PHP 8.2 8.2.35-1+gps1+ubuntu2004+stable.1; PHP 8.3 8.3.36-1+gps1+ubuntu2004+stable.1; PHP 8.4 8.4.27-1+gps1+ubuntu2004+stable.1|Fix|Fix|CVE assessment: Fixed in the specified GetPageSpeed amd64 DEB builds: bionic PHP 7.2 7.2.34-66+gps1+ubuntu1804+stable.1; buster PHP 7.3 7.3.33-35+gps1+deb10+stable.1; focal PHP 7.4 1:7.4.33-31+gps1+ubuntu2004+stable.1; PHP 8.0 1:8.0.30-25+gps1+ubuntu2004+stable.1; PHP 8.1 8.1.34-9+gps1+ubuntu2004+stable.1; PHP 8.2 8.2.35-1+gps1+ubuntu2004+stable.1; PHP 8.3 8.3.36-1+gps1+ubuntu2004+stable.1; PHP 8.4 8.4.27-1+gps1+ubuntu2004+stable.1<br>GetPageSpeed released PHP2Shell-fixed DEB packages for the specified PHP branches on Ubuntu 18.04/20.04 and Debian 10, on amd64.|[source 1](<https://www.getpagespeed.com/server-setup/php/php2shell-on-ubuntu-debian>)<br>[source 2](<https://www.getpagespeed.com/php2shell>)<br>[source 3](<https://extras.getpagespeed.com/ubuntu/dists/bionic/main/binary-amd64/Packages.gz>)<br>[source 4](<https://extras.getpagespeed.com/debian/dists/buster/main/binary-amd64/Packages.gz>)<br>[source 5](<https://extras.getpagespeed.com/ubuntu/dists/focal/main/binary-amd64/Packages.gz>)|
|2026-10-27 11:55:48 +0100|Cleo|Cleo Streem (Streem Print)|Patch available by mail; fixed release not publicly stated|Fix|Fix|CVE assessment: Fix available by mail according to maintainer-accepted PR #41; fixed release not publicly stated.<br>Cleo Streem release notes establish a PHP-bearing product scope. PR #41 reports that the PHP2Shell fix is distributed by email from Streem support; no public fixed build was independently verified.|[source 1](<https://support.cleo.com/hc/en-us/articles/39285811298327-Cleo-Streem-Release-Notes>)<br>[source 2](<https://github.com/NCSC-NL/php2shell/pull/41>)|
|2026-10-27 11:35:19 +0100|Broadcom|CloudSOC SpanVA Appliance|Broadcom ESG advisory 39404 affected product scope|Vulnerable|Vulnerable|CVE assessment: Broadcom ESG advisory 39404, updated 2026-10-26, explicitly lists CloudSOC SpanVA Appliance under Affected Product(s) for both PHP2Shell CVEs; the umbrella advisory does not state affected or fixed releases.<br>Broadcom ESG advisory 39404 lists CloudSOC SpanVA Appliance under Affected Product(s) for CVE-2026-109618 and CVE-2026-109619; the umbrella advisory does not state fixed releases.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-27 11:35:19 +0100|Broadcom|Content Analysis and Malware Analysis (CASMA)|Broadcom ESG advisory 39404 under-investigation product scope|Investigation|Investigation|CVE assessment: Broadcom advisory 39404, updated 26 October, lists Content Analysis and Malware Analysis (CASMA) under investigation for both PHP2Shell CVEs. The separate Content Analysis (CAS) product is not vulnerable; that assessment does not transfer to CASMA.<br>Broadcom advisory 39404, updated 26 October, lists Content Analysis and Malware Analysis (CASMA) under investigation for both PHP2Shell CVEs; affected and fixed releases are not published.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-27 11:21:24 +0100|Ubiquiti|UISP CRM (UCRM)|UISP Application 3.1.70 (CRM module)|Fix|Fix|CVE assessment: Ubiquiti confirms that UISP Application 3.1.70 fixes both PHP2Shell CVEs in the PHP runtime used by the UISP CRM module. Fix status applies to that release; it does not establish that existing deployments or cloud instances have been upgraded.<br>Public official release dated 2026-10-23; Ubiquiti recommends updating promptly. The release notes do not specify a standalone CRM version, bundled PHP version, or complete affected-version range. Official release: https://uisp.community.ui.com/releases/UISP-Application-3-1-70/8292c6cb-4eb4-447d-9c90-455ca41b4f67 ; Historical community discussion: https://uisp.community.ui.com/questions/UCRM-4-6-15-remains-exposed-to-CVSS-9-2-RCEs-CVE-2026-109618-109619-ETA-for-PHP-8-3-36/d0fae711-2df1-4550-80e3-2b395a6a5c86 ; Earlier EA release (contents not independently verified): https://uisp.community.ui.com/releases/UISP-Application-3-1-69/d19ae117-04f7-42b3-bf53-f77d2b9e09fc|[source 1](<https://uisp.community.ui.com/releases/UISP-Application-3-1-70/8292c6cb-4eb4-447d-9c90-455ca41b4f67>)<br>[source 2](<https://uisp.community.ui.com/questions/UCRM-4-6-15-remains-exposed-to-CVSS-9-2-RCEs-CVE-2026-109618-109619-ETA-for-PHP-8-3-36/d0fae711-2df1-4550-80e3-2b395a6a5c86>)<br>[source 3](<https://uisp.community.ui.com/releases/UISP-Application-3-1-69/d19ae117-04f7-42b3-bf53-f77d2b9e09fc>)|
|2026-10-27 11:06:35 +0100|Alpine Linux package maintainers|Alpine Linux v3.22 php84 package family|8.4.27-r0|Fix|Fix|CVE assessment: Alpine v3.22 community/php84 secfixes metadata lists both CVEs as fixed in 8.4.27-r0; the official x86_64 package catalogue confirms that build. Update the installed packages and restart PHP workers.<br>Install php84 8.4.27-r0 or a later vendor-fixed build from Alpine v3.22 and restart PHP workers.|[source 1](<https://pkgs.alpinelinux.org/package/v3.22/community/x86_64/php84>)<br>[source 2](<https://raw.githubusercontent.com/alpinelinux/aports/3.22-stable/community/php84/APKBUILD>)|
|2026-10-27 11:06:35 +0100|Antagonist|Antagonist DirectAdmin PHP hosting selector|Provider-patched managed hosting, including PHP Extended Support, by 2026-10-22; build numbers unpublished|Fix|Fix|CVE assessment: Antagonist confirms security updates for both CVEs were installed across its managed hosting systems, including older PHP versions under Extended Support. Original PHP version numbers were retained; exact patched builds are not published.<br>No customer PHP patch installation is required for this provider-managed hosting scope.|[source 1](<https://help.antagonist.nl/hc/nl/articles/8523972848401-Wat-kan-ik-met-de-PHP-selector-in-DirectAdmin>)<br>[source 2](<https://www.antagonist.nl/blog/php-lekken-gedicht-zo-hebben-we-het-aangepakt/>)|
|2026-10-27 11:06:35 +0100|Automattic / WordPress.com|WordPress.com plugin-enabled PHP hosting environment|WordPress.com managed service protected as of 2026-10-21; patched build unpublished|Fix|Fix|CVE assessment: WordPress.com confirms all hosted sites, including plugin-enabled plans, are already protected. Its patched-version FAQ also covers displayed PHP 8.3.35 and 8.4.26. No customer PHP update is required; self-hosted sites and other hosts are excluded.<br>No customer PHP patching is required for sites hosted on WordPress.com. Assess sites hosted elsewhere independently.|[source 1](<https://wordpress.com/support/php-environment/>)<br>[source 2](<https://wordpress.com/support/php-security-update-october-2026-cve-2026-109618-and-cve-2026-109619-php2shell/>)|
|2026-10-27 11:06:35 +0100|Broadcom|Content Analysis|Content Analysis (CAS) only; excludes CASMA|Not vuln|Not vuln|CVE assessment: Broadcom advisory 39404, updated 26 October, explicitly confirms Content Analysis (CAS) is not vulnerable to both CVEs. Distinct Content Analysis and Malware Analysis (CASMA) remains under investigation and is excluded.<br>No remediation is required for Content Analysis (CAS) for these CVEs. Do not extend this conclusion to CASMA.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-27 11:06:35 +0100|Cisco|Cisco Ultra Cloud Core - Converged Policy and Charging|Cisco advisory 1.7 confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.7 explicitly lists Ultra Packet Core - Converged Policy and Charging as confirmed not vulnerable to both CVEs. This matches the existing Ultra Cloud Core product entry; no status is inferred from absence.<br>No remediation is required for this vendor-confirmed non-vulnerable product scope.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-27 11:06:35 +0100|Fortinet|FortiClient Cloud Services|Remediated forticlient-forensics-{dev,us,eu,ap}.forticloud.com services; build unpublished|Fix|Fix|CVE assessment: Fortinet FG-IR-26-186 confirms remediation of four FortiClient forensics endpoints: dev, us, eu and ap under forticloud.com. No customer action is required. This does not assess other FortiClient Cloud Services endpoints; service build numbers are unpublished.<br>No customer action is required for the four vendor-remediated FortiClient forensics endpoints.|[source 1](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)<br>[source 2](<https://www.fortiguard.com/psirt/FG-IR-26-186>)|
|2026-10-27 11:06:35 +0100|FreshRSS project|FreshRSS|1.30.3 official default Debian Docker images; PHP 8.4.27-1~deb13u1|Fix|Fix|CVE assessment: FreshRSS 1.30.3 fixes both CVEs in the official default Debian Docker images, using PHP 8.4.27-1~deb13u1. The release explicitly excludes delayed alternative Alpine images. Source installations still require their own patched PHP runtime.<br>Pull and recreate the official default Debian Docker image for release 1.30.3. Do not assume its alternative Alpine images or source deployments are fixed.|[source 1](<https://freshrss.github.io/FreshRSS/en/admins/02_Prerequisites.html>)<br>[source 2](<https://github.com/FreshRSS/FreshRSS/releases/tag/1.30.3>)|
|2026-10-27 11:06:35 +0100|HumHub|HumHub|HumHub deployments on unpatched PHP; application versions not specified|Vulnerable|Vulnerable|CVE assessment: The HumHub Team explicitly identifies both CVEs and confirms HumHub installations on unpatched PHP are affected. Update the deployed PHP runtime. The announcement promises Docker updates and describes Cloud protective measures; it does not confirm a released fixed image or completed Cloud patch.<br>Update PHP on the HumHub server to a vendor-fixed build. If patching is delayed, restrict access as advised by the vendor.|[source 1](<https://docs.humhub.org/docs/admin/requirements/>)<br>[source 2](<https://community.humhub.com/s/announcements/post/post/view?id=18588>)|
|2026-10-27 11:06:35 +0100|IONOS|IONOS webhosting PHP and CLI options|Provider-patched IONOS-managed webhosting PHP; build numbers unpublished|Fix|Fix|CVE assessment: IONOS confirms PHP2Shell updates are installed on its managed PHP infrastructure, including vendor-maintained older branches. This covers account-managed webhosting PHP; customer-managed VPS, dedicated-server and custom CLI installations require separate updates.<br>No customer PHP patch installation is required for account-managed hosting PHP. Patch customer-managed server installations separately.|[source 1](<https://www.ionos.com/help/hosting/managing-php-versions-in-the-control-panel/displaying-or-changing-php-versions/>)<br>[source 2](<https://www.ionos.com/help/hosting/using-php-for-web-projects/executing-php-files-via-the-command-line-php-cli/>)<br>[source 3](<https://www.ionos.com/help/hosting/php2shell-security-vulnerability-important-information-regarding-your-ionos-contract/>)|
|2026-10-27 11:06:35 +0100|OVHcloud|OVHcloud webhosting PHP / .ovhconfig runtime|Provider-patched Web Hosting PHP 5.3-8.5; deployment completed 2026-10-23|Fix|Fix|CVE assessment: OVHcloud confirms PHP 7.4-8.5 patches on all Web Hosting clusters on 21 October and PHP 5.3-7.3 patches on 23 October; maintenance completed 26 October. Customer-managed VPS and dedicated servers are excluded.<br>No customer PHP patch installation is required for this managed Web Hosting scope. Update customer-managed servers separately.|[source 1](<https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/configure-your-web-hosting>)<br>[source 2](<https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk>)<br>[source 3](<https://community.ovhcloud.com/t/faille-critique-php-cve-2026-109618-109619-correctifs-sur-les-hebergements-web-ovhcloud/54166/12>)|
|2026-10-27 11:06:35 +0100|Sangoma|PBXact 17 PHP management edition|PBXact 17 after latest PHP security updates (Sangoma advisory 2026-10-23); exact build unpublished|Fix|Fix|CVE assessment: Sangoma directs PBXact 17 operators to install the available PHP security updates for both CVEs. Fixed scope requires those system updates; an unupdated version 17 installation remains affected. The advisory does not specify an exact package build.<br>Apply the latest system PHP security updates using Sangoma's version 17 update procedure and verify the installed packages.|[source 1](<https://www.freepbx.org/pbxact-17-general-availability-announcement/>)<br>[source 2](<https://community.freepbx.org/t/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact/110423>)|
|2026-10-27 11:06:35 +0100|Sangoma / FreePBX project|FreePBX 17 management framework|FreePBX 17 after latest PHP security updates (Sangoma advisory 2026-10-23); exact build unpublished|Fix|Fix|CVE assessment: Sangoma directs FreePBX 17 operators to install the available PHP security updates for both CVEs. Fixed scope requires those system updates; an unupdated version 17 installation remains affected. The advisory does not specify an exact package build.<br>Apply the latest system PHP security updates using Sangoma's FreePBX 17 update procedure and verify the installed packages.|[source 1](<https://sangomakb.atlassian.net/wiki/spaces/FP/pages/279052296>)<br>[source 2](<https://github.com/FreePBX/framework/blob/release/17.0/install.php>)<br>[source 3](<https://community.freepbx.org/t/critical-php-security-vulnerabilities-action-required-for-freepbx-and-pbxact/110423>)<br>[source 4](<https://sangomakb.atlassian.net/wiki/spaces/FP/pages/2121924609/FreePBX%2BOpen%2BSource%2B-%2BUpdate%2Bsystem%2Bsoftware%2Bon%2BFreePBX%2B17>)|
|2026-10-27 11:06:35 +0100|TerraMaster|TerraMaster TOS6 Web Server optional PHP hosting|TOS 6 systems using PHP/Web Server; migration to TOS 7 required|Vulnerable|Vulnerable|CVE assessment: TerraMaster support explicitly lists TOS 5/6 as affected by both CVEs and names Web Server among PHP-dependent applications. TOS 6 users must migrate to TOS 7 and install its patched PHP packages; no in-place TOS 6 fix is established.<br>Migrate to TOS 7, install the vendor-fixed PHP package in App Center and restart PHP-dependent services. Update containers independently.|[source 1](<https://help.terra-master.com/docs/TOS6/application/web-server>)<br>[source 2](<https://forum.terra-master.com/en/viewtopic.php?p=61416&t=10721>)|
|2026-10-27 11:06:35 +0100|The PHP Group|PHP Session|CVE-2026-109619: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (session upload-progress lifecycle)|Investigation|Fix|CVE assessment: PHP relationship confirmed; CVE match unknown; CVE-2026-109619: the upstream advisory confirms the session upload-progress lifecycle and lists the fixed PHP releases. This assessment covers that lifecycle in web workers; CVE-2026-109618 remains Investigation at the Session component scope.<br>Upgrade the complete PHP runtime to a listed fixed release and restart PHP workers. This change assesses only CVE-2026-109619 at the Session component scope.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.w32>)<br>[source 3](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-27 11:06:35 +0100|wallabag project|wallabag|Official wallabag/wallabag Docker image 2.6.14.1; PHP 8.2.35|Fix|Fix|CVE assessment: The published official wallabag Docker image 2.6.14.1 includes fixes for both CVEs, with PHP 8.2.35 on Alpine 3.22. This is an image rebuild; arbitrary source installations and older Docker images are outside the fixed scope.<br>Pull the official wallabag/wallabag:2.6.14.1 image and recreate the container. Patch PHP independently for source deployments.|[source 1](<https://doc.wallabag.org/admin/installation/requirements/>)<br>[source 2](<https://github.com/wallabag/docker/releases/tag/2.6.14.1>)<br>[source 3](<https://github.com/wallabag/docker/pull/485>)<br>[source 4](<https://hub.docker.com/r/wallabag/wallabag/tags>)|
|2026-10-26 03:46:58 +0100|GetPageSpeed|GetPageSpeed PHP 5.6-8.4 backport packages for CentOS 7 / EL7|Known patched EL7 builds: 5.6.40-44.el7; 7.0.33-46.el7; 7.1.33-35.el7; 7.2.34-30.el7; 7.3.33-26.el7; 7.4.33-35.el7; 8.0.30-25.el7; 8.1.34-8.el7; 8.2.35-2.el7; 8.3.36-2.el7; 8.4.27-3.el7|Fix|Fix|CVE assessment: Fixed in GetPageSpeed CentOS 7 / EL7 PHP builds: 5.6 5.6.40-44.el7; 7.0 7.0.33-46.el7; 7.1 7.1.33-35.el7; 7.2 7.2.34-30.el7; 7.3 7.3.33-26.el7; 7.4 7.4.33-35.el7; 8.0 8.0.30-25.el7; 8.1 8.1.34-8.el7; 8.2 8.2.35-2.el7; 8.3 8.3.36-2.el7; 8.4 8.4.27-3.el7<br>GetPageSpeed released fixed PHP 5.6 to 8.4 RPMs for CentOS 7 / EL7, including backports for the branches upstream no longer supports (5.6 to 8.1).|[source 1](<https://www.getpagespeed.com/php2shell#eol>)<br>[source 2](<https://www.getpagespeed.com/server-setup/php/php2shell-on-centos-7>)<br>[source 3](<https://www.getpagespeed.com/eol/centos-7>)|
|2026-10-26 03:19:07 +0100|Broadcom|CloudSOC Cloud Access Security Broker (CASB)|CloudSOC CASB service; excludes the separate SpanVA appliance|Not vuln|Not vuln|CVE assessment: Broadcom ESG advisory 39404, updated 2026-10-23, explicitly lists CloudSOC CASB as not vulnerable. The separately named CloudSOC SpanVA appliance is affected; that assessment does not transfer to the CASB service.<br>Broadcom ESG advisory 39404, updated 2026-10-23, explicitly lists CloudSOC CASB as not vulnerable. The separately named CloudSOC SpanVA appliance is affected; that assessment does not transfer to the CASB service.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-26 03:19:07 +0100|Cisco|Cisco Catalyst Center (formerly DNA Center)|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.<br>Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-26 03:19:07 +0100|Cisco|Cisco CX Cloud|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.<br>Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-26 03:19:07 +0100|Cisco|Cisco IoT Control Center|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.<br>Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-26 03:19:07 +0100|Cisco|Cisco Meraki Dashboard|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.<br>Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-26 03:19:07 +0100|Cisco|Cisco WAN Automation Engine (WAE)|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.<br>Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-26 03:19:07 +0100|Cisco|Slido|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.<br>Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-26 03:19:07 +0100|F5|BIG-IP APM PHP page templates|BIG-IP 17.1.3.7 / 17.5.1.11 / 21.1.0.4|Fix|Fix|CVE assessment: F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable.<br>F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable.|[source 1](<https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html>)<br>[source 2](<https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/advanced-customization-using-logon-page-templates.html>)<br>[source 3](<https://my.f5.com/manage/s/article/K000163821>)|
|2026-10-26 03:19:07 +0100|F5|BIG-IP TMOS platform PHP|BIG-IP 17.1.3.7 / 17.5.1.11 / 21.1.0.4|Fix|Fix|CVE assessment: F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable.<br>F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable.|[source 1](<https://cdn.f5.com/product/bugtracker/ID1270257.html>)<br>[source 2](<https://my.f5.com/manage/s/article/K000133753>)<br>[source 3](<https://my.f5.com/manage/s/article/K000163821>)|
|2026-10-26 03:19:07 +0100|Fedora Project PHP maintainers|Fedora PHP distribution package family|php-8.4.27-2.fc43; php-8.5.12-1.fc44; php-8.5.12-1.fc45; php-8.5.12-1.fc46 (Rawhide)|Fix|Fix|CVE assessment: Fedora bug 2556842 names both CVEs and the fixed RPMs. Fedora Update System confirms the Fedora 43 and 45 updates reached stable; the report also records the Fedora 44 update as live and Fedora 46/Rawhide as pushed. Only the listed builds are assessed as fixed.<br>Fedora bug 2556842 names both CVEs and the fixed RPMs. Fedora Update System confirms the Fedora 43 and 45 updates reached stable; the report also records the Fedora 44 update as live and Fedora 46/Rawhide as pushed. Only the listed builds are assessed as fixed.|[source 1](<https://packages.fedoraproject.org/pkgs/php/php/>)<br>[source 2](<https://bugzilla.redhat.com/show_bug.cgi?id=2556842>)|
|2026-10-26 03:19:07 +0100|Fortinet|FortiDDoS-F|FortiDDoS-F; vendor-confirmed not impacted scope|Not vuln|Not vuln|CVE assessment: Fortinet FG-IR-26-186, updated 2026-10-23, lists FortiDDoS-F among products confirmed not impacted. FortiDDoS without the -F suffix remains under investigation.<br>Fortinet FG-IR-26-186, updated 2026-10-23, lists FortiDDoS-F among products confirmed not impacted. FortiDDoS without the -F suffix remains under investigation.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-26 03:19:07 +0100|Hewlett Packard Enterprise|HPE Networking ClearPass Policy Manager|ClearPass 6.14.1 + PHP CVE hotfix / ClearPass 6.11.16 + PHP CVE hotfix|Fix|Fix|CVE assessment: HPESBNW05171 rev.2 lists released ClearPass 6.14.1 and 6.11.16 Hotfix Patches to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619. Both base releases without the hotfix remain affected; their earlier mitigations are not full fixes.<br>HPESBNW05171 rev.2 lists released ClearPass 6.14.1 and 6.11.16 Hotfix Patches to Address PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619. Both base releases without the hotfix remain affected; their earlier mitigations are not full fixes.|[source](<https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05171en_us&docLocale=en_US>)|
|2026-10-26 03:19:07 +0100|Juniper Networks|Junos OS J-Web (EX/SRX scope)|Junos OS J-Web on EX/SRX using affected PHP; SRX 25.2R1 no longer uses PHP|Vulnerable|Investigation|CVE assessment: Juniper JSA112681 (2026-10-23) explicitly confirms Junos OS is vulnerable to CVE-2026-109618. SRX no longer uses PHP starting with 25.2R1. The advisory names both CVEs overall but does not explicitly resolve CVE-2026-109619 for the Junos OS row; its status remains Investigation.<br>Juniper JSA112681 (2026-10-23) explicitly confirms Junos OS is vulnerable to CVE-2026-109618. SRX no longer uses PHP starting with 25.2R1. The advisory names both CVEs overall but does not explicitly resolve CVE-2026-109619 for the Junos OS row; its status remains Investigation.|[source 1](<https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json>)<br>[source 2](<https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software>)<br>[source 3](<https://supportportal.juniper.net/s/article/2026-10-Reference-Advisory-Status-of-PHP2Shell-vulnerabilities-on-Juniper-Products-CVE-2026-109618-CVE-2026-109619>)|
|2026-10-26 03:19:07 +0100|NetApp|ONTAP 9|9.15.1P20HF1 / 9.16.1P16HF1 / 9.17.1P11HF1 / 9.18.1P8HF1 / 9.19.1P3HF1|Fix|Not vuln|CVE assessment: NetApp NTAP-20261021-0021 version 7.0 (2026-10-25) lists these currently available ONTAP 9 patches. ONTAP 9 is affected only by CVE-2026-109618; CVE-2026-109619 does not affect it. Exploitation of an unpatched release is limited to the www user in the PHP jail.<br>NetApp NTAP-20261021-0021 version 7.0 (2026-10-25) lists these currently available ONTAP 9 patches. ONTAP 9 is affected only by CVE-2026-109618; CVE-2026-109619 does not affect it. Exploitation of an unpatched release is limited to the www user in the PHP jail.|[source](<https://security.netapp.com/advisory/NTAP-20261021-0021>)|
|2026-10-26 03:19:07 +0100|QNAP|QNAP QTS built-in PHP runtime|QTS 6.1.0.3656 build 20261023 / QTS 5.2.11.3661 build 20261023|Fix|Fix|CVE assessment: QNAP QSA-26-18 revision 1.1 (2026-10-24) marks the QTS branches Resolved and lists these fixed firmware builds for both CVEs. Earlier affected builds remain vulnerable.<br>QNAP QSA-26-18 revision 1.1 (2026-10-24) marks the QTS branches Resolved and lists these fixed firmware builds for both CVEs. Earlier affected builds remain vulnerable.|[source 1](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)<br>[source 2](<https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero>)<br>[source 3](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-26 03:19:07 +0100|QNAP|QNAP QuTS hero built-in PHP runtime|QuTS hero h6.1.0.3656 / h6.0.2.3656 / h5.2.11.3661, each build 20261023|Fix|Fix|CVE assessment: QNAP QSA-26-18 revision 1.1 (2026-10-24) marks the QuTS hero branches Resolved and lists these fixed firmware builds for both CVEs. Earlier affected builds remain vulnerable.<br>QNAP QSA-26-18 revision 1.1 (2026-10-24) marks the QuTS hero branches Resolved and lists these fixed firmware builds for both CVEs. Earlier affected builds remain vulnerable.|[source 1](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)<br>[source 2](<https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero>)<br>[source 3](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-26 03:19:07 +0100|QNAP|QNAP QuTScloud|QuTScloud c5.2.9.3661 build 20261023|Fix|Fix|CVE assessment: QNAP QSA-26-18 revision 1.1 (2026-10-24) marks QuTScloud Resolved in c5.2.9.3661 build 20261023 for both CVEs. Earlier affected builds remain vulnerable.<br>QNAP QSA-26-18 revision 1.1 (2026-10-24) marks QuTScloud Resolved in c5.2.9.3661 build 20261023 for both CVEs. Earlier affected builds remain vulnerable.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-26 03:19:07 +0100|Quest Software|KACE Systems Management Appliance|KACE SMA 15.0 CU5 (15.0.378) / 15.1 CU2 (15.1.177)|Fix|Fix|CVE assessment: Quest KB 4385046, updated 2026-10-23, confirms KACE SMA is affected by both CVEs and that 15.0 CU5 and 15.1 CU2 addressing them are available. Earlier 15.0 CU4 and 15.1 CU1 do not contain these fixes. The separate KACE SDA product is outside this inventory entry.<br>Quest KB 4385046, updated 2026-10-23, confirms KACE SMA is affected by both CVEs and that 15.0 CU5 and 15.1 CU2 addressing them are available. Earlier 15.0 CU4 and 15.1 CU1 do not contain these fixes. The separate KACE SDA product is outside this inventory entry.|[source 1](<https://support.quest.com/kace-systems-management-appliance/kb/4385046/4385046>)<br>[source 2](<https://support.quest.com/kace-systems-management-appliance/rss>)<br>[source 3](<https://support.quest.com/kace-systems-management-appliance/kb/4385046/quest-kace-response-to-cve-2026-109618-and-cve-2026-109619-php2shell>)|
|2026-10-23 14:50:49 +0200|Broadcom|Symantec Endpoint Protection Manager (SEPM)|14.3.27716.10000 / 14.4.494.0000|Fix|Fix|CVE assessment: The maintainer accepts issue #30's reported SEPM 14.3.27716.10000 and 14.4.494.0000 updates as fixes for both PHP2Shell CVEs. The report cites Broadcom advisory 39421, which requires login and was not independently verified. Fix status applies only to these two builds.<br>Fix status is limited to SEPM 14.3.27716.10000 and 14.4.494.0000, as reported in issue #30 and accepted by the maintainer. Product-specific advisory 39421 requires login and was not independently verified; older releases and deployed installations are not marked fixed.|[source 1](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)<br>[source 2](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Symantec-Endpoint-Protection-Security-Update-for-PHP2Shell/39421>)<br>[source 3](<https://github.com/NCSC-NL/php2shell/issues/30>)|
|2026-10-23 14:50:49 +0200|Hewlett Packard Enterprise|HPE Networking ClearPass Policy Manager|6.14.0 and below / 6.11.15 and below; 6.14.1 / 6.11.16 partially mitigated, still affected|Vulnerable|Vulnerable|CVE assessment: HPESBNW05171 rev.1 confirms ClearPass 6.14.0 and below and 6.11.15 and below are fully affected. Versions 6.14.1 and 6.11.16 partially mitigate exposure by requiring authenticated cluster-admin privileges; full fixes remain in development.<br>HPESBNW05171 rev.1 confirms both CVEs affect ClearPass. Releases 6.14.1 and 6.11.16 only restrict exploitation to authenticated cluster-admin users; full fixes are still in development.|[source](<https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05171en_us&docLocale=en_US>)|
|2026-10-23 14:50:49 +0200|NetApp|ONTAP 9|ONTAP 9; affected maintenance releases and fixed releases not specified|Vulnerable|Not vuln|CVE assessment: NTAP-20261021-0021 version 3.0 lists ONTAP 9 as affected only by CVE-2026-109618. An unauthenticated attacker could gain www-user access restricted to the PHP jail. No fixed release is listed.; NetApp explicitly states ONTAP 9 is affected only by CVE-2026-109618, excluding CVE-2026-109619. The vendor does not publish the technical reason for this exclusion.<br>NTAP-20261021-0021 version 3.0 confirms ONTAP 9 is affected only by CVE-2026-109618, not CVE-2026-109619. Exploitation is limited to the www user in the PHP jail. No fixed release is listed; workarounds have operational trade-offs.|[source](<https://security.netapp.com/advisory/NTAP-20261021-0021>)|
|2026-10-23 13:48:52 +0200|Cisco|Cisco Expressway Select Series|Expressway Select Series; affected release range not specified|Vulnerable|Vulnerable|CVE assessment: Cisco lists Expressway Select Series as vulnerable under CSCwx37062. The listed 15.5.21 fix has a TBD availability date and is not a confirmed released fix.<br>Monitor CSCwx37062 for an available fixed release; Cisco lists no workaround.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 13:48:52 +0200|Cisco|Cisco Identity Services Engine (ISE) Portal Builder||Investigation|Investigation|CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability.<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Identity Services Engine (ISE) Portal Builder as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 13:48:52 +0200|Cisco|Cisco Meraki Dashboard||Investigation|Investigation|CVE assessment: Retained Investigation: Cisco advisory version 1.4 explicitly lists nine current product scopes under investigation and does not explicitly resolve the retained Panoptica scope. A product's absence from the current list is not treated as confirmed non-vulnerability.<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Meraki Dashboard as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 13:33:24 +0200|CloudLinux|CloudLinux ea-PHP fixed packages for CloudLinux 7-10|ea-php52 through ea-php85: vendor fixed build matrix released 2026-10-21 20:55 UTC (EL7/8/9/10)|Fix|Fix|CVE assessment: CloudLinux confirms fixed ea-php52 through ea-php85 packages in stable for EL7/8/9/10. Use the exact vendor package revisions, not the upstream PHP number alone: for example ea-php84 8.4.26-2.elX.cloudlinux.1 contains both fixes. CL6 and other platforms are not included in this fixed scope.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)|
|2026-10-23 13:33:24 +0200|CloudLinux / TuxCare|CloudLinux Alt-PHP fixed packages for CloudLinux 7-10 and Ubuntu 22.04|Stable security builds released 2026-10-21/22; CL8/9 PHP 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 also released 2026-10-23|Fix|Fix|CVE assessment: CloudLinux confirms fixed alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5 for CL7/8/9; Ubuntu 22.04 covers 5.2, 5.6, 7.0-7.4 and 8.0-8.5. CL10 has fixed 5.2 in stable and other branches through ELS ALT PHP. CL8/9 also have new upstream-number builds for 8.2-8.5. CL6 and unlisted platform/branch combinations are excluded. Check backport revisions and changelogs.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)|
|2026-10-23 13:33:24 +0200|FileCloud|FileCloud Server PHP installation and maintenance|FileCloud Server 23.263.2 (PHP 8.4.27), Windows and Linux|Fix|Fix|CVE assessment: Fixed in FileCloud Server 23.263.2, which includes PHP 8.4.27, for Windows and Linux. Earlier Server versions are affected. This does not confirm completion of the separately announced FileCloud Online rollout.<br>FileCloud confirms that Server 23.263.2 includes PHP 8.4.27 and fixes both CVEs on Windows and Linux.|[source 1](<https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only>)<br>[source 2](<https://docs.filecloud.com/fcdoc/latest/server/security-advisories/2026-security-advisories/filecloud-release-23-263-security-advisories/advisory-2026-10-03-php2shell-critical-php-remote-code-execution-vulnerabilities>)|
|2026-10-23 13:33:24 +0200|FileRun|FileRun official Docker image (fixed PHP rebuild)|filerun/filerun:2026.03 rebuilt with fixed PHP, announced 2026-10-21|Fix|Fix|CVE assessment: FileRun confirms its official Docker image already includes the PHP fix and identifies filerun/filerun:2026.03 in the update instructions. Re-pull and recreate the container. Non-Docker FileRun installations still require a separate PHP update.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://filerun.com/index.php/php-security-alert-21oct26>)|
|2026-10-23 13:33:24 +0200|FrankenPHP|FrankenPHP static builds|FrankenPHP 1.13.2 static binaries with PHP 8.5.12|Fix|Fix|CVE assessment: Fixed in FrankenPHP 1.13.2 static binaries embedding PHP 8.5.12. Replace the embedded runtime binary; updating a separate system PHP installation does not repair older static builds.<br>FrankenPHP 1.13.2 publishes static binaries with PHP 8.5.12 fixing both PHP2Shell CVEs.|[source 1](<https://frankenphp.dev/docs/static/>)<br>[source 2](<https://www.php.net/archive/2026.php#2026-10-21-1>)<br>[source 3](<https://github.com/php/frankenphp/issues/2732>)<br>[source 4](<https://github.com/php/frankenphp/releases/tag/v1.13.2>)|
|2026-10-23 13:33:24 +0200|GLPI / Teclib|GLPI official Docker images (main, 12, 11, 10)|Official main / 12 / 11 / 10 image rebuilds announced 2026-10-21|Fix|Fix|CVE assessment: GLPI confirms rebuilt official Docker images for main, 12, 11 and 10 with patched PHP. Pull and recreate containers; updating GLPI application files or restarting an old container is insufficient. Other self-hosted deployments require their own PHP security update.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://www.glpi-project.org/en/%F0%9F%9A%A8-critical-php2shell-php-vulnerabilities-cve-2026-109618-cve-2026-109619-what-you-need-to-know-for-your-glpi-server/>)|
|2026-10-23 13:33:24 +0200|Grav project|Grav official Docker images (getgrav/grav)|getgrav/grav tags rebuilt 2026-10-21 with patched PHP|Fix|Fix|CVE assessment: Grav confirms all official getgrav/grav tags were rebuilt on 21 October 2026 with patched PHP for both CVEs. This applies to those replacement images; pull and recreate containers. Non-container Grav installations still require their own PHP update.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://mail.getgrav.org/blog/php-critical-security-release-october-2026>)|
|2026-10-23 13:33:24 +0200|grommunio GmbH|grommunio PHP packages for SUSE-based installations|Out-of-band PHP security packages announced 2026-10-21|Fix|Fix|CVE assessment: grommunio confirms its patched PHP packages are available in community and supported repositories for SUSE-based installations. The advisory does not give exact package revisions. Debian, Ubuntu and other distributions must obtain their own distribution PHP fixes; a grommunio Web application update alone does not fix those runtimes.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://grommunio.com/news/php2shell-patched-php-packages-available/>)|
|2026-10-23 13:33:24 +0200|Hestia Control Panel project|HestiaCP hestia-php internal runtime|hestia-php security update released 2026-10-22; Ubuntu 22.04+ and Debian 11+|Fix|Fix|CVE assessment: Fixed hestia-php packages were released on 22 October 2026 for Ubuntu 22.04+ and Debian 11+; the maintainer separately confirms Debian Bullseye publication. The notice does not identify an exact package revision. Hosted-site and system PHP remain separate update scopes.<br>HestiaCP's maintainer confirms released hestia-php updates for Ubuntu 22.04 and newer and Debian 11 and newer.|[source 1](<https://github.com/hestiacp/hestiacp/releases/tag/1.10.5>)<br>[source 2](<https://hestiacp.com/docs/contributing/building>)<br>[source 3](<https://hestiacp.com/docs/server-administration/configuration>)<br>[source 4](<https://github.com/hestiacp/hestiacp/commit/7d617fd1c5fd3be86458c7f53a6dad4a444b0a82>)<br>[source 5](<https://forum.hestiacp.com/t/hestia-1-10-5-release/22209>)<br>[source 6](<https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423>)<br>[source 7](<https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6333993141>)<br>[source 8](<https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6342235021>)|
|2026-10-23 13:33:24 +0200|Nextcloud GmbH / Nextcloud AIO maintainers|Nextcloud AIO Nextcloud application container|Nextcloud AIO 14.4.1|Fix|Fix|CVE assessment: Fixed in Nextcloud AIO 14.4.1, whose release directs users to upgrade for the PHP CVEs and includes the patched PHP dependencies. This assessment is limited to AIO; other Nextcloud distributions have independent runtimes.<br>Nextcloud AIO 14.4.1 ships updated PHP dependencies and is the project's published PHP2Shell security update.|[source 1](<https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile>)<br>[source 2](<https://github.com/nextcloud/all-in-one/issues/8876>)<br>[source 3](<https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1>)|
|2026-10-23 13:33:24 +0200|Part-DB project|Part-DB official Docker image (PHP 8.4.27 rebuild)|jbtronics/part-db1:2.20.2 rebuild containing PHP 8.4.27|Fix|Fix|CVE assessment: The Part-DB maintainer confirms a republished 2.20.2 image with PHP 8.4.27. This Fix is limited to that rebuilt image content: later ARM64 reports still show PHP 8.4.26 and have no maintainer resolution. Do not treat every architecture or cached 2.20.2 image as fixed; verify the selected image's serving runtime.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://github.com/Part-DB/Part-DB-server/issues/1615#issuecomment-6324675679>)<br>[source 2](<https://github.com/Part-DB/Part-DB-server/issues/1615>)|
|2026-10-23 13:33:24 +0200|phpLDAPadmin / leenooks project|phpLDAPadmin official Docker image|Docker release 2.3.12 (PHP 8.4.27)|Fix|Fix|CVE assessment: The phpLDAPadmin owner confirms Docker release 2.3.12 was pushed with PHP 8.4.27 in the issue for both PHP2Shell CVEs. Pull and recreate the container. This does not patch externally supplied PHP for non-container phpLDAPadmin deployments.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://github.com/leenooks/phpLDAPadmin/issues/491#issuecomment-6339838166>)|
|2026-10-23 13:33:24 +0200|Plesk|Plesk for Linux hosted PHP 7.4 and 8.0-8.5 fixed packages|PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; 7.4.33 / 8.0.30 / 8.1.34 built 2026-10-21|Fix|Fix|CVE assessment: Plesk confirms fixed Linux hosted PHP 8.2-8.5 packages and backports for 7.4.33, 8.0.30 and 8.1.34 built on 21 October 2026. The unchanged legacy version number alone is insufficient. PHP 5.6/7.2/7.3 and the internal sw-engine are separate update scopes.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-23 13:33:24 +0200|Plesk|Plesk for Windows hosted PHP 8.2-8.5 fixed packages|PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: Plesk confirms released Windows hosted PHP fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. This covers hosted PHP handlers only. The internal plesk-engine requires its separate Plesk update; older or custom handlers are outside this fixed scope.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-23 13:33:24 +0200|Plesk|Plesk plesk-engine internal PHP management runtime for Windows|Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4|Fix|Fix|CVE assessment: Fixed in Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4 for the internal management PHP engine: Linux sw-engine and Windows plesk-engine. Hosted-site PHP packages are separate and also require their applicable security updates.<br>Plesk confirms released fixes for the Windows plesk-engine internal PHP runtime in 18.0.80 Update 11 and 18.0.81 Update 4.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-23 13:33:24 +0200|Plesk|Plesk sw-engine internal PHP management runtime|Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4|Fix|Fix|CVE assessment: Fixed in Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4 for the internal management PHP engine: Linux sw-engine and Windows plesk-engine. Hosted-site PHP packages are separate and also require their applicable security updates.<br>Plesk confirms released fixes for the Linux sw-engine internal PHP runtime in 18.0.80 Update 11 and 18.0.81 Update 4.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://support.plesk.com/hc/en-us/articles/31743316866071-The-sw-engine-process-causes-high-CPU-usage-on-a-Plesk-server>)<br>[source 3](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-23 13:33:24 +0200|Red Hat|Red Hat Enterprise Linux 9 PHP 8.0 packages|php-0:8.0.30-8.el9_8.1 (RHSA-2026:87151)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:87151 and php-0:8.0.30-8.el9_8.1 as a fixed release for both CVEs. This backport is specific to RHEL 9 PHP 8.0; the broader RHEL 9 PHP family still includes an affected PHP 8.4 stream.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://access.redhat.com/errata/RHSA-2026:87151>)<br>[source 2](<https://access.redhat.com/security/cve/cve-2026-109618>)<br>[source 3](<https://access.redhat.com/security/cve/cve-2026-109619>)|
|2026-10-23 13:33:24 +0200|Red Hat|Red Hat Enterprise Linux 9 php:8.3 module|php:8.3-9080020261020115403.9 (RHSA-2026:87079)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:87079 and php:8.3-9080020261020115403.9 as a fixed release for both CVEs. This assessment covers the RHEL 9 php:8.3 module only; it does not cover the still-affected PHP 8.4 stream.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://access.redhat.com/errata/RHSA-2026:87079>)<br>[source 2](<https://access.redhat.com/security/cve/cve-2026-109618>)<br>[source 3](<https://access.redhat.com/security/cve/cve-2026-109619>)|
|2026-10-23 13:33:24 +0200|Roundcube project|Roundcube official 1.7.x-fpm-alpine Docker image|1.7.x-fpm-alpine rebuilt 2026-10-23 09:45 UTC (PHP 8.4.27)|Fix|Fix|CVE assessment: Roundcube's maintainer confirms correction of a regression that reintroduced an old fpm-alpine base. The published 1.7.x-fpm-alpine index was replaced on 23 October at 09:45 UTC; all five Linux platform configurations declare PHP 8.4.27. Scope is this verified index, not every historical tag or a running deployment.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6361850134>)<br>[source 2](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6361860529>)<br>[source 3](<https://hub.docker.com/v2/repositories/roundcube/roundcubemail/tags/1.7.x-fpm-alpine>)|
|2026-10-23 13:33:24 +0200|Shaarli community|Shaarli|Shaarli Docker v0.16.10 / v0.16 / release rebuilt with PHP 8.4.27|Fix|Fix|CVE assessment: Fixed in the official ghcr.io/shaarli/shaarli images v0.16.10, v0.16 and release rebuilt with PHP 8.4.27. The remaining open issue concerns build reproducibility. Non-container installations must update their own PHP runtime.<br>Shaarli's maintainer confirms fixed official Docker images with PHP 8.4.27 in the 0.16.10 release.|[source 1](<https://github.com/shaarli/Shaarli/blob/master/composer.json>)<br>[source 2](<https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435>)<br>[source 3](<https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6328236858>)<br>[source 4](<https://github.com/shaarli/Shaarli/releases/tag/v0.16.10>)|
|2026-10-23 13:33:24 +0200|Shlink project|Shlink official Docker image|shlinkio/shlink:5.1.8, published 2026-10-22|Fix|Fix|CVE assessment: Shlink 5.1.8 explicitly fixes both CVEs in its Docker images by moving to Alpine 3.24. Docker Hub confirms publication on 22 October after the initial build failure. Scope is the published image; non-container deployments must update their own PHP runtime.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://github.com/shlinkio/shlink/releases/tag/v5.1.8>)<br>[source 2](<https://hub.docker.com/v2/repositories/shlinkio/shlink/tags/5.1.8>)|
|2026-10-23 13:33:24 +0200|TuxCare / CloudLinux|TuxCare ELS PHP distribution family|TuxCare ELS security packages released by 2026-10-22 00:07 UTC; vendor-supported PHP/OS combinations|Fix|Fix|CVE assessment: CloudLinux's 22 October completed-release update confirms that TuxCare ELS fixed packages are released for alt-php, distribution PHP and Windows PHP. Scope is vendor-supported ELS packages; lower upstream PHP version numbers can contain backports, so verify the installed package revision and CVE changelog.<br>CloudLinux's completed release update confirms TuxCare ELS fixed packages for alt-php, distribution PHP and Windows PHP.|[source 1](<https://docs.tuxcare.com/els-for-runtimes/php/>)<br>[source 2](<https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability>)<br>[source 3](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)|
|2026-10-23 13:13:42 +0200|Broadcom|Carbon Black App Control Server|Broadcom ESG advisory 39404 affected product scope|Vulnerable|Vulnerable|CVE assessment: Broadcom ESG advisory 39404 lists Carbon Black App Control Server and Symantec Endpoint Protection Manager (SEPM) under Affected Product(s) for both PHP2Shell CVEs; the umbrella advisory does not state affected or fixed releases.<br>Broadcom ESG advisory 39404 lists Carbon Black App Control Server under Affected Product(s) for CVE-2026-109618 and CVE-2026-109619; the umbrella advisory does not state fixed releases.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-23 13:13:42 +0200|Broadcom|CloudSOC Cloud Access Security Broker (CASB)|Broadcom ESG advisory 39404 under-investigation product scope|Investigation|Investigation|CVE assessment: Broadcom ESG advisory 39404 lists CloudSOC Cloud Access Security Broker (CASB) and Content Analysis as under investigation for both PHP2Shell CVEs; affected and fixed releases are not published.<br>Broadcom ESG advisory 39404 lists CloudSOC Cloud Access Security Broker (CASB) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-23 13:13:42 +0200|Broadcom|Content Analysis|Broadcom ESG advisory 39404 under-investigation product scope|Investigation|Investigation|CVE assessment: Broadcom ESG advisory 39404 lists CloudSOC Cloud Access Security Broker (CASB) and Content Analysis as under investigation for both PHP2Shell CVEs; affected and fixed releases are not published.<br>Broadcom ESG advisory 39404 lists Content Analysis as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-23 13:13:42 +0200|Broadcom|Symantec Endpoint Protection Manager (SEPM)|Broadcom ESG advisory 39404 affected product scope|Vulnerable|Vulnerable|CVE assessment: Broadcom ESG advisory 39404 lists Carbon Black App Control Server and Symantec Endpoint Protection Manager (SEPM) under Affected Product(s) for both PHP2Shell CVEs; the umbrella advisory does not state affected or fixed releases.<br>Broadcom ESG advisory 39404 lists Symantec Endpoint Protection Manager (SEPM) under Affected Product(s) for CVE-2026-109618 and CVE-2026-109619; the umbrella advisory does not state fixed releases.|[source](<https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/Enterprise-Security-Group-Advisory-for-PHP2Shell/39404>)|
|2026-10-23 11:44:18 +0200|Tenable|Tenable Enclave Security|SC-202610.1 on Enclave Security 1.7.0 / 1.8.0 / 1.9.1 (PHP 8.2.35)|Fix|Fix|CVE assessment: Patch SC-202610.1 updates the bundled PHP to 8.2.35. Affected: Enclave Security 1.9.1 and earlier. Patch-supported scope: Security Center 6.7.5, 6.8.0 and 6.9.1 on Enclave Security 1.7.0, 1.8.0 and 1.9.1 respectively. Apply the matching vendor patch in the Security Center pod, following the documented service stop/start procedure; verify the patch applied successfully. Unpatched installations remain affected.<br>Tenable Enclave Security bundles a PHP runtime; vendor advisory TNS-2026-29 confirms CVE-2026-109618/109619 and a fix.|[source 1](<https://www.tenable.com/security/tns-2026-29>)<br>[source 2](<https://docs.tenable.com/release-notes/Content/enclave-security/2026.htm>)|
|2026-10-23 11:44:18 +0200|Tenable|Tenable Security Center (formerly Tenable.sc)|SC-202610.1 on Security Center 6.6.0 / 6.7.2 / 6.8.0 / 6.9.1 (PHP 8.2.35)|Fix|Fix|CVE assessment: Patch SC-202610.1 updates the bundled PHP to 8.2.35. Affected: Security Center 6.9.1 and earlier. Patch-supported scope: Security Center 6.6.0, 6.7.2, 6.8.0 and 6.9.1 on Oracle Linux or Red Hat Enterprise Linux 8 or later. Install the matching vendor patch and restart Security Center after installation; verify the patch applied successfully. Unpatched installations remain affected.<br>Tenable Security Center bundles a PHP runtime for its web console; vendor advisory TNS-2026-28 confirms CVE-2026-109618/109619 (CVSSv3 9.8) and a fix.|[source 1](<https://www.tenable.com/security/tns-2026-28>)<br>[source 2](<https://docs.tenable.com/release-notes/Content/security-center/2026.htm>)|
|2026-10-23 11:34:29 +0200|Amazon Web Services|AWS Elastic Beanstalk PHP platform|AL2023 PHP 8.2-8.5 platform version 4.13.13|Fix|Fix|CVE assessment: AWS confirms released AL2023 PHP platform 4.13.13 with upstream fixes: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier configuration-only platform update is not the fix recorded here.<br>Update the environment platform to the applicable 4.13.13 release; managed updates apply during the configured maintenance window.|[source 1](<https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html>)<br>[source 2](<https://aws.amazon.com/security/security-bulletins/2026-143-aws/>)<br>[source 3](<https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-21-al2023-php84-php85.html>)<br>[source 4](<https://docs.aws.amazon.com/elasticbeanstalk/latest/relnotes/release-2026-10-22-al2023-php82-php83.html>)|
|2026-10-23 11:34:29 +0200|Cisco|AppDynamics On-Premises Secure Application|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|AppDynamics PHP Agent|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|AppDynamics SaaS Secure Application|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco ASR 5000 Series Software (StarOS)|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Business Process Automation (BPA)|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Catalyst SD-WAN Manager|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Defense Orchestrator|Security Cloud Control - Firewall Management (formerly Defense Orchestrator)|Not vuln|Not vuln|CVE assessment: Cisco confirms Security Cloud Control - Firewall Management, formerly Cisco Defense Orchestrator, is not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Expressway Series|Expressway Series; affected release range not specified|Vulnerable|Vulnerable|CVE assessment: Cisco lists Expressway Series as vulnerable under CSCwx37062. The listed 15.5.21 fix has a TBD availability date and is not a confirmed released fix.<br>Monitor CSCwx37062 for an available fixed release; Cisco lists no workaround.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Hypershield|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Identity Services Engine (ISE)|ISE; excludes separately investigated ISE Portal Builder|Not vuln|Not vuln|CVE assessment: Cisco confirms ISE is not vulnerable. ISE Portal Builder remains separately under investigation; that component is not covered by this conclusion.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Multicloud Defense|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Nexus Dashboard Insights|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Policy Suite (CPS)|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Secure Access|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Secure Email Threat Defense|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Ultra Cloud Core - Policy Control Function|PCF / SMI scope named under Ultra Packet Core in the advisory|Not vuln|Not vuln|CVE assessment: Cisco confirms the named PCF and SMI products are not vulnerable; the advisory uses Ultra Packet Core naming for these Ultra Cloud Core components.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source 1](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)<br>[source 2](<https://www.cisco.com/c/en/us/td/docs/wireless/ucc/licensing/cisco-ultra-cloud-core-licensing-quick-reference.html>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure|PCF / SMI scope named under Ultra Packet Core in the advisory|Not vuln|Not vuln|CVE assessment: Cisco confirms the named PCF and SMI products are not vulnerable; the advisory uses Ultra Packet Core naming for these Ultra Cloud Core components.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source 1](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)<br>[source 2](<https://www.cisco.com/c/en/us/td/docs/wireless/ucc/licensing/cisco-ultra-cloud-core-licensing-quick-reference.html>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Ultra-Reliable Wireless Backhaul (URWB)|URWB; affected release range not specified|Vulnerable|Vulnerable|CVE assessment: Cisco lists URWB as vulnerable under CSCwx37073 and requires an authenticated administrator for exploitation. Release 27.1.1 is only estimated for February 2027, not an available fix.<br>Monitor CSCwx37073 for an available fixed release; do not treat its estimated date as released software.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco Vulnerability Management (formerly Kenna.VM)|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Cisco+ Secure Connect|Vendor-confirmed not vulnerable product scope|Not vuln|Not vuln|CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|Cisco|Webex|Webex Meetings, Webex Teams and Webex Web SDK only|Not vuln|Not vuln|CVE assessment: Cisco explicitly confirms Webex Meetings, Teams and Web SDK are not vulnerable. This assessment is limited to those named offerings, not every Webex-branded product.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-23 11:34:29 +0200|DDEV project|DDEV PHP webserver development container|DDEV 1.25.4 AMD64 project images rebuilt with PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: DDEV confirms tested AMD64 project-image rebuilds that install fixed PHP packages, including a package upgrade for bundled PHP 8.2-8.5. This is not a claim that stock 1.25.4 images or ARM64 images are fixed, or that planned 1.25.5 has shipped.<br>Follow DDEV's documented AMD64 PHP package-upgrade and no-cache rebuild procedure and verify the runtime. Public casual hosting and ddev share require patching; local-only exposure is treated separately by DDEV.|[source 1](<https://docs.ddev.com/en/stable/users/configuration/config/>)<br>[source 2](<https://ddev.com/blog/php2shell-what-ddev-users-need-to-know/>)|
|2026-10-23 11:34:29 +0200|Delta Controls|enteliWEB building management system|enteliWEB 4.29 or newer with SecB0015 security patch applied|Fix|Fix|CVE assessment: Delta Controls publishes an enteliWEB security patch for 4.29 and newer. Versions 4.28 and older must upgrade first and then apply the patch; an unpatched 4.29 installation is not fixed.<br>Upgrade older enteliWEB installations to 4.29 or newer, then apply the security patch. Keep exposure restrictions until patched; controller firmware is outside this product row.|[source 1](<https://deltacontrols.com/programs-services/cybersecurity/>)<br>[source 2](<https://deltacontrols.com/wp-content/uploads/SecB0015_Security_Bulletin.pdf>)|
|2026-10-23 11:34:29 +0200|F5|BIG-IP APM PHP page templates|BIG-IP APM 17.1.0-17.1.3 / 17.5.0-17.5.1 / 21.1.0|Vulnerable|Vulnerable|CVE assessment: F5 confirms BIG-IP APM/SSLO access-profile data-plane exposure in the listed releases, in addition to the Configuration utility. No introduced fix is listed; this does not assert every PHP template is reachable.<br>Apply F5's APM-specific mitigation guidance and restart requirements after staging validation; monitor for released fixes.|[source 1](<https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html>)<br>[source 2](<https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/advanced-customization-using-logon-page-templates.html>)<br>[source 3](<https://my.f5.com/manage/s/article/K000163821>)|
|2026-10-23 11:34:29 +0200|F5|BIG-IP TMOS platform PHP|BIG-IP 17.1.0-17.1.3 / 17.5.0-17.5.1 / 21.1.0|Vulnerable|Vulnerable|CVE assessment: F5 confirms the BIG-IP Configuration utility control plane is affected across all modules in the listed releases. K000163821 lists no introduced fix; its mitigations are not recorded as fixed software.<br>Apply F5's Configuration utility access restrictions and staged PHP mitigation guidance while monitoring for an available fixed release.|[source 1](<https://cdn.f5.com/product/bugtracker/ID1270257.html>)<br>[source 2](<https://my.f5.com/manage/s/article/K000133753>)<br>[source 3](<https://my.f5.com/manage/s/article/K000163821>)|
|2026-10-23 11:34:29 +0200|Fortinet|FortiADC|Vendor-confirmed not impacted product scope|Not vuln|Not vuln|CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source 1](<https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/db39ff41-6283-11f0-a9d0-d2b0d2e22f7d/fortiadc-v7.4.8-cli-reference-guide.pdf>)<br>[source 2](<https://docs2.fortinet.com/document/fortiadc/7.4.11/handbook/406890/solutions-by-issue-type>)<br>[source 3](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-23 11:34:29 +0200|Fortinet|FortiADC Manager|Vendor-confirmed not impacted product scope|Not vuln|Not vuln|CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-23 11:34:29 +0200|Fortinet|FortiEndpoint|Vendor-confirmed not impacted product scope|Not vuln|Not vuln|CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-23 11:34:29 +0200|Fortinet|FortiMonitor|Vendor-confirmed not impacted product scope|Not vuln|Not vuln|CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-23 11:34:29 +0200|Fortinet|FortiSIEM|Vendor-confirmed not impacted product scope|Not vuln|Not vuln|CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs.<br>Official vendor non-vulnerability confirmation reviewed 2026-10-23.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-23 11:34:29 +0200|Lime Technology / Unraid|Unraid PHP management runtime distribution|Unraid OS 7.3.4 (PHP 8.4.27)|Fix|Fix|CVE assessment: Unraid's official administrator announcement confirms OS 7.3.4 includes PHP 8.4.27 fixing both CVEs. This does not cover separately maintained Docker or VM runtimes or the libvirt-php binding.<br>Update Unraid OS to 7.3.4; assess independently maintained application runtimes separately.|[source 1](<https://docs.unraid.net/unraid-os/release-notes/7.3.2/>)<br>[source 2](<https://docs.unraid.net/unraid-os/release-notes/7.4.0/>)<br>[source 3](<https://forums.unraid.net/topic/200990-unraid-os-734-now-available/>)|
|2026-10-23 11:34:29 +0200|Microsoft|Azure App Service PHP on Linux|Linux built-in PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 on Latest and Standard|Fix|Fix|CVE assessment: The Azure App Service team confirms completed rollout of fixed built-in Linux PHP images to Latest and Standard. Extended, EOL runtimes and customer-maintained containers are not covered by that completion statement.<br>Use a supported runtime on Latest or Standard and verify the running PHP patch version; rebuild custom containers separately.|[source 1](<https://learn.microsoft.com/en-us/azure/app-service/configure-language-php>)<br>[source 2](<https://azure.github.io/AppService/2026/10/21/php-critical-security-release-app-service-linux.html>)<br>[source 3](<https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623>)|
|2026-10-23 11:34:29 +0200|N-able|Mail Assure / Spam Experts|Vendor platform fixes completed 22 October 2026 at 18:30 EDT|Fix|Fix|CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing.<br>No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-23 11:34:29 +0200|N-able|N-sight|Vendor platform fixes completed 22 October 2026 at 18:30 EDT|Fix|Fix|CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing.<br>No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-23 11:34:29 +0200|N-able|Passportal|Vendor platform fixes completed 22 October 2026 at 18:30 EDT|Fix|Fix|CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing.<br>No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-23 11:34:29 +0200|N-able|Take Control Session routing|Vendor platform fixes completed 22 October 2026 at 18:30 EDT|Fix|Fix|CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing.<br>No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-23 11:34:29 +0200|NixOS / Nixpkgs maintainers|Nixpkgs PHP runtime environments|Nixpkgs PHP 8.3.36 / 8.4.27 / 8.5.12; updated nixos-26.05-small and nixos-unstable-small inputs|Fix|Fix|CVE assessment: Nixpkgs merged PR 576853 fixing both CVEs; a maintainer confirms delivery to the small channels. Other channels and pinned inputs are not assumed updated, and this finding does not claim a PHP 8.2 fix from that PR.<br>Update the applicable Nixpkgs input/channel, rebuild and activate services, and verify the running PHP version.|[source 1](<https://nixos.org/manual/nixpkgs/stable/>)<br>[source 2](<https://wiki.nixos.org/w/index.php?title=PHP&oldid=33628>)<br>[source 3](<https://github.com/NixOS/nixpkgs/pull/576853>)<br>[source 4](<https://github.com/NixOS/nixpkgs/pull/576853#issuecomment-6337965090>)|
|2026-10-23 11:34:29 +0200|phpMyFAQ project|phpMyFAQ|phpMyFAQ deployments on affected PHP-CGI runtimes|Vulnerable|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown; The phpMyFAQ team's 21 October notice explicitly reports CVE-2026-109618 exposure on PHP-CGI. It does not assess CVE-2026-109619; that CVE remains Investigation. No application-code fix or complete configuration workaround is asserted.<br>Update the deployed PHP runtime using the official PHP security guidance; do not treat the notice's CGI configuration suggestion as a complete fix.|[source 1](<https://github.com/thorsten/phpMyFAQ/blob/main/composer.json>)<br>[source 2](<https://github.com/thorsten/phpMyFAQ/blob/main/docs/release.md>)<br>[source 3](<https://phpmyfaq.de/>)|
|2026-10-23 11:34:29 +0200|Render; customer/base-image publisher|Render customer PHP Docker hosting|Customer PHP Docker services running unpatched affected runtimes|Vulnerable|Vulnerable|CVE assessment: Render's official advisory directs customers to patch and redeploy their PHP Docker services for both CVEs. This is customer-container exposure, not a vulnerability assertion about Render's control plane or every deployed service.<br>Rebuild or obtain patched PHP images, redeploy each affected service, and verify the runtime serving web requests; Render does not automatically patch customer images.|[source 1](<https://render.com/docs/deploy-php-laravel-docker>)<br>[source 2](<https://render.com/docs/docker>)<br>[source 3](<https://render.com/docs/advisory-php2shell>)|
|2026-10-23 11:34:29 +0200|Sophos|MyUTM portal|MyUTM hosted licensing portal before vendor PHP update|Vulnerable|Vulnerable|CVE assessment: Sophos advisory version 4 confirms the MyUTM hosted portal ran affected PHP and was taken offline pending its update. The separate statement that Sophos products are not affected does not exclude this hosted service.<br>Use Sophos Support for licensing while the portal is offline; no completed portal fix is asserted.|[source](<https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell>)|
|2026-10-23 11:34:29 +0200|SUSE|SUSE Linux Enterprise PHP8 package families|SLE 15 SP4: 8.0.30-150400.4.80.1; SP6: 8.2.35-150600.3.39.1; SP7: 8.3.36-150700.3.24.1; SLES 16.0: 8.4.27-160000.1.1|Fix|Fix|CVE assessment: SUSE publishes fixed PHP8 packages for the listed SLE product branches. This does not assert that every SLE service pack or PHP package family is fixed; use the matching product-specific advisory.<br>Install the product-specific SUSE security update and restart affected PHP services; do not select a package built for another SLE branch.|[source 1](<https://documentation.suse.com/releasenotes/sles/15-SP6/index.html>)<br>[source 2](<https://www.suse.com/support/update/announcement/2026/suse-su-20264651-1/>)<br>[source 3](<https://www.suse.com/security/cve/CVE-2026-109618.html>)<br>[source 4](<https://www.suse.com/security/cve/CVE-2026-109619.html>)<br>[source 5](<https://www.suse.com/support/update/announcement/2026/suse-su-20264843-1/>)<br>[source 6](<https://www.suse.com/support/update/announcement/2026/suse-su-20264844-1/>)<br>[source 7](<https://www.suse.com/support/update/announcement/2026/suse-su-20264852-1/>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 7.3 archived package family|Synology PHP 7.3; end of life|Vulnerable|Vulnerable|CVE assessment: Synology-SA-26:14 lists PHP 7.3 as affected by both CVEs and states that no fix will be provided because the package is end of life.<br>Migrate dependent applications to a supported, fixed Synology PHP package; do not expect a PHP 7.3 fix.|[source 1](<https://archive.synology.com/download/Package/PHP7.3/7.3.33-0173>)<br>[source 2](<https://archive.synology.com/download/Package/PHP7.3>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 7.4 archived package family|7.4.33-0131 or above in the corresponding Synology PHP branch|Fix|Fix|CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected.<br>Update the corresponding PHP package through DSM Package Center and verify dependent services restart.|[source 1](<https://archive.synology.com/download/Package/PHP7.4/7.4.33-0140>)<br>[source 2](<https://archive.synology.com/download/Package/PHP7.4>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 8.0 archived package family|8.0.30-0122 or above in the corresponding Synology PHP branch|Fix|Fix|CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected.<br>Update the corresponding PHP package through DSM Package Center and verify dependent services restart.|[source 1](<https://archive.synology.com/download/Package/PHP8.0/8.0.30-0121>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.0>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 8.1 archived package family|8.1.34-0120 or above in the corresponding Synology PHP branch|Fix|Fix|CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected.<br>Update the corresponding PHP package through DSM Package Center and verify dependent services restart.|[source 1](<https://archive.synology.com/download/Package/PHP8.1/8.1.34-0110>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.1>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 8.2 archived package family|8.2.35-0171 or above in the corresponding Synology PHP branch|Fix|Fix|CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected.<br>Update the corresponding PHP package through DSM Package Center and verify dependent services restart.|[source 1](<https://archive.synology.com/download/Package/PHP8.2/8.2.30-0170>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.2>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 8.3 archived package family|8.3.36-0051 or above in the corresponding Synology PHP branch|Fix|Fix|CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected.<br>Update the corresponding PHP package through DSM Package Center and verify dependent services restart.|[source 1](<https://archive.synology.com/download/Package/PHP8.3/8.3.30-0050>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.3>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology PHP 8.4 package distribution|8.4.27-0051 or above in the corresponding Synology PHP branch|Fix|Fix|CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected.<br>Update the corresponding PHP package through DSM Package Center and verify dependent services restart.|[source 1](<https://archive.synology.com/download/Package/PHP8.4/8.4.19-0050>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.4>)<br>[source 3](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)|
|2026-10-23 11:34:29 +0200|Synology|Synology Web Station optional PHP hosting|Web Station with vendor-patched PHP packages from Synology-SA-26:14|Fix|Fix|CVE assessment: Synology names Web Station among affected PHP-dependent packages and says updating PHP resolves the vulnerabilities after dependent packages restart. This is a PHP dependency fix, not a separate Web Station release.<br>Update the applicable PHP package through Package Center; supported fixed branches and builds are listed in Synology-SA-26:14. DSM versions older than 7.2 require the vendor's additional upgrade guidance.|[source 1](<https://www.synology.com/en-global/dsm/7.4/software_spec/web_station>)<br>[source 2](<https://www.synology.com/en-global/security/advisory/Synology_SA_26_14>)<br>[source 3](<https://www.synology.com/en-us/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities>)|
|2026-10-23 11:34:29 +0200|TransIP|TransIP shared webhosting PHP option|Shared-hosting PHP patches deployed 21 October 2026, including 7.4 / 8.0 / 8.1|Fix|Fix|CVE assessment: TransIP confirms all PHP versions offered on its shared-webhosting platform were patched. Customer-managed VPS, Kubernetes and OpenStack PHP installations are excluded and require customer updates.<br>No action required on TransIP shared webhosting; separately patch customer-managed PHP environments.|[source 1](<https://www.transip.nl/knowledgebase/5987-wil-php-versie-mijn-website-wijzigen>)<br>[source 2](<https://www.transip.nl/knowledgebase/website-troubleshooting/kritieke-php-kwetsbaarheden-cve-2026-109618-en-cve-2026-109619>)|
|2026-10-23 11:34:29 +0200|Trend Micro|Apex Central|Apex Central; vendor version ranges not specified|Vulnerable|Vulnerable|CVE assessment: Trend Micro KA-0024802, updated 23 October, confirms Apex Central is impacted and mitigation is in development; no released fix is identified.<br>Monitor KA-0024802 for vendor hotfixes or critical patches and restrict management access to trusted networks.|[source 1](<https://files.trendmicro.com/documentation/readme/CP/apexcentral_win_en_criticalpatch_b7328_Readme.html>)<br>[source 2](<https://success.trendmicro.com/en-US/solution/KA-0024802>)|
|2026-10-23 11:34:29 +0200|Trend Micro|Apex One|Apex One on-premises server; vendor version ranges not specified|Vulnerable|Vulnerable|CVE assessment: Trend Micro KA-0024802, updated 23 October, confirms Apex One on-premises server is impacted and mitigation is in development. Apex One as a Service is a separate scope.<br>Monitor KA-0024802 for vendor hotfixes or critical patches and restrict management access to trusted networks.|[source 1](<https://files.trendmicro.com/documentation/readme/Apex%20One/2020/apex_one_2019_win_cp_b20105_EN_hotfix_Readme.html>)<br>[source 2](<https://success.trendmicro.com/en-US/solution/KA-0024802>)|
|2026-10-23 11:34:29 +0200|UnoPim|UnoPim|Rebuilt webkul/unopim 3.1.3 / 3.1 / latest with PHP 8.4.27|Fix|Fix|CVE assessment: An UnoPim collaborator confirms published images were rebuilt with PHP 8.4.27 fixing both CVEs. The web image digest is sha256:733a1ac27259acd59a9542eefbde1417edfc1920458b52dcc7fa1fd09f03ca50; cached copies of the same tags are not fixed.<br>Pull the rebuilt image by verified digest and recreate containers. Custom FPM builds and existing cached images need separate rebuilding and verification.|[source 1](<https://github.com/unopim/unopim>)<br>[source 2](<https://api.github.com/repos/unopim/unopim/dependency-graph/sbom>)<br>[source 3](<https://github.com/unopim/unopim/pull/787#issuecomment-6345365916>)<br>[source 4](<https://github.com/unopim/unopim/pull/791#issuecomment-6345463242>)|
|2026-10-23 11:34:29 +0200|WP Engine|WP Engine managed WordPress PHP hosting|Vendor-patched managed PHP infrastructure, confirmed 22 October 2026|Fix|Fix|CVE assessment: WP Engine confirms all customer sites run fully patched PHP after deployment of official LTS-provider patches, separately from its earlier WAF and configuration mitigations.<br>No customer action required for the managed hosting scope covered by WP Engine's confirmation.|[source 1](<https://wpengine.com/support/php-guide/>)<br>[source 2](<https://wpengine.com/blog/php-vulnerability-update/>)|
|2026-10-23 10:50:06 +0200|Server Side Up|Server Side Up PHP Docker images, v5.0.2 for PHP 8.2-8.5|v5.0.2: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 image variants|Fix|Fix|CVE assessment: The publisher reports v5.0.2 images for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 rebuilt and tested for CVE-2026-109618. This assessment covers those versioned image variants only. PHP 8.1.34 remains unpatched; image digests and running deployments were not verified.; The publisher reports v5.0.2 images for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 rebuilt and tested for CVE-2026-109619. This assessment covers those versioned image variants only. PHP 8.1.34 remains unpatched; image digests and running deployments were not verified.<br>Publisher reports fixed v5.0.2 Docker images for PHP 8.2-8.5; image digests and deployed workers were not verified.|[source 1](<https://github.com/serversideup/docker-php/releases/tag/v5.0.2>)<br>[source 2](<https://github.com/docker-library/php/pull/1694>)|
|2026-10-23 00:48:02 +0200|UnoPim|UnoPim official Docker images (webkul/unopim, webkul/unopim-queue)|Images 3.1.3 / 3.1 / latest rebuilt 2026-10-22 on PHP 8.4.27|Fix|Fix|CVE assessment: UnoPim's v3.1.3 release note confirms the official webkul/unopim and webkul/unopim-queue images were rebuilt on PHP 8.4.27 for both CVEs. This confirms the named Docker image scope only; self-hosted installs must update their own PHP runtime and cached/running containers require pull and redeploy.<br>Vendor-confirmed fix available in the named official Docker image scope; see the CVE assessment for self-hosted and deployment caveats.|[source 1](<https://github.com/unopim/unopim/releases/tag/v3.1.3>)<br>[source 2](<https://github.com/unopim/unopim/pull/787>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiADC Manager||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiADC Manager as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiClient Cloud Services||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiClient Cloud Services as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiDDoS||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiDDoS as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiDDoS-F||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiDDoS-F as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiEndpoint||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiEndpoint as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiMonitor||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiMonitor as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiSIEM||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiSIEM as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiSOAR||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiSOAR as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 17:28:33 +0200|Fortinet|FortiSOAR PaaS||Investigation|Investigation|CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published<br>Fortinet PSIRT advisory FG-IR-26-186 lists FortiSOAR PaaS as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://fortiguard.fortinet.com/psirt/FG-IR-26-186>)|
|2026-10-22 16:13:43 +0200|EfficientIP|EfficientIP DNS and network automation product suite||Investigation|Investigation|CVE assessment: Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available.<br>A trusted party reported to NCSC-NL that EfficientIP management interfaces for DNS and network automation products use .php URL paths; exact product scope and PHP runtime details are not publicly confirmed.|Reported to NCSC-NL by trusted party; no official vendor information available.|
|2026-10-22 16:13:43 +0200|Entelliweb|Entelliweb building management system||Investigation|Investigation|CVE assessment: Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available.<br>A trusted party reported to NCSC-NL that the Entelliweb building management system uses .php URL paths in its management interface; exact product release and PHP runtime details are not publicly confirmed.|Reported to NCSC-NL by trusted party; no official vendor information available.|
|2026-10-22 15:30:07 +0200|QNAP|QNAP Note Station 3|Note Station 3 3.9.14 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists Note Station 3 3.9.14 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP QNE (ADRA)|QNE (ADRA) 1.0.7 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists QNE (ADRA) 1.0.7 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP QTS built-in PHP runtime|QTS 6.1.0; QTS 5.2.11 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists QTS 6.1.0 and QTS 5.2.11 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed versions are to be announced.|[source 1](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)<br>[source 2](<https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero>)<br>[source 3](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP QuMagie|QuMagie 2.10.1 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 identifies QuMagie 2.10.1 and earlier in its affected-products header for CVE-2026-109618 and CVE-2026-109619; fixed version is not yet published.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP QuTS hero built-in PHP runtime|QuTS hero h6.1.0; QuTS hero h6.0.x; QuTS hero h5.2.11 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists QuTS hero h6.1.0, QuTS hero h6.0.x and QuTS hero h5.2.11 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed versions are to be announced.|[source 1](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)<br>[source 2](<https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero>)<br>[source 3](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP QuTScloud|QuTScloud c5.2.9 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists QuTScloud c5.2.9 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP QVR Surveillance|QVR Surveillance 3.0.3 and earlier (ARM32 models)|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists QVR Surveillance 3.0.3 and earlier on ARM32 models as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:30:07 +0200|QNAP|QNAP TVR OS|TVR OS 1.0.4 and earlier|Vulnerable|Vulnerable|CVE assessment: QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.<br>QNAP QSA-26-18 lists TVR OS 1.0.4 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.|[source](<https://www.qnap.com/en/security-advisory/qsa-26-18>)|
|2026-10-22 15:17:07 +0200|Cisco|AppDynamics On-Premises Secure Application||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists AppDynamics On-Premises Secure Application as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|AppDynamics PHP Agent||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists AppDynamics PHP Agent as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|AppDynamics SaaS Secure Application||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists AppDynamics SaaS Secure Application as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco AI Defense (hybrid on-premises deployment)||Not vuln|Not vuln|Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco AI Defense (hybrid on-premises deployment) as not vulnerable to CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco ASR 5000 Series Software (StarOS)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco ASR 5000 Series Software (StarOS) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Business Process Automation (BPA)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Business Process Automation (BPA) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Catalyst Center (formerly DNA Center)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Catalyst Center (formerly DNA Center) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Catalyst SD-WAN Manager||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Catalyst SD-WAN Manager as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco CX Cloud||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco CX Cloud as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Defense Orchestrator||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Defense Orchestrator as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Expressway Series||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Expressway Series as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Hypershield||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Hypershield as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Identity Services Engine (ISE)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Identity Services Engine (ISE) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco IoT Control Center||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco IoT Control Center as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Multicloud Defense||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Multicloud Defense as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Nexus Dashboard Insights||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Nexus Dashboard Insights as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Panoptica||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Panoptica as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Policy Suite (CPS)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Policy Suite (CPS) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Secure Access||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Secure Access as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Secure Email Threat Defense||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Secure Email Threat Defense as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Ultra Cloud Core - Converged Policy and Charging||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra Cloud Core - Converged Policy and Charging as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Ultra Cloud Core - Policy Control Function||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra Cloud Core - Policy Control Function as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Ultra-Reliable Wireless Backhaul (URWB)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra-Reliable Wireless Backhaul (URWB) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Umbrella||Not vuln|Not vuln|Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco Umbrella as not vulnerable to CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Unified Industrial Wireless Software||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Unified Industrial Wireless Software as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco Vulnerability Management (formerly Kenna.VM)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Vulnerability Management (formerly Kenna.VM) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco WAN Automation Engine (WAE)||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco WAN Automation Engine (WAE) as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Cisco+ Secure Connect||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco+ Secure Connect as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Slido||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Slido as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:17:07 +0200|Cisco|Webex||Investigation|Investigation|CVE assessment: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet<br>Cisco advisory cisco-sa-php-october26-Jj384Daq lists Webex as under investigation for CVE-2026-109618 and CVE-2026-109619.|[source](<https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq>)|
|2026-10-22 15:08:35 +0200|Check Point|Check Point firewall web interfaces|Force/Cloud: R81.20, R82, R82.10, R82.20; EoS R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10. Spark: R81.10.x, R82.00.x; EoS R77.20.x, R80.20.x|Vulnerable|Vulnerable|CVE assessment: Check Point sk1000302 identifies listed Force, Spark and Cloud Firewall web interfaces as affected when specified portal or VPN features are enabled; Jumbo Hotfix fixes are planned for 2026-11-11.<br>Check Point sk1000302 identifies both CVEs as affecting listed Force, Spark and Cloud Firewall web interfaces only when specified portal or VPN features are enabled; Check Point Portal and SaaS services are already patched.|[source](<https://support.checkpoint.com/results/sk/sk1000302>)|
|2026-10-22 14:30:40 +0200|Citrix / NetScaler|NetScaler ADC|All supported NetScaler software versions impacted; fixed PHP package pending|Vulnerable|Vulnerable|CVE assessment: NetScaler says its PHP-based Management Portal is impacted in all supported software versions; fix pending. Scope is the NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI; Console and SVM are not impacted.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619 in the PHP-based NetScaler Management Portal; fixed package pending.|[source 1](<https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf>)<br>[source 2](<https://prod-docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/signatures/signature-auto-update>)<br>[source 3](<https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/>)|
|2026-10-22 11:25:32 +0200|Coolify|Coolify|Coolify 4.0.1 / 4.1.3 / 4.2.1 / 4.3.24 / 4.4.7 on their respective v4 lines|Fix|Fix|CVE assessment: Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://github.com/coollabsio/coolify/blob/main/composer.json>)<br>[source 2](<https://api.github.com/repos/coollabsio/coolify/dependency-graph/sbom>)<br>[source 3](<https://github.com/coollabsio/coolify/issues/12266>)|
|2026-10-22 11:25:32 +0200|Firefly III project|Firefly III|Rebuilt existing Firefly III container tags with PHP 8.5.12; maintainer confirmation 2026-10-21|Fix|Fix|CVE assessment: Firefly III's maintainer JC5 explicitly confirms that Firefly III and its data importer now run PHP 8.5.12 and closes the CVE issue. Existing image tags were rebuilt without a new application release. This confirms the container runtime fix, not a PHP update for independently hosted non-container installations.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://github.com/firefly-iii/firefly-iii>)<br>[source 2](<https://api.github.com/repos/firefly-iii/firefly-iii/dependency-graph/sbom>)<br>[source 3](<https://github.com/firefly-iii/firefly-iii/issues/13087#issuecomment-6324447202>)|
|2026-10-22 11:25:32 +0200|FreeBSD Project / ports maintainers|FreeBSD PHP port and mod_php package integration|Ports source: php82 8.2.35; php83 8.3.36; php84 8.4.27; php85 8.5.12|Fix|Fix|CVE assessment: FreeBSD VuXML names both CVEs and the fixed PHP branch thresholds. Current official main-branch port Makefiles independently select those fixed releases. This confirms corrected ports source, not binary package availability for every architecture/quarterly repository or all mod_php subpackages; no installed system was tested.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://lists.freebsd.org/archives/dev-commits-ports-branches/2026-August/014722.html>)<br>[source 2](<https://docs.freebsd.org/en/books/handbook/network-servers/>)<br>[source 3](<https://www.vuxml.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html>)<br>[source 4](<https://www.vuxml.org/freebsd/vuln.xml>)<br>[source 5](<https://github.com/freebsd/freebsd-ports/blob/main/lang/php82/Makefile>)<br>[source 6](<https://github.com/freebsd/freebsd-ports/blob/main/lang/php83/Makefile>)<br>[source 7](<https://github.com/freebsd/freebsd-ports/blob/main/lang/php84/Makefile>)<br>[source 8](<https://github.com/freebsd/freebsd-ports/blob/main/lang/php85/Makefile>)|
|2026-10-22 11:25:32 +0200|Homebrew maintainers|Homebrew PHP formula and bottles|Homebrew php 8.5.12, revision 0; formula source SHA-256 e1fe7d4bad28b3d65b67ac83013fd0dd78d4aa1fe55ca95124e8213bc4c17ab5|Fix|Fix|CVE assessment: Homebrew's live formula/API publishes PHP 8.5.12 and bottle metadata for the listed macOS ARM and Linux architectures, sourced from PHP's fixed 8.5.12 tarball. PHP's official advisory confirms this release fixes both CVEs. This confirmation is scoped to php 8.5.12, not EOL php@8.1 or all older bottles; binaries were not downloaded or executed.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://formulae.brew.sh/formula/php>)<br>[source 2](<https://formulae.brew.sh/api/formula/php.json>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-22 11:25:32 +0200|Kinsta|Kinsta managed WordPress PHP hosting|Platform-wide PHP security rollout completed 2026-10-22 08:26 UTC; covered branches 7.4 / 8.0 / 8.1 / 8.2 / 8.3 / 8.4 / 8.5|Fix|Fix|CVE assessment: Kinsta's official incident reports the PHP security updates rolled out across the platform at 08:26 UTC on 22 October, following explicit branch-by-branch patch rollout updates. This records the vendor's completed managed-platform remediation, not a published independent package build ID or a guarantee about prior compromise.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://kinsta.com/docs/wordpress-hosting/php/>)<br>[source 2](<https://status.kinsta.com/incidents/c0c6xl1ghpb2>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-22 11:25:32 +0200|Laravel|Laravel Cloud PHP runtime option|Laravel Cloud managed runtimes: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: Laravel's official response, updated 21 October 23:26 UTC, confirms every running Cloud application was patched in place and new deployments use fixed base images. No customer redeploy was needed. This finding is limited to Laravel Cloud, not arbitrary self-hosted Laravel applications.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://laravel.com/cloud/docs/runtimes>)<br>[source 2](<https://laravel.com/cloud/docs/environments>)<br>[source 3](<https://laravel.com/blog/php-critical-vulnerability-response-updates>)<br>[source 4](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-22 11:25:32 +0200|Laravel; AWS infrastructure|Laravel Vapor PHP serverless hosting configuration|Laravel Vapor native PHP 8.2+ patched runtimes; PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: Laravel confirms the patched Vapor runtimes are live. Native PHP 8.2+ applications must be redeployed; custom/Docker runtime applications need a new build/deployment. PHP 8.0 and 8.1 are explicitly excluded from the available patch confirmation and must be upgraded.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://docs.vapor.build/projects/environments>)<br>[source 2](<https://laravel.com/blog/php-critical-vulnerability-response-updates>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-22 11:25:32 +0200|Netgate / pfSense|pfSense management components|Updated PHP packages: pfSense Plus 26.07 / 26.03.1 and CE 2.9.0: PHP 8.5.12; CE 2.8.1: PHP 8.3.36|Fix|Fix|CVE assessment: Netgate explicitly identifies both CVEs and confirms published fixed PHP packages for the named pfSense Plus/CE releases. Existing installations require the command-line package update, not just a GUI update. GUI and Captive Portal exposure are configuration-specific; older releases are not included in this fix confirmation.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://www.netgate.com/blog/the-new-gui-for-pfsense-plus>)<br>[source 2](<https://docs.netgate.com/pfsense/en/latest/development/additional-php-modules.html>)<br>[source 3](<https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html>)<br>[source 4](<https://docs.netgate.com/pfsense/en/latest/releases/26-07.html>)<br>[source 5](<https://docs.netgate.com/pfsense/en/latest/nexus/options.html>)<br>[source 6](<https://www.netgate.com/blog/critical-php-security-update>)|
|2026-10-22 11:25:32 +0200|OpenEMR project|OpenEMR|Binary Docker recipe b171ac28a57e5da96b1b8eaceb7324edac045948; Forge release 10212026 with PHP 8.5.12 (OpenEMR 8.4.1)|Fix|Fix|CVE assessment: OpenEMR's maintainer merged PR 14773, adopting the published binary-forge release 10212026 with fixed PHP 8.5.12. This confirms the corrected binary Docker recipe and its named forge build only. The separate standard Alpine-image update PR 14771 was still unmerged when reviewed; no blanket fix for all OpenEMR distributions is claimed.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://github.com/openemr/openemr/blob/master/composer.json>)<br>[source 2](<https://github.com/openemr/openemr/pull/14773>)<br>[source 3](<https://github.com/openemr/openemr/blob/b171ac28a57e5da96b1b8eaceb7324edac045948/docker/binary/README.md>)|
|2026-10-22 11:25:32 +0200|OpenWrt packages feed maintainers|OpenWrt selectable PHP8 package family|Merged package recipes: master/openwrt-25.12 PHP 8.4.27; openwrt-24.10 PHP 8.3.36|Fix|Fix|CVE assessment: OpenWrt member-authored security update PRs explicitly name both CVEs and are merged into the named package-feed branches. This confirms fixed package source recipes, not a completed binary mirror or firmware rollout for every target. Devices without the optional PHP packages are outside this record's runtime scope.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://github.com/openwrt/packages/blob/master/lang/php8/Makefile>)<br>[source 2](<https://github.com/openwrt/packages/pull/30844>)<br>[source 3](<https://github.com/openwrt/packages/pull/30845>)<br>[source 4](<https://github.com/openwrt/packages/pull/30847>)|
|2026-10-22 11:25:32 +0200|OPNsense / Deciso|OPNsense WebGUI and API|Community 26.7.7 PHP hotfix: 8.5.12; Business 26.4.2p3 PHP hotfix: 8.3.36|Fix|Fix|CVE assessment: The OPNsense team's Administrator announcement explicitly confirms a released hotfix for both CVEs in Community 26.7.7 and Business 26.4.2p3. Install the PHP hotfix even if the displayed product release already matches; captive portal users must restart that service afterward.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://docs.opnsense.org/releases/CE_26.7.html>)<br>[source 2](<https://docs.opnsense.org/development/frontend/routing.html>)<br>[source 3](<https://forum.opnsense.org/index.php?topic=53191.msg276103>)|
|2026-10-22 11:25:32 +0200|Pantheon|Pantheon managed PHP application runtime|Patched production/LTS and paid pre-production runtimes; upstream PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 plus vendor LTS backports|Fix|Fix|CVE assessment: Pantheon's current official incident API confirms patched live production, LTS, SFTP-mode and paid pre-production environments. The 22 October update leaves free/sandbox environments pending over the next 24-48 hours. This is a scoped confirmed fix, not fleet-wide completion; customers should follow their environment-specific status.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://docs.pantheon.io/guides/php>)<br>[source 2](<https://docs.pantheon.io/release-notes/2026/09/php-82-83-84-85-security-updates>)<br>[source 3](<https://status.pantheon.io/incidents/x7h8z1yhgvml>)<br>[source 4](<https://status.pantheon.io/api/v2/incidents/x7h8z1yhgvml.json>)|
|2026-10-22 11:25:32 +0200|Scalingo|Scalingo PaaS|Scalingo PHP runtimes 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 available since 2026-10-21 16:40 UTC+2|Fix|Fix|CVE assessment: Scalingo SSB-2026-005 explicitly names both CVEs and confirms all four fixed runtimes are available. Customers must rebuild/redeploy with compatible constraints and verify the deployed PHP version. Router multipart blocking is separate mitigation and does not update the runtime or prove a fix in an old deployment.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source](<https://doc.scalingo.com/security/bulletins/ssb-2026-005>)|
|2026-10-22 11:25:32 +0200|Scalingo|Scalingo PHP buildpack|Buildpack-selected PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: Scalingo confirms the buildpack can select all four fixed PHP releases. Rebuild and redeploy are required; restart-only, custom/forked/pinned buildpacks and incompatible PHP constraints do not automatically receive the fix. The upload-progress configuration workaround alone is not complete remediation.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source](<https://doc.scalingo.com/security/bulletins/ssb-2026-005>)|
|2026-10-22 11:25:32 +0200|Upsun|Upsun PHP application containers|Managed PHP runtime images: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports for 7.4 / 8.0 / 8.1|Fix|Fix|CVE assessment: Upsun's official technical notice names both CVEs and the patched images; its public incident RSS confirms grid deployment on 21 October and completed Dedicated-cluster patch deployment at 04:12 UTC on 22 October. PHP 7.3 and earlier receive no updates, and composable images require the separate customer action described by the vendor. Edge mitigations alone are not a fix.<br>Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.|[source 1](<https://developer.upsun.com/docs/languages/php>)<br>[source 2](<https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check>)<br>[source 3](<https://status.upsun.com/incidents/2cdvc2ctv5jwb>)<br>[source 4](<https://status.upsun.com/data/rss/feed.xml>)|
|2026-10-22 10:40:58 +0200|Securepoint GmbH|Securepoint Resellerportal||Investigation|Investigation|CVE assessment: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown<br>Securepoint's live Resellerportal login HTML exposes Laravel application markers and a Securepoint resellerportal session cookie.|[source 1](<https://my.securepoint.de/>)<br>[source 2](<https://laravel.com/framework/docs/deployment>)|
|2026-10-22 10:27:43 +0200|Checkmk GmbH|Checkmk Appliance|1.7.25|Fix|Fix|CVE assessment: Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update<br>Checkmk's appliance 1.7.25 release manifest upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release for both php2shell CVEs.|[source 1](<https://checkmk.com/werks?product=cma>)<br>[source 2](<https://download.checkmk.com/appliance/1.7.25/ChangedPackages>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-22 10:22:31 +0200|Quest Software|KACE Systems Management Appliance||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>Quest published KB 4385046 in the KACE Systems Management Appliance support feed as a response to CVE-2026-109618 and CVE-2026-109619.|[source 1](<https://support.quest.com/kace-systems-management-appliance/kb/4385046/4385046>)<br>[source 2](<https://support.quest.com/kace-systems-management-appliance/rss>)|
|2026-10-21 23:40:13 +0200|Cachet project|Cachet||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official Cachet repository requires PHP 8.3 or later for the self-hosted status page system, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/cachethq/cachet>)<br>[source 2](<https://api.github.com/repos/cachethq/cachet/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|Coolify|Coolify||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official Coolify Composer manifest declares PHP ^8.4 for the self-hostable PaaS, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/coollabsio/coolify/blob/main/composer.json>)<br>[source 2](<https://api.github.com/repos/coollabsio/coolify/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|Crater Invoice|Crater||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official Crater repository identifies an invoicing application and its installer config sets a minimum PHP version of 7.4.0; GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/crater-invoice-inc/crater/blob/master/config/installer.php>)<br>[source 2](<https://api.github.com/repos/crater-invoice-inc/crater/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|Firefly III project|Firefly III||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official Firefly III repository identifies a self-hosted personal finance manager with a PHP application tree, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/firefly-iii/firefly-iii>)<br>[source 2](<https://api.github.com/repos/firefly-iii/firefly-iii/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|Krayin|Krayin CRM||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official Krayin CRM repository requires PHP 8.3 or higher for the Laravel CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/krayin/laravel-crm>)<br>[source 2](<https://api.github.com/repos/krayin/laravel-crm/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|Monica project|Monica||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official Monica Composer manifest declares PHP ^8.3 for the personal CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/monicahq/monica/blob/main/composer.json>)<br>[source 2](<https://api.github.com/repos/monicahq/monica/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|QloApps|QloApps||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official QloApps repository identifies a hotel management and reservation platform with PHP application code, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/Qloapps/QloApps>)<br>[source 2](<https://api.github.com/repos/Qloapps/QloApps/dependency-graph/sbom>)|
|2026-10-21 23:40:13 +0200|UnoPim|UnoPim||Investigation|Investigation|CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown<br>The official UnoPim repository documents a Laravel PIM/DAM platform requiring PHP 8.4.1+, and GitHub exposes an SPDX dependency-graph SBOM for the repository.|[source 1](<https://github.com/unopim/unopim>)<br>[source 2](<https://api.github.com/repos/unopim/unopim/dependency-graph/sbom>)|
|2026-10-21 23:19:28 +0200|Akeneo|Akeneo PIM Community Edition||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>The official Akeneo PIM Community Edition Composer manifest declares PHP 8.1.* and required extensions.|[source](<https://github.com/akeneo/pim-community-dev/blob/master/composer.json>)|
|2026-10-21 23:19:28 +0200|Clientexec|Clientexec||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>Official Clientexec system requirements list PHP runtime support for Clientexec 6.x and 7.x plus required extensions and ionCube Loader versions.|[source](<https://docs.clientexec.com/en/article/system-requirements-yl750s/>)|
|2026-10-21 23:19:28 +0200|FreshRSS project|FreshRSS||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>Official FreshRSS server requirements state that current releases are PHP web applications requiring PHP 8.1+.|[source](<https://freshrss.github.io/FreshRSS/en/admins/02_Prerequisites.html>)|
|2026-10-21 23:19:28 +0200|HumHub|HumHub||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>Official HumHub requirements document Apache/mod_php or PHP-FPM deployment options and a current PHP compatibility matrix.|[source](<https://docs.humhub.org/docs/admin/requirements/>)|
|2026-10-21 23:19:28 +0200|N-able|Mail Assure / Spam Experts||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>N-able lists Mail Assure / Spam Experts among products receiving emergency maintenance and updates for php2shell.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-21 23:19:28 +0200|N-able|N-sight||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>N-able lists N-sight among products receiving emergency maintenance and updates for php2shell.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-21 23:19:28 +0200|N-able|Passportal||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>N-able lists Passportal among products receiving emergency maintenance and updates for php2shell.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-21 23:19:28 +0200|N-able|Take Control Session routing||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>N-able scoped emergency php2shell maintenance to Take Control session routing rather than the whole Take Control product family.|[source](<https://www.n-able.com/blog/n-able-update-on-the-global-php-issue>)|
|2026-10-21 23:19:28 +0200|OpenEMR project|OpenEMR||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>The official OpenEMR Composer manifest pins its platform runtime to PHP 8.3 and lists required PHP extensions.|[source](<https://github.com/openemr/openemr/blob/master/composer.json>)|
|2026-10-21 23:19:28 +0200|phpMyFAQ project|phpMyFAQ||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>The official phpMyFAQ Composer manifest declares PHP >=8.4.0, and the release process documents signed CycloneDX SBOM publication.|[source 1](<https://github.com/thorsten/phpMyFAQ/blob/main/composer.json>)<br>[source 2](<https://github.com/thorsten/phpMyFAQ/blob/main/docs/release.md>)|
|2026-10-21 23:19:28 +0200|Scalingo|Scalingo PaaS||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>Scalingo's php2shell bulletin says PHP applications hosted on Scalingo may be affected and lists patched PHP releases.|[source](<https://doc.scalingo.com/security/bulletins/ssb-2026-005>)|
|2026-10-21 23:19:28 +0200|Scalingo|Scalingo PHP buildpack||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>Scalingo says applications using its PHP buildpack must rebuild and redeploy to receive the updated PHP runtime and workaround.|[source](<https://doc.scalingo.com/security/bulletins/ssb-2026-005>)|
|2026-10-21 23:19:28 +0200|Sophos|MyUTM portal||Investigation|Investigation|CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation<br>Sophos says its legacy MyUTM portal ran an affected PHP version and was taken offline for update, while stating that Sophos products themselves are not affected.|[source](<https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell>)|
|2026-10-21 23:19:28 +0200|wallabag project|wallabag||Investigation|Investigation|CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown<br>Official wallabag requirements state compatibility with PHP >=7.4 and require PHP-FPM plus extensions.|[source](<https://doc.wallabag.org/admin/installation/requirements/>)|
|2026-10-21 23:14:12 +0200|Adiscon / LogAnalyzer project|Adiscon LogAnalyzer PHP web application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project identifies LogAnalyzer as a PHP syslog web application; its Composer platform value is only a resolution target.|[source 1](<https://github.com/rsyslog/loganalyzer>)<br>[source 2](<https://github.com/rsyslog/loganalyzer/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|Adobe|Adobe Commerce||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Adobe separately lists PHP modules for its commercial and open-source editions, requires pcntl for parallel indexers, and publishes per-release PHP matrices.|[source 1](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings>)<br>[source 2](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements>)|
|2026-10-21 23:14:12 +0200|AfterLogic|AfterLogic WebMail Lite PHP||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor requirements were re-read: PHP >=7.4 and mysqlnd-backed database access apply to the Lite PHP webmail application, separately from its mail services and other editions.|[source](<https://afterlogic.com/docs/webmail-lite/system-requirements>)|
|2026-10-21 23:14:12 +0200|Akaunting|Akaunting self-hosted application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The application's root runtime requirements explicitly declare PHP and thirteen extensions; README separates PHP from the Node asset pipeline.|[source 1](<https://github.com/akaunting/akaunting/blob/master/composer.json>)<br>[source 2](<https://github.com/akaunting/akaunting>)|
|2026-10-21 23:14:12 +0200|API Platform project|API Platform Core||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The API framework core declares PHP and runtime Symfony components; Laravel/Doctrine and tooling entries in require-dev are not automatically mandatory production dependencies.|[source](<https://packagist.org/packages/api-platform/core>)|
|2026-10-21 23:14:12 +0200|Artefactual Systems / AtoM project|AtoM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 2.9 manual requires PHP for archival description software and distinguishes PHP modules from Elasticsearch, ImageMagick and other external services/tools.|[source](<https://accesstomemory.org/en/docs/2.9/admin-manual/installation/requirements/>)|
|2026-10-21 23:14:12 +0200|Backdrop CMS project|Backdrop CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Backdrop requires PHP and documents a Drupal 7 upgrade path; OpenSSL is recommended and required by Update Manager.|[source 1](<https://docs.backdropcms.org/documentation/system-requirements>)<br>[source 2](<https://backdropcms.org/>)|
|2026-10-21 23:14:12 +0200|Bolt CMS project|Bolt CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Bolt 5.2 documentation explicitly requires PHP and lists core and optional PHP modules.|[source](<https://docs.boltcms.io/5.2/getting-started/requirements>)|
|2026-10-21 23:14:12 +0200|BoxBilling project|BoxBilling||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The archived project explicitly identifies PHP/MySQL runtime requirements and directs readers to the separately maintained FOSSBilling fork.|[source](<https://github.com/boxbilling/boxbilling>)|
|2026-10-21 23:14:12 +0200|CakePHP project|CakePHP framework||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>CakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages.|[source](<https://packagist.org/packages/cakephp/cakephp>)|
|2026-10-21 23:14:12 +0200|Catalyst IT / Mahara project|Mahara||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement.|[source 1](<https://manual.mahara.org/en/26.04/administration/config_php.html>)<br>[source 2](<https://mahara.org/interaction/forum/topic.php?id=10051&post38023=>)|
|2026-10-21 23:14:12 +0200|Centreon|Centreon Web and central-server PHP interface||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor installation procedure explicitly enables PHP 8.2 for the central web environment.|[source 1](<https://docs.centreon.com/docs/installation/installation-of-a-central-server/using-packages/>)<br>[source 2](<https://github.com/centreon/centreon-collect>)|
|2026-10-21 23:14:12 +0200|Chamilo Association / Chamilo project|Chamilo||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced.|[source](<https://docs.chamilo.org/administration-guide/admin-guide/installation/server-requirements>)|
|2026-10-21 23:14:12 +0200|CiviCRM project|CiviCRM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Publisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release's direct manifest.|[source 1](<https://packagist.org/packages/civicrm/civicrm-core>)<br>[source 2](<https://docs.civicrm.org/installation/en/latest/requirements/>)|
|2026-10-21 23:14:12 +0200|ClassicPress project|ClassicPress||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files.|[source 1](<https://www.classicpress.net/requirements/>)<br>[source 2](<https://docs.classicpress.net/user-guides/installing-classicpress/>)|
|2026-10-21 23:14:12 +0200|CodeIgniter Foundation|CodeIgniter 4 framework||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific.|[source](<https://packagist.org/packages/codeigniter4/framework>)|
|2026-10-21 23:14:12 +0200|Combodo|iTop||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official application manifest declares a bounded PHP runtime requirement separately from development packages.|[source](<https://github.com/Combodo/iTop/blob/develop/composer.json>)|
|2026-10-21 23:14:12 +0200|Composer / Packagist project|Packagist.org open-source web application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation.|[source 1](<https://github.com/composer/packagist/blob/main/composer.json>)<br>[source 2](<https://github.com/composer/packagist/blob/main/README.md>)|
|2026-10-21 23:14:12 +0200|Concrete CMS / PortlandLabs|Concrete CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Concrete states that it is primarily written in PHP and gives a per-release PHP compatibility table.|[source](<https://documentation.concretecms.org/9-x/developers/introduction/system-requirements>)|
|2026-10-21 23:14:12 +0200|Contao project|Contao CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions.|[source](<https://docs.contao.org/5.x/manual/en/installation/system-requirements/>)|
|2026-10-21 23:14:12 +0200|Contao project|Contao Manager||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Contao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation.|[source](<https://docs.contao.org/5.x/manual/en/installation/contao-manager/>)|
|2026-10-21 23:14:12 +0200|Corporation for Digital Scholarship / Omeka project|Omeka Classic||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project provides version-specific PHP requirements and separately requires ImageMagick for image resizing.|[source](<https://omeka.org/classic/docs/Installation/System_Requirements/>)|
|2026-10-21 23:14:12 +0200|Corporation for Digital Scholarship / Omeka project|Omeka S||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends.|[source](<https://omeka.org/s/docs/user-manual/install/>)|
|2026-10-21 23:14:12 +0200|Craft CMS / Pixel & Tonic|Craft CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Craft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line.|[source](<https://craftcms.com/docs/5.x/requirements.html>)|
|2026-10-21 23:14:12 +0200|CS-Cart|CS-Cart and Multi-Vendor||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor.|[source](<https://docs.cs-cart.com/latest/install/system_requirements.html>)|
|2026-10-21 23:14:12 +0200|daloRADIUS project|daloRADIUS PHP web management application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>daloRADIUS describes its PHP web application and current PDO database integration.|[source](<https://github.com/lirantal/daloradius/blob/master/README.md>)|
|2026-10-21 23:14:12 +0200|DokuWiki project / splitbrain|DokuWiki||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official manifest requires PHP and suggests mbstring for performance and intl for locale-aware sorting.|[source](<https://github.com/dokuwiki/dokuwiki/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|Dolibarr project|Dolibarr ERP CRM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official release compatibility table supplies version-specific PHP boundaries; the repository identifies a PHP web application with JavaScript enhancements.|[source 1](<https://wiki.dolibarr.org/index.php/Releases>)<br>[source 2](<https://github.com/Dolibarr/dolibarr>)|
|2026-10-21 23:14:12 +0200|EC-CUBE project|EC-CUBE||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The publisher registry provides PHP and direct runtime extension requirements for the explicitly alpha 4.4 sample.|[source 1](<https://packagist.org/packages/ec-cube/ec-cube>)<br>[source 2](<https://github.com/EC-CUBE/ec-cube>)|
|2026-10-21 23:14:12 +0200|EGroupware GmbH / EGroupware project|EGroupware||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The publisher manifest declares PHP, runtime extensions, optional modules and separately versioned suite packages.|[source 1](<https://packagist.org/packages/egroupware/egroupware>)<br>[source 2](<https://github.com/EGroupware/egroupware/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|Enhancesoft / osTicket project|osTicket||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project installation documentation requires a PHP-capable web server and explicitly lists compatible PHP versions.|[source](<https://docs.osticket.com/en/latest/Getting%20Started/Installation.html>)|
|2026-10-21 23:14:12 +0200|EspoCRM project|EspoCRM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project explicitly requires PHP and distinguishes mandatory extensions, database alternatives and optional feature modules.|[source](<https://docs.espocrm.com/administration/server-configuration/>)|
|2026-10-21 23:14:12 +0200|ExpressionEngine project|ExpressionEngine||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official 7.x requirements identify a PHP/MySQL CMS, required PHP modules and optional PHP-FPM integration.|[source](<https://docs.expressionengine.com/latest/installation/requirements.html>)|
|2026-10-21 23:14:12 +0200|Feng Office|Feng Office Community Edition||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official Community repository explicitly requires a PHP/MySQL web-server environment and documents application installation/cron setup.|[source](<https://github.com/fengoffice/fengoffice>)|
|2026-10-21 23:14:12 +0200|FileCloud|FileCloud Server PHP installation and maintenance||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official upgrade instructions invoke the XAMPP php.exe post-upgrade script and identify PHP web-install and multi-tenant administration files.|[source](<https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only>)|
|2026-10-21 23:14:12 +0200|FileGator project|FileGator||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project requires a PHP web server and ZIP; its sample distro installation also installs mbstring, DOM and XML packages.|[source](<https://docs.filegator.io/install.html>)|
|2026-10-21 23:14:12 +0200|FileRun|FileRun||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor identifies FileRun as PHP software and separates installation-blocking modules from feature-dependent additions.|[source](<https://docs.filerun.com/requirements>)|
|2026-10-21 23:14:12 +0200|FileSender project|FileSender||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 3.x installation guide requires PHP, identifies web/CLI paths and a separately installed SimpleSAMLphp authentication dependency.|[source 1](<https://docs.filesender.org/filesender/v3.0/install/>)<br>[source 2](<https://filesender.org/software/>)|
|2026-10-21 23:14:12 +0200|Flarum project / Flarum Foundation|Flarum||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official 2.x documentation distinguishes PHP, database drivers and CLI/Composer maintenance; 1.x has a separate compatibility scope.|[source 1](<https://docs.flarum.org/install/>)<br>[source 2](<https://docs.flarum.org/1.x/install/>)|
|2026-10-21 23:14:12 +0200|Forma LMS project|Forma LMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project mirror README explicitly lists a PHP server, required extensions and web-based installation.|[source](<https://github.com/formalms/formalms>)|
|2026-10-21 23:14:12 +0200|FOSSBilling project|FOSSBilling||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The current requirements identify PHP and distinguish mandatory modules, recommended media/cache support and the Plesk-only SimpleXML requirement.|[source 1](<https://docs.fossbilling.org/getting-started/requirements/>)<br>[source 2](<https://github.com/boxbilling/boxbilling>)|
|2026-10-21 23:14:12 +0200|FreeScout project|FreeScout||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project describes a PHP/Laravel helpdesk and documents both web and CLI requirements.|[source 1](<https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide/393b7d2751835e7ef272f4b09ba5e38a14804ff0>)<br>[source 2](<https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide>)<br>[source 3](<https://github.com/freescout-help-desk/freescout>)|
|2026-10-21 23:14:12 +0200|FrontAccounting project|FrontAccounting||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official project mirror explicitly requires PHP for the accounting application and explains PHP session/web-server configuration.|[source](<https://github.com/FrontAccountingERP/FA>)|
|2026-10-21 23:14:12 +0200|Froxlor Team|Froxlor control panel PHP branches||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The main manifest declares PHP^8.5 and Laravel13, while the separately scoped 2.0 migration guide documents older PHP requirements and PHP CLI helpers.|[source 1](<https://github.com/froxlor/froxlor/blob/main/composer.json>)<br>[source 2](<https://docs.froxlor.org/v2/general/migration-guide.html>)|
|2026-10-21 23:14:12 +0200|FusionDirectory|FusionDirectory||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The versioned manual identifies a PHP identity-management web application with an independently operated LDAP server.|[source](<https://fusiondirectory-user-manual.readthedocs.io/en/1.4/fusiondirectory/prerequisite/prerequisite.html>)|
|2026-10-21 23:14:12 +0200|FusionDirectory|FusionDirectory Orchestrator||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor manual identifies Orchestrator as a PHP web application with its own version requirements and a separate FusionDirectory/LDAP dependency.|[source](<https://fusiondirectory-user-manual.readthedocs.io/en/latest/fusiondirectory-orchestrator/prerequisite/prerequisite.html>)|
|2026-10-21 23:14:12 +0200|FusionPBX project|FusionPBX PHP management application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>FusionPBX publishes a PHP CLI/FPM installation recipe with version-specific package choices.|[source](<https://github.com/fusionpbx/fusionpbx-install.sh/blob/master/debian/resources/php.sh>)|
|2026-10-21 23:14:12 +0200|GLPI / Teclib|GLPI||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official release catalogue and pinned version-bump diff establish GLPI 12.0.0 final. The installation guide still covers only 10/11 PHP minima; the 12 release Composer manifest read was denied.|[source 1](<https://glpi-install.readthedocs.io/en/latest/prerequisites.html>)<br>[source 2](<https://github.com/glpi-project/glpi-agent>)<br>[source 3](<https://github.com/glpi-project/glpi/releases/tag/12.0.0>)<br>[source 4](<https://github.com/glpi-project/glpi/commit/cd812fbc82eaa8d0356d0fb650842069c1c18f4e>)|
|2026-10-21 23:14:12 +0200|Grav project|Grav CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The current 2.x guide requires PHP 8.3.11+ and describes flat-file storage without a database.|[source 1](<https://learn.getgrav.org/2/basics/requirements>)<br>[source 2](<https://learn.getgrav.org/17/basics/requirements>)|
|2026-10-21 23:14:12 +0200|Grokability / Snipe-IT project|Snipe-IT||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor distinguishes required PHP extensions from LDAP and alternative image-processing requirements.|[source](<https://snipe-it.readme.io/docs/requirements>)|
|2026-10-21 23:14:12 +0200|grommunio GmbH|grommunio Web||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project separates its PHP server from JavaScript/CSS, requires the Gromox MAPI extension and says released packages contain a built tree.|[source](<https://github.com/grommunio/grommunio-web>)|
|2026-10-21 23:14:12 +0200|Horde Project|Horde Groupware Webmail Edition 5||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official legacy Webmail manifest identifies the PHP groupware/webmail bundle and its Horde dependency.|[source](<https://github.com/horde/webmail/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|HostBill / HostBillApp|HostBill||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor-hosted requirements distinguish mandatory PHP modules and ionCube from recommended/feature-specific additions.|[source](<https://hostbill.atlassian.net/wiki/spaces/DOCS/pages/53745197/System%2Brequirements>)|
|2026-10-21 23:14:12 +0200|Ibexa|Ibexa DXP||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The versioned requirements page lists PHP 8.3/8.4 for DXP 5.0, PHP CLI/FPM packages and runtime extensions.|[source](<https://doc.ibexa.co/en/5.0/getting_started/requirements/>)|
|2026-10-21 23:14:12 +0200|Icinga GmbH|Icinga Web||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official guide explicitly separates PHP web/CLI requirements from Icinga 2 and Icinga DB monitoring services.|[source 1](<https://icinga.com/docs/icinga-web/latest/doc/02-Installation/From-Source/>)<br>[source 2](<https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates>)|
|2026-10-21 23:14:12 +0200|ILIAS Society / ILIAS project|ILIAS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official release-branch guide documents mod_php, FCGI/PHP-FPM and PHP CLI setup and cron, with separate required and feature-dependent modules.|[source 1](<https://github.com/ILIAS-eLearning/ILIAS/blob/release_11/docs/configuration/install.md>)<br>[source 2](<https://github.com/ILIAS-eLearning/ILIAS/releases>)|
|2026-10-21 23:14:12 +0200|iNextrix / ASTPP|ASTPP v7 PHP billing and management application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>ASTPP's vendor explicitly identifies PHP8.2 in version7.|[source](<https://astppbilling.org/your-top-questions-from-the-astpp-v7-webinar-answered>)|
|2026-10-21 23:14:12 +0200|Invision Community / Invision Power Services|Invision Community Classic||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor explicitly describes PHP requirements for the self-hosted Classic product and customer responsibility for server security patches and version upgrades.|[source](<https://invisioncommunity.com/buy/self-hosted/>)|
|2026-10-21 23:14:12 +0200|Invoice Ninja|Invoice Ninja self-hosted server||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The source manifest confirms the PHP server and direct extensions; the repository identifies a Laravel API/client-portal implementation.|[source 1](<https://github.com/invoiceninja/invoiceninja/blob/v5-stable/composer.json>)<br>[source 2](<https://www.invoiceninja.org/getting-started/>)<br>[source 3](<https://github.com/invoiceninja/invoiceninja>)<br>[source 4](<https://invoiceninja.github.io/docs/self-host/self-host-installation>)|
|2026-10-21 23:14:12 +0200|InvoicePlane project|InvoicePlane||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The installation guide confirms PHP web/CLI use; the manifest identifies PHP libraries and a CodeIgniter 3.4 fork separately from development tools.|[source 1](<https://github.com/InvoicePlane/InvoicePlane/blob/develop/.github/docs/INSTALLATION.md>)<br>[source 2](<https://github.com/InvoicePlane/InvoicePlane/blob/develop/composer.json>)|
|2026-10-21 23:14:12 +0200|Jakub Vrana / Adminer project|Adminer||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official site describes a database administration application shipped as a single PHP file and requiring PHP session support.|[source](<https://www.adminer.org/>)|
|2026-10-21 23:14:12 +0200|Kanboard project|Kanboard||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The server-side requirements distinguish PHP versions and extensions from ordinary browser/device requirements.|[source](<https://docs.kanboard.org/v1/admin/requirements/>)|
|2026-10-21 23:14:12 +0200|Kirby CMS project|Kirby CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Kirby provides version-specific PHP support and required, recommended and optional extension lists.|[source](<https://getkirby.com/docs/reference/system/requirements>)|
|2026-10-21 23:14:12 +0200|Klemen Stirn / Hesk|Hesk Free self-hosted helpdesk||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor identifies Hesk Free as self-hosted PHP/MySQL software and publishes its version and PHP range.|[source](<https://www.hesk.com/download.php>)|
|2026-10-21 23:14:12 +0200|Kopano / Kopano-dev|Kopano WebApp||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official WebApp mirror explicitly lists PHP server dependencies and a separate native MAPI interface.|[source](<https://github.com/Kopano-dev/kopano-webapp>)|
|2026-10-21 23:14:12 +0200|Ladybird Web Solution / Faveo|Faveo Helpdesk Community Edition||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Edition-labelled vendor installation instructions explicitly provision PHP for the Community helpdesk.|[source 1](<https://docs.faveohelpdesk.com/docs/installation/providers/community/ubuntu-apache/>)<br>[source 2](<https://docs.faveohelpdesk.com/docs/system-requirement/requirement/>)|
|2026-10-21 23:14:12 +0200|Laminas Project / Linux Foundation|Laminas MVC||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The released package declares PHP and MVC application dependencies; official Laminas documentation labels MVC security-only maintenance.|[source 1](<https://packagist.org/packages/laminas/laminas-mvc>)<br>[source 2](<https://docs.laminas.dev/>)|
|2026-10-21 23:14:12 +0200|Laminas Project / Mezzio|Mezzio||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Publisher metadata identifies a PHP PSR-15 middleware framework with router, template and request-handler packages.|[source 1](<https://packagist.org/packages/mezzio/mezzio>)<br>[source 2](<https://docs.laminas.dev/>)|
|2026-10-21 23:14:12 +0200|LDAP Account Manager project|LDAP Account Manager||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The manual requires a PHP web environment and separates optional Perl lamdaemon from the PHP application.|[source](<https://www.ldap-account-manager.org/static/doc/manual/ch02.html>)|
|2026-10-21 23:14:12 +0200|Leantime project|Leantime||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The root runtime manifest explicitly requires PHP and modules, including LDAP and process-control modules, separately from development tooling.|[source 1](<https://github.com/Leantime/leantime/blob/master/composer.json>)<br>[source 2](<https://github.com/Leantime/leantime>)|
|2026-10-21 23:14:12 +0200|LibreNMS project|LibreNMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The root manifest requires PHP and runtime modules; the guide separately configures PHP-FPM/CLI and Python/native helper packages.|[source 1](<https://docs.librenms.org/Installation/Install-LibreNMS/>)<br>[source 2](<https://github.com/librenms/librenms/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|LimeSurvey GmbH / LimeSurvey project|LimeSurvey Community Edition||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The CE installation manual binds PHP bands to major LS versions and separates conditional survey, mail, directory and archive features.|[source 1](<https://www.limesurvey.org/manual/Installation_-_LimeSurvey_CE>)<br>[source 2](<https://www.limesurvey.org/manual/index.php?title=Installation_-_LimeSurvey_CE&oldid=385498>)|
|2026-10-21 23:14:12 +0200|Mage-OS project|Mage-OS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official page lists PHP runtime requirements and identifies the Magento base for Mage-OS release families.|[source](<https://mage-os.org/get-started/system-requirements/>)|
|2026-10-21 23:14:12 +0200|MailWatch project|MailWatch for MailScanner||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official repository explicitly describes a PHP web front end to the separate MailScanner system.|[source](<https://github.com/mailwatch/MailWatch>)|
|2026-10-21 23:14:12 +0200|MantisBT project|MantisBT||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project's own installation requirements explicitly identify PHP for the bug tracker server.|[source](<https://github.com/mantisbt/mantisbt>)|
|2026-10-21 23:14:12 +0200|Matomo|Matomo On-Premise||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor FAQ confirms PHP web/CLI processing and upcoming beta requirements; the 5.x source root preserves a lower declared PHP floor.|[source 1](<https://matomo.org/faq/on-premise/matomo-requirements/>)<br>[source 2](<https://github.com/matomo-org/matomo/blob/5.x-dev/composer.json>)|
|2026-10-21 23:14:12 +0200|Mautic project|Mautic||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official installation guide documents PHP web settings and console execution for marketing automation.|[source 1](<https://docs.mautic.org/en/7.0/getting_started/how_to_install_mautic.html>)<br>[source 2](<https://github.com/mautic/mautic/blob/7.x/composer.json>)|
|2026-10-21 23:14:12 +0200|Metaways / tine project|tine groupware||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project requires PHP for the groupware server and lists mandatory and optional modules separately from browser/native clients.|[source](<https://docs.tine-groupware.de/main/operators/System_Requirements/>)|
|2026-10-21 23:14:12 +0200|MISP project / CIRCL|MISP 2.5 core PHP server||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official requirements distinguish mandatory PHP extensions from recommended modules for MISP2.5.|[source 1](<https://www.circl.lu/doc/misp/requirements/>)<br>[source 2](<https://github.com/MISP/MISP>)|
|2026-10-21 23:14:12 +0200|MODX project|MODX Revolution||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The guide says MODX is written in PHP and lists the 3.2+ PHP 8.1 floor and required modules.|[source](<https://docs.modx.com/3.x/en/getting-started/server-requirements>)|
|2026-10-21 23:14:12 +0200|Montala / ResourceSpace|ResourceSpace||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor identifies PHP as the server language, gives per-release bands and required distro packages, and separates external media tools.|[source](<https://www.resourcespace.com/knowledge-base/systemadmin/general_requirements?from_rs=true>)|
|2026-10-21 23:14:12 +0200|Moodle project|Moodle||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official 5.3 notes specify PHP 8.3.0+, additional 8.4.x support, sodium and 64-bit PHP. The download catalogue separates the 5.3 release from weekly 5.3+ packages and publishes a release checksum.|[source 1](<https://moodledev.io/general/releases/5.3>)<br>[source 2](<https://docs.moodle.org/503/en/PHP>)<br>[source 3](<https://download.moodle.org/releases/latest/>)<br>[source 4](<https://packaging.moodle.org/stable503/moodle-5.3.tgz.sha256>)|
|2026-10-21 23:14:12 +0200|MyBB Group|MyBB||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official MyBB 1.8 installation requirements identify PHP and three named extensions plus a selected database driver.|[source](<https://docs.mybb.com/1.8/install/requirements/>)|
|2026-10-21 23:14:12 +0200|Nagios Enterprises|Nagios Fusion web component subsystem||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor explains how PHP component files are included during Fusion application instantiation and register web-page callbacks.|[source](<https://assets.nagios.com/downloads/nagiosfusion/guides/developer/components.php>)|
|2026-10-21 23:14:12 +0200|Nagios Enterprises|Nagios XI web configuration-wizard subsystem||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official development guide identifies PHP scripts and callback functions loaded by the XI configuration-wizard interface.|[source](<https://assets.nagios.com/downloads/nagiosxi/docs/Writing-Custom-Wizards-2024.pdf>)|
|2026-10-21 23:14:12 +0200|Neos project|Neos CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Neos publishes a Neos/Flow/PHP matrix and requires matching web and CLI PHP versions for class precompilation.|[source](<https://docs.neos.io/guide/installation-development-setup/system-requirements>)|
|2026-10-21 23:14:12 +0200|Nette Foundation / Nette community|Nette framework metapackage||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Nette 3.3.0 is a metapackage with a finite seventeen-name direct runtime package list; each name was independently checked for PHP use.|[source](<https://packagist.org/packages/nette/nette>)|
|2026-10-21 23:14:12 +0200|Observium Limited / Observium project|Observium||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official installation guide explicitly provisions both the PHP web SAPI and command-line runtime.|[source](<https://docs.observium.org/install_debian/>)|
|2026-10-21 23:14:12 +0200|October CMS project|October CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 4.x guide explicitly calls October a PHP web application and requires PHP 8.2 with named modules.|[source](<https://docs.octobercms.com/4.x/setup/installation.html>)|
|2026-10-21 23:14:12 +0200|Open eClass project / GUnet|Open eClass||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 4.1 installation page requires PHP and names modules; it explicitly says the current package does not include phpMyAdmin.|[source](<https://docs.openeclass.org/en/4.1/install>)|
|2026-10-21 23:14:12 +0200|Open Web Analytics project|Open Web Analytics||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official analytics application manifest explicitly requires PHP and a Composer merge plugin for module requirements.|[source](<https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|OpenCart project|OpenCart||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Publisher package metadata for 4.1.0.4 explicitly requires PHP >=8.1.0. The official repository describes the PHP server and runtime modules.|[source 1](<https://packagist.org/packages/opencart/opencart>)<br>[source 2](<https://github.com/opencart/opencart/blob/master/docs/getting-started/system-requirements.md>)|
|2026-10-21 23:14:12 +0200|OpenConext / SURF|OpenConext EngineBlock SAML proxy||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The SAML proxy manifest declares PHP ^8.5 and runtime extensions.|[source 1](<https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json>)<br>[source 2](<https://github.com/OpenConext/OpenConext-engineblock>)<br>[source 3](<https://github.com/OpenConext/OpenConext-engineblock/releases>)<br>[source 4](<https://openconext.org/openconext-building-blocks/>)|
|2026-10-21 23:14:12 +0200|OpenDocMan project|OpenDocMan||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The source manifest requires PHP, while official README and website requirements show different generations of guidance.|[source 1](<https://github.com/opendocman/opendocman/blob/master/composer.json>)<br>[source 2](<https://github.com/opendocman/opendocman>)<br>[source 3](<https://www.opendocman.com/documentation/>)|
|2026-10-21 23:14:12 +0200|OpenMage project|OpenMage||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official requirements establish PHP and intl. Publisher registry metadata separately identifies OpenMage as a Magento-1 fork.|[source 1](<https://docs.openmage.org/users/requirements/>)<br>[source 2](<https://packagist.org/packages/openmage/magento-lts>)|
|2026-10-21 23:14:12 +0200|OrangeHRM Inc.|OrangeHRM Starter||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The edition-labelled Starter repository links to vendor prerequisites that explicitly install the PHP web environment.|[source 1](<https://starterhelp.orangehrm.com/hc/en-us/articles/6187572000540-Prerequisites-for-installing-OrangeHRM-Starter-in-Linux>)<br>[source 2](<https://github.com/orangehrm/orangehrm>)|
|2026-10-21 23:14:12 +0200|Oro Inc.|OroCommerce||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor separates server PHP/CLI and extension requirements from client-side browsers, cookies and JavaScript.|[source](<https://doc.oroinc.com/backend/setup/system-requirements/>)|
|2026-10-21 23:14:12 +0200|Oro, Inc.|OroCRM Community Edition application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The product-specific package metadata confirms PHP for the CRM Community application and distinguishes it from Enterprise, Commerce and Platform distributions.|[source 1](<https://packagist.org/packages/oro/crm-application>)<br>[source 2](<https://github.com/oroinc/crm-application/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|osCommerce|osCommerce 4||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor explicitly states that its V4 commerce platform uses PHP 8.3 and also supports older PHP from 7.4.|[source](<https://www.oscommerce.com/>)|
|2026-10-21 23:14:12 +0200|osCommerce legacy project|osCommerce Online Merchant 2.3||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The archived v2.3 manual requires a PHP-enabled web server and describes compatibility with PHP 4/5.|[source](<https://library.oscommerce.com/Online&en&oscom_2_3&getting_started&requirements>)|
|2026-10-21 23:14:12 +0200|ownCloud / Kiteworks|ownCloud Classic 11||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor's 11.0 guide confirms that supported Docker installations include PHP 8 and Apache and replace native Linux installation.|[source](<https://doc.owncloud.com/server/11.0/admin_manual/installation/installing_with_docker.html>)|
|2026-10-21 23:14:12 +0200|ownCloud / Kiteworks|ownCloud Server 10||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The versioned vendor requirements identify PHP 7.4 for the classic server branch.|[source](<https://doc.owncloud.com/server/10.16/admin_manual/installation/system_requirements.html>)|
|2026-10-21 23:14:12 +0200|OXID eSales|OXID eShop||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 7.3 vendor requirements name PHP 8.2-8.4 and required modules for the documented eShop editions.|[source](<https://docs.oxid-esales.com/eshop/de/7.3/installation/neu-installation/server-und-systemvoraussetzungen.html>)|
|2026-10-21 23:14:12 +0200|Part-DB project|Part-DB server||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official server manifest declares PHP and direct native modules; README separates server execution from Node/yarn browser-asset building.|[source 1](<https://github.com/Part-DB/Part-DB-server/blob/master/composer.json>)<br>[source 2](<https://github.com/Part-DB/Part-DB-server>)|
|2026-10-21 23:14:12 +0200|Phalcon project|Phalcon framework PHP extension||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official installation guides describe Phalcon as a compiled PHP extension, with distinct web/CLI loading and feature-specific companion modules.|[source 1](<https://docs.phalcon.io/5.23/installation/>)<br>[source 2](<https://docs.phalcon.io/5.9/installation/>)<br>[source 3](<https://pecl.php.net/>)|
|2026-10-21 23:14:12 +0200|Phillips Data / Blesta|Blesta billing platform||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Versioned vendor requirements explicitly identify PHP, encoded-code loader and native extensions for the billing platform.|[source](<https://docs.blesta.com/installation/>)|
|2026-10-21 23:14:12 +0200|phpBB Limited / phpBB project|phpBB||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The publisher package declares PHP and direct extensions for its displayed 4.0 alpha release, with separate runtime and development dependencies.|[source](<https://packagist.org/packages/phpbb/phpbb>)|
|2026-10-21 23:14:12 +0200|phpIPAM project|phpIPAM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project supplies branch-specific PHP ranges and separately documents PHP modules and optional CLI functions.|[source 1](<https://github.com/phpipam/phpipam>)<br>[source 2](<https://phpipam.net/documents/installation/>)|
|2026-10-21 23:14:12 +0200|phpLDAPadmin / leenooks project|phpLDAPadmin||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The current source manifest explicitly requires PHP and LDAP-related extensions for the directory administration web application.|[source 1](<https://github.com/leenooks/phpLDAPadmin/blob/master/composer.json>)<br>[source 2](<https://github.com/leenooks/phpLDAPadmin>)|
|2026-10-21 23:14:12 +0200|phpList project|phpList||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official requirements explicitly identify PHP and warn that some functionality/modules and plugin requirements are conditional.|[source](<https://resources.phplist.com/system/start>)|
|2026-10-21 23:14:12 +0200|phpPgAdmin project|phpPgAdmin||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official application manifest explicitly declares PHP and the PostgreSQL PHP extension.|[source](<https://github.com/phppgadmin/phppgadmin/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|phpVirtualBox project|phpVirtualBox server-side administration application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project describes a PHP web administration interface for VirtualBox.|[source](<https://github.com/phpvirtualbox/phpvirtualbox>)|
|2026-10-21 23:14:12 +0200|Pi-hole project|Pi-hole v5 legacy PHP web interface||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Pi-hole's version6 announcement explicitly removes the former lighttpd/PHP dependency.|[source](<https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/>)|
|2026-10-21 23:14:12 +0200|Pimcore project|Pimcore Platform||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Versioned platform requirements list PHP 8.5+ for 2026.2; the 2025.1 page specifies PHP 8.3/8.4.|[source 1](<https://docs.pimcore.com/platform/2026.2/Getting_Started/Installation/System_Requirements/>)<br>[source 2](<https://docs.pimcore.com/platform/2025.1/Pimcore/Installation_and_Upgrade/System_Requirements/>)|
|2026-10-21 23:14:12 +0200|PluXml project|PluXml 5.8 documented branch||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The PluXml 5.8 installation guide requires a PHP interpreter and GD for images.|[source](<https://wiki.pluxml.org/docs/install/install.html>)|
|2026-10-21 23:14:12 +0200|PmWiki project|PmWiki||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project requires PHP on the web server and describes its PHP compatibility range.|[source](<https://www.pmwiki.org/wiki/PmWiki/Requirements>)|
|2026-10-21 23:14:12 +0200|PostfixAdmin project|PostfixAdmin||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project identifies a PHP-capable web application used to administer virtual users for a separate Postfix mail server.|[source](<https://github.com/postfixadmin/postfixadmin>)|
|2026-10-21 23:14:12 +0200|PrestaShop project|PrestaShop||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The version-9 requirements identify PHP, required modules and separate compatibility bands for 9.0 and 9.1.|[source](<https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/>)|
|2026-10-21 23:14:12 +0200|PrivateBin project|PrivateBin||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official manifest requires PHP; the project separately states that paste encryption/decryption occurs in the browser.|[source 1](<https://github.com/PrivateBin/PrivateBin/blob/master/composer.json>)<br>[source 2](<https://github.com/PrivateBin/PrivateBin>)|
|2026-10-21 23:14:12 +0200|ProcessWire project|ProcessWire CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official requirements list PHP 8.x as recommended, PHP 7.x compatibility, and image-processing support.|[source 1](<https://processwire.com/about/requirements/>)<br>[source 2](<https://processwire.com/docs/front-end/include/>)|
|2026-10-21 23:14:12 +0200|ProjectSend project|ProjectSend||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The current source installation guide lists PHP web/CLI requirements; LDAP is required even without configured LDAP use.|[source 1](<https://github.com/projectsend/projectsend/blob/main/INSTALL.md>)<br>[source 2](<https://docs.projectsend.org/about/installation/requirements>)|
|2026-10-21 23:14:12 +0200|Pterodactyl project|Pterodactyl Panel PHP application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The Panel manifest declares PHP, Laravel and required PHP extensions for the management application.|[source 1](<https://github.com/pterodactyl/panel/blob/1.0-develop/composer.json>)<br>[source 2](<https://github.com/pterodactyl/wings/blob/develop/go.mod>)|
|2026-10-21 23:14:12 +0200|Public Knowledge Project (PKP)|Open Journal Systems||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official OJS README requires PHP and supplies a platform-check example while warning that its sample version numbers are not minimum versions.|[source](<https://github.com/pkp/ojs/blob/main/README.md>)|
|2026-10-21 23:14:12 +0200|Public Knowledge Project (PKP)|Open Monograph Press||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official OMP README requires PHP and distinguishes PHP platform requirements from illustrative module version numbers.|[source](<https://github.com/pkp/omp>)|
|2026-10-21 23:14:12 +0200|Public Knowledge Project (PKP)|Open Preprint Systems||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official OPS README requires PHP for the preprint server and identifies web-versus-CLI configuration differences.|[source](<https://github.com/pkp/ops>)|
|2026-10-21 23:14:12 +0200|Pydio|Pydio 8 Enterprise Distribution||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor's legacy Enterprise guide explicitly requires PHP, modules and ionCube, and recommends a PHP CLI path.|[source 1](<https://docs.pydio.com/pydio-v8/admin-guide/installation-guide/pydio-requirements/>)<br>[source 2](<https://github.com/pydio/cells>)|
|2026-10-21 23:14:12 +0200|RainLoop Team|RainLoop Webmail||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor requirements explicitly specify PHP and distinguish optional contact-database support from the mail UI.|[source 1](<https://www.rainloop.net/docs/system-requirements/>)<br>[source 2](<https://github.com/RainLoop/rainloop-webmail>)|
|2026-10-21 23:14:12 +0200|RaspAP project|RaspAP PHP network-management web GUI||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>RaspAP's manual installation configures a PHP-CGI web management interface.|[source](<https://docs.raspap.com/get-started/manual/>)|
|2026-10-21 23:14:12 +0200|SalesAgility / SuiteCRM project|SuiteCRM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Version-specific SuiteCRM 7 and 8 compatibility tables explicitly identify the PHP server runtime.|[source 1](<https://docs.suitecrm.com/8.x/admin/compatibility-matrix/>)<br>[source 2](<https://docs.suitecrm.com/admin/compatibility-matrix/>)|
|2026-10-21 23:14:12 +0200|Sendy|Sendy self-hosted application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor describes Sendy as a PHP-hosted application and separately identifies Amazon SES for sending mail.|[source 1](<https://sendy.co/>)<br>[source 2](<https://sendy.co/get-started>)|
|2026-10-21 23:14:12 +0200|Serendipity project|Serendipity Blog System||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project calls Serendipity a PHP web application and specifies PHP 7.3+, cookie/session support and extensions.|[source](<https://docs.s9y.org/docs/users/getting-started/fresh-installation.html>)|
|2026-10-21 23:14:12 +0200|Shlink project|Shlink||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official package metadata identifies a PHP URL-shortening application with CLI/REST interfaces and direct runtime modules.|[source 1](<https://packagist.org/packages/shlinkio/shlink>)<br>[source 2](<https://github.com/shlinkio/shlink>)|
|2026-10-21 23:14:12 +0200|Shopware 5 project / shopware AG lineage|Shopware 5||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The v5.7.20 package declares PHP and its extension requirements. The project README says active maintenance is no longer guaranteed.|[source](<https://packagist.org/packages/shopware/shopware>)|
|2026-10-21 23:14:12 +0200|shopware AG|Shopware 6||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official 6.7 update guide requires PHP 8.2/8.3/8.4 and separately describes the Vue/Vite administration frontend.|[source 1](<https://docs.shopware.com/en/shopware-6-en/update-guides/update-guide-shopware-67>)<br>[source 2](<https://developer.shopware.com/docs/v6.6/guides/installation/requirements.html>)|
|2026-10-21 23:14:12 +0200|Silverstripe CMS project|Silverstripe CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 6.x manual requires a PHP web server, PHP 8.3-8.5 and specific extensions.|[source](<https://docs.silverstripe.org/en/6/getting_started/server_requirements/>)|
|2026-10-21 23:14:12 +0200|Simple Machines / SMF project|Simple Machines Forum||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official application manifest declares a PHP runtime constraint separately from PHP-CS-Fixer and PHPUnit development dependencies.|[source](<https://github.com/SimpleMachines/SMF/blob/release-3.0/composer.json>)|
|2026-10-21 23:14:12 +0200|SimpleRisk|SimpleRisk PHP GRC application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>SimpleRisk publishes PHP version and extension requirements plus supported Apache/nginx execution modes.|[source](<https://support.simplerisk.com/kb/01-01-system-requirements>)|
|2026-10-21 23:14:12 +0200|SimpleSAMLphp project|SimpleSAMLphp||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>SimpleSAMLphp is a PHP SAML service-provider/identity-provider application with explicit PHP and extension requirements.|[source](<https://packagist.org/packages/simplesamlphp/simplesamlphp>)|
|2026-10-21 23:14:12 +0200|Slim project|Slim framework||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Slim is a PHP HTTP microframework; its package requires a separately chosen PSR-7 implementation and identifies XML parser modules as optional.|[source](<https://packagist.org/packages/slim/slim>)|
|2026-10-21 23:14:12 +0200|SnappyMail project|SnappyMail||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project documents PHP for its server-side webmail implementation and identifies its RainLoop lineage.|[source](<https://github.com/the-djmaze/snappymail>)|
|2026-10-21 23:14:12 +0200|SolidWorx / SolidInvoice project|SolidInvoice application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official runtime manifest requires PHP and native extensions; source and binary installation methods have different packaging boundaries.|[source 1](<https://github.com/SolidInvoice/SolidInvoice/blob/3.2.x/composer.json>)<br>[source 2](<https://github.com/SolidInvoice/SolidInvoice>)|
|2026-10-21 23:14:12 +0200|SPIP project|SPIP||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official configuration table gives PHP compatibility and extension requirements separately for SPIP 4.4, 4.3 and 4.2.|[source](<https://www.spip.net/en_article6659.html>)|
|2026-10-21 23:14:12 +0200|Spryker Systems GmbH|Spryker Commerce OS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor documents PHP-backed commerce and marketplace applications; its upgrade guide distinguishes the 8.3 floor from the 8.5 recommendation.|[source 1](<https://docs.spryker.com/docs/dg/dev/system-requirements/latest/system-requirements.html>)<br>[source 2](<https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/upgrade-to-php-85>)|
|2026-10-21 23:14:12 +0200|SquirrelMail project|SquirrelMail legacy documented webmail||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The old official installation manual explicitly requires a PHP-capable web server for the webmail application.|[source](<https://www.squirrelmail.org/docs/admin/admin-3.html>)|
|2026-10-21 23:14:12 +0200|Statamic project|Statamic CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Statamic describes itself as a PHP application installed as a Laravel package and lists PHP 8.3+ requirements.|[source](<https://statamic.dev/getting-started/requirements>)|
|2026-10-21 23:14:12 +0200|SugarAI / SugarCRM|Sugar application server||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor's supported-platforms page explicitly lists PHP among application server requirements, separately from end-user browser requirements.|[source](<https://support.sugarai.com/resources/supported_platforms/>)|
|2026-10-21 23:14:12 +0200|Sulu project|Sulu CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The Sulu 3.x requirements explicitly require PHP 8.2+ and DOM/XML extensions.|[source](<https://docs.sulu.io/3.x/reference/requirements.html>)|
|2026-10-21 23:14:12 +0200|SURF / SURFnet|SURFconext Service Provider Dashboard||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The registration/management application declares PHP ^8.2 in its root manifest.|[source 1](<https://github.com/SURFnet/sp-dashboard/blob/main/composer.json>)<br>[source 2](<https://github.com/SURFnet/sp-dashboard>)|
|2026-10-21 23:14:12 +0200|Sylius project|Sylius||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official prerequisites require PHP 8.2+ and five named extensions for the Symfony-based commerce application.|[source](<https://docs.sylius.com/public/getting-started/before-you-begin>)|
|2026-10-21 23:14:12 +0200|TeamPass project|TeamPass||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project identifies a PHP/MySQL credential vault, lists native modules and separates the server from a browser extension.|[source 1](<https://github.com/nilsteampassnet/TeamPass>)<br>[source 2](<https://github.com/nilsteampassnet/TeamPass/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|Textpattern project|Textpattern CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Textpattern lists PHP, MySQL and required/optional PHP modules for its 4.9 line.|[source 1](<https://textpattern.com/about/system-requirements>)<br>[source 2](<https://textpattern.com/weblog/textpattern-490-released-php-85-mysql-84-features-fixes-fine-tuning-and-much-more>)|
|2026-10-21 23:14:12 +0200|The Cacti Group|Cacti||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The source manifest and README confirm PHP for the web application and built-in poller, with differing table/develop minima.|[source 1](<https://github.com/Cacti/cacti/blob/develop/composer.json>)<br>[source 2](<https://github.com/Cacti/cacti>)|
|2026-10-21 23:14:12 +0200|Thelia project|Thelia||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official 3.0 guide requires PHP and modules; migration notes distinguish the root application from the lower-level core package floor.|[source 1](<https://doc.thelia.net/docs/3.0/getting-started/installation>)<br>[source 2](<https://doc.thelia.net/docs/3.0/upgrading/migrate>)|
|2026-10-21 23:14:12 +0200|thirty development llc / thirty bees project|thirty bees||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The release/download page gives a PHP-specific build selection and runtime requirements; the repository identifies its PrestaShop 1.6.1.11 fork point.|[source 1](<https://thirtybees.com/download/>)<br>[source 2](<https://github.com/thirtybees/thirtybees/blob/main/README.md>)|
|2026-10-21 23:14:12 +0200|Tiki Software Community Association / Tiki project|Tiki Wiki CMS Groupware||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project documents a PHP 7.4-to-8.1 migration boundary and PHP-dependent Composer libraries.|[source](<https://doc.tiki.org/PHP-8>)|
|2026-10-21 23:14:12 +0200|Totara|Totara||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor requires a PHP server and separates supported PHP branches, mandatory modules and recommended modules.|[source](<https://totara.help/docs/server-system-requirements>)|
|2026-10-21 23:14:12 +0200|TYPO3 project|TYPO3 13.4||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official 13.4.36 download page publishes a PHP 8.2-8.5 requirement and source-archive checksums. Versioned 13.4 documentation describes required and optional modules.|[source 1](<https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/Installation/SystemRequirements/Index.html>)<br>[source 2](<https://get.typo3.org/version/13>)|
|2026-10-21 23:14:12 +0200|Utrecht University / Yoda|Yoda v1.5 legacy PHP web portal||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Version 1.5 notes explicitly document the PHP portal upgrade.|[source](<https://utrechtuniversity.github.io/yoda/release-notes/release-1.5.html>)|
|2026-10-21 23:14:12 +0200|Uwe Steinmann / SeedDMS project|SeedDMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The project identifies a PHP-based document-management application with MySQL, SQLite or PostgreSQL and separately publishes two branch families.|[source 1](<https://www.seeddms.org/about/>)<br>[source 2](<https://www.seeddms.org/download/>)|
|2026-10-21 23:14:12 +0200|Vanderbilt University / REDCap Consortium|REDCap||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients.|[source](<https://projectredcap.org/software/requirements/>)|
|2026-10-21 23:14:12 +0200|Vtiger|Vtiger CRM Open Source||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor's Open Source installation FAQ explicitly requires PHP and several modules.|[source](<https://help.vtiger.com/article/158054339-Vtiger-Open-Source-FAQs>)|
|2026-10-21 23:14:12 +0200|VuFind project / Villanova University|VuFind||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components.|[source](<https://github.com/vufind-org/vufind/blob/dev/composer.json>)|
|2026-10-21 23:14:12 +0200|webERP project|webERP||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions.|[source](<https://www.weberp.org/downloads/webERP.Manual.4.15.2.2025-09-03.pdf>)|
|2026-10-21 23:14:12 +0200|Webkul|Bagisto||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5.|[source 1](<https://devdocs.bagisto.com/getting-started/before-you-start.html>)<br>[source 2](<https://devdocs.bagisto.com/getting-started/installation>)|
|2026-10-21 23:14:12 +0200|Webkul / UVdesk|UVdesk Community Helpdesk||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance.|[source 1](<https://github.com/uvdesk/community-skeleton>)<br>[source 2](<https://github.com/uvdesk/community-skeleton/blob/master/composer.json>)|
|2026-10-21 23:14:12 +0200|Whirl-i-Gig / CollectiveAccess project|CollectiveAccess Providence||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools.|[source](<https://docs.collectiveaccess.org/providence/user/setup/systemReq>)|
|2026-10-21 23:14:12 +0200|Winter CMS project|Winter CMS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork.|[source 1](<https://wintercms.com/docs/v1.2/docs/setup/installation>)<br>[source 2](<https://wintercms.com/en/>)<br>[source 3](<https://wintercms.com/blog/post/we-have-forked-october-cms>)|
|2026-10-21 23:14:12 +0200|WoltLab GmbH|WoltLab Suite||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases.|[source 1](<https://manual.woltlab.com/en/requirements/>)<br>[source 2](<https://manual.woltlab.com/en/php-compatibility/>)|
|2026-10-21 23:14:12 +0200|X-Cart|X-Cart 5||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The versioned developer page requires PHP 8.3-8.4, lists runtime extensions and separately recommends Xdebug for development.|[source](<https://developer.x-cart.com/getting_started/requirements>)|
|2026-10-21 23:14:12 +0200|XenForo Ltd|XenForo||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Vendor documentation identifies PHP web-server requirements, GD JPEG support and a PHP CLI command interface.|[source](<https://docs.xenforo.com/devs>)|
|2026-10-21 23:14:12 +0200|YetiForce S.A.|YetiForce CRM||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 7.x guide identifies PHP, mandatory modules and optional/integration-specific libraries.|[source 1](<https://doc.yetiforce.com/en/introduction/requirements/>)<br>[source 2](<https://github.com/YetiForceCompany/YetiForceCRM>)<br>[source 3](<https://github.com/YetiForceCompany/YetiForce>)|
|2026-10-21 23:14:12 +0200|Yii Software / Yii project|Yii 2 framework||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Yii 2 release metadata declares a server PHP framework and separately lists lib-pcre and browser asset packages.|[source](<https://packagist.org/packages/yiisoft/yii2>)|
|2026-10-21 23:14:12 +0200|YOURLS project|YOURLS||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The official project explicitly describes PHP scripts providing self-hosted URL shortening, statistics and plugins.|[source](<https://github.com/YOURLS/YOURLS>)|
|2026-10-21 23:14:12 +0200|Zabbix|Zabbix web frontend||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The 7.4 guide identifies the PHP frontend, its PHP version range and conditional authentication/database modules separately from native server/proxy/agent requirements.|[source 1](<https://www.zabbix.com/documentation/7.4/en/manual/installation/frontend>)<br>[source 2](<https://www.zabbix.com/documentation/7.4/en/manual/installation/requirements>)|
|2026-10-21 23:14:12 +0200|Zen Cart project|Zen Cart||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>Official requirements distinguish core release compatibility, the 1.5.8 installer exception and extension introduction dates.|[source](<https://docs.zen-cart.com/user/first_steps/server_requirements/>)|
|2026-10-21 22:40:16 +0200|Drupal project|Drupal||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>The refreshed official compatibility matrix preserves major/minor-specific PHP bands. It directs exact extension requirements to core/composer.json; that linked source rendered only a loading placeholder.|[source 1](<https://www.drupal.org/docs/getting-started/system-requirements/php-requirements>)<br>[source 2](<https://www.drupal.org/project/drupal>)<br>[source 3](<https://www.drupal.org/project/drupal/releases/11.4.10>)<br>[source 4](<https://www.drupal.org/project/drupal/releases/10.6.19>)<br>[source 5](<https://packagist.org/packages/drupal/core>)|
|2026-10-21 22:40:16 +0200|Joomla project|Joomla 6.x||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>The stable/current Joomla documentation identifies version 6.1 and gives a PHP 8.3.0 minimum, PHP 8.4 recommendation and required modules.|[source](<https://manual.joomla.org/docs/get-started/technical-requirements/>)|
|2026-10-21 22:40:16 +0200|Laravel|Laravel 13 framework||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>Laravel 13 deployment documentation identifies server PHP requirements and web/CLI deployment operations. The separately versioned 12 guide has a lower PHP floor.|[source 1](<https://laravel.com/framework/docs/deployment>)<br>[source 2](<https://laravel.com/framework/docs/12.x/deployment>)|
|2026-10-21 22:40:16 +0200|Magento / Adobe|Magento Open Source||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>Adobe's shared PHP settings page supplies a separate Magento Open Source extension list and makes pcntl conditional on parallel indexing.|[source 1](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings>)<br>[source 2](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements>)|
|2026-10-21 22:40:16 +0200|MediaWiki project|MediaWiki||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>MediaWiki explicitly requires PHP, lists native modules and distinguishes recommended modules from a 32-bit arithmetic alternative.|[source](<https://www.mediawiki.org/wiki/Manual:Installation_requirements>)|
|2026-10-21 22:40:16 +0200|phpMyAdmin project|phpMyAdmin||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>Registry metadata provides a release-specific PHP/module subset while the development manual separates optional archive/media/authentication features.|[source 1](<https://docs.phpmyadmin.net/en/latest/require.html>)<br>[source 2](<https://packagist.org/packages/phpmyadmin/phpmyadmin>)|
|2026-10-21 22:40:16 +0200|Roundcube project|Roundcube Webmail||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>The official project identifies a PHP/JavaScript webmail server with an internal IMAP library; registry supplies a named release and bounded PHP range.|[source 1](<https://github.com/roundcube/roundcubemail>)<br>[source 2](<https://packagist.org/packages/roundcube/roundcubemail>)<br>[source 3](<https://github.com/roundcube/roundcubemail/blob/master/composer.json>)|
|2026-10-21 22:40:16 +0200|Symfony|Symfony framework||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>The current Symfony setup guide identifies PHP and six extensions; the official component catalogue and separate manifests distinguish reusable packages from the full framework.|[source 1](<https://symfony.com/doc/current/setup.html>)<br>[source 2](<https://symfony.com/components>)<br>[source 3](<https://packagist.org/packages/symfony/http-foundation>)|
|2026-10-21 22:40:16 +0200|The PHP Group|PHP core and Zend Engine affected web-serving release scope|>=5.4.0 before fixed release or vendor backport; supported branches <8.2.35, <8.3.36, <8.4.27, <8.5.12|Vulnerable|Vulnerable|CVE assessment: Affected web-serving PHP runtime scope; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older branches require vendor backports or upgrade.<br>Version-scoped PHP runtime variant for affected web-serving releases. PHP says all PHP installations serving web requests are at risk; Calif found affected paths back to PHP 5.4.0.|[source 1](<https://www.php.net/archive/2026.php#2026-10-21-5>)<br>[source 2](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 3](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)<br>[source 4](<https://calif.io/php2shell/>)|
|2026-10-21 22:40:16 +0200|The PHP Group|PHP core and Zend Engine fixed upstream releases|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers<br>Version-scoped PHP runtime variant for the upstream fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.|[source 1](<https://www.php.net/archive/2026.php#2026-10-21-5>)<br>[source 2](<https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w>)<br>[source 3](<https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp>)|
|2026-10-21 22:40:16 +0200|WHMCS Ltd.|WHMCS self-hosted application||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>The vendor's 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches.|[source 1](<https://docs.whmcs.com/9-0/installation-guide/system-requirements/>)<br>[source 2](<https://docs.whmcs.com/8-13/installation-guide/system-requirements/>)|
|2026-10-21 22:40:16 +0200|WordPress project|WordPress||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>Current WordPress requirements recommend PHP 8.3+ and allow legacy PHP 7.4+. The Hosting Handbook distinguishes required JSON/mysqli from recommended modules.|[source 1](<https://wordpress.org/about/requirements/>)<br>[source 2](<https://make.wordpress.org/hosting/handbook/server-environment/>)|
|2026-10-21 20:01:23 +0200|aaPanel|aaPanel PHP Project hosting and CLI selection|aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12|Fix|Fix|CVE assessment: aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://www.aapanel.com/docs/Function/php.html>)<br>[source 2](<https://www.aapanel.com/forum/d/26249-critical-php-security-update>)|
|2026-10-21 20:01:23 +0200|BookStack project|BookStack|Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports|Fix|Fix|CVE assessment: BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStack code alone is insufficient.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://www.bookstackapp.com/docs/admin/installation/>)<br>[source 2](<https://www.bookstackapp.com/blog/php-security-release-critical/>)|
|2026-10-21 20:01:23 +0200|Bref project|Bref PHP Lambda runtime layers|Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115|Fix|Fix|CVE assessment: Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded<br>Bref confirms patched Bref 3 and Bref 2 PHP Lambda layers are published in all regions; update selected layer versions and redeploy.|[source 1](<https://bref.sh/docs/runtimes>)<br>[source 2](<https://github.com/brefphp/bref/issues/2222>)<br>[source 3](<https://bref.sh/news/06-php-security-release-october-2026>)|
|2026-10-21 20:01:23 +0200|Bref project|Bref PHP serverless application adapter|bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers|Fix|Fix|CVE assessment: Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://packagist.org/packages/bref/bref>)<br>[source 2](<https://github.com/brefphp/bref/blob/master/composer.json>)<br>[source 3](<https://bref.sh/news/06-php-security-release-october-2026>)|
|2026-10-21 20:01:23 +0200|Bref project|Bref v2 PHP Docker images|Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27|Fix|Fix|CVE assessment: Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched<br>Bref confirms published patched v2 Docker images for PHP 8.2 through 8.4; rebuild derived images with fresh base layers and redeploy.|[source 1](<https://bref.sh/docs/runtimes>)<br>[source 2](<https://github.com/brefphp/bref/issues/2222>)<br>[source 3](<https://bref.sh/news/06-php-security-release-october-2026>)|
|2026-10-21 20:01:23 +0200|Canonical / Ubuntu package maintainers|Ubuntu optional PHP package and SAPI family|Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1|Fix|Fix|CVE assessment: USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows.<br>USN-8948-1 supplies fixes for the listed Ubuntu Apache-module, CGI, CLI and FPM packages; separately inventoried FPM rows also retain USN-8948-2 release and entitlement scope.|[source 1](<https://ubuntu.com/server/docs/how-to/web-services/install-php/>)<br>[source 2](<https://packages.ubuntu.com/noble-updates/php8.3-fpm>)<br>[source 3](<https://ubuntu.com/security/notices/USN-8948-1>)<br>[source 4](<https://ubuntu.com/security/notices/USN-8948-2>)|
|2026-10-21 20:01:23 +0200|Gentoo PHP maintainers|Gentoo dev-lang/php runtime package family|dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot|Fix|Fix|CVE assessment: Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://packages.gentoo.org/packages/dev-lang/php>)<br>[source 2](<https://security.gentoo.org/glsa/202610-02>)|
|2026-10-21 20:01:23 +0200|Google Cloud|Google App Engine Flexible PHP runtime|App Engine Flexible PHP runtimes not redeployed onto patched supported images|Vulnerable|Vulnerable|CVE assessment: Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding with fixed PHP; unsupported runtimes remain exposed.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.cloud.google.com/appengine/docs/flexible/php/runtime>)<br>[source 2](<https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619>)|
|2026-10-21 20:01:23 +0200|Google Cloud; customer image publisher|Google Cloud Run customer PHP container option|Cloud Run customer containers with unpatched PHP on their respective branches|Vulnerable|Vulnerable|CVE assessment: Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.cloud.google.com/run/docs/quickstarts/build-and-deploy/deploy-php-service>)<br>[source 2](<https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619>)|
|2026-10-21 20:01:23 +0200|Heroku / Salesforce|Heroku PHP buildpack and application runtime|Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22|Fix|Fix|CVE assessment: Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://devcenter.heroku.com/articles/php-support>)<br>[source 2](<https://devcenter.heroku.com/changelog-items/3845>)|
|2026-10-21 20:01:23 +0200|Hestia Control Panel project|HestiaCP hestia-php internal runtime|Unpatched HestiaCP bundled hestia-php runtime; fix still being built|Vulnerable|Vulnerable|CVE assessment: HestiaCP's maintainer explicitly confirms its bundled hestia-php remains vulnerable while a fix is prepared. This is distinct from patched distribution PHP serving hosted websites; INI changes are not a complete fix.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://github.com/hestiacp/hestiacp/releases/tag/1.10.5>)<br>[source 2](<https://hestiacp.com/docs/contributing/building>)<br>[source 3](<https://hestiacp.com/docs/server-administration/configuration>)<br>[source 4](<https://github.com/hestiacp/hestiacp/commit/7d617fd1c5fd3be86458c7f53a6dad4a444b0a82>)<br>[source 5](<https://forum.hestiacp.com/t/hestia-1-10-5-release/22209>)<br>[source 6](<https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423>)|
|2026-10-21 20:01:23 +0200|Hestia Control Panel project|HestiaCP hosted-site PHP-FPM / MultiPHP option|HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21|Fix|Fix|CVE assessment: HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://hestiacp.com/install>)<br>[source 2](<https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423>)|
|2026-10-21 20:01:23 +0200|ISPConfig project|ISPConfig 3 control panel UI and scripts|ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers|Vulnerable|Vulnerable|CVE assessment: ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://www.ispconfig.org/blog/ispconfig-3-2-12-released/>)<br>[source 2](<https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/>)|
|2026-10-21 20:01:23 +0200|JBMC Software / DirectAdmin|DirectAdmin CustomBuild hosted PHP|CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1|Fix|Fix|CVE assessment: DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledged.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.directadmin.com/webservices/php/multiple-php.html>)<br>[source 2](<https://docs.directadmin.com/webservices/php/php-options.html>)<br>[source 3](<https://forum.directadmin.com/threads/critical-php-updates.82726/page-3>)|
|2026-10-21 20:01:23 +0200|Kevin Papst / Kimai project|Kimai|Kimai 2.70.1 rebuilt supported Docker image tags|Fix|Fix|CVE assessment: Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP runtime update.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://packagist.org/packages/kimai/kimai>)<br>[source 2](<https://github.com/kimai/kimai>)<br>[source 3](<https://github.com/kimai/kimai/blob/main/composer.json>)<br>[source 4](<https://www.kimai.org/documentation/installation.html>)<br>[source 5](<https://github.com/kimai/kimai/releases/tag/2.70.1>)<br>[source 6](<https://github.com/kimai/kimai/pull/6262#issuecomment-6322087754>)|
|2026-10-21 20:01:23 +0200|Palo Alto Networks|PAN-OS|All PAN-OS versions listed affected; fixed releases not yet announced|Vulnerable|Vulnerable|CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing>)<br>[source 2](<https://security.paloaltonetworks.com/CVE-2025-0108>)<br>[source 3](<https://security.paloaltonetworks.com/CVE-2026-109618>)|
|2026-10-21 20:01:23 +0200|Palo Alto Networks|Panorama|All Panorama versions listed affected; fixed releases not yet announced|Vulnerable|Vulnerable|CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing>)<br>[source 2](<https://docs.paloaltonetworks.com/panorama/getting-started/panorama-overview/about-panorama>)<br>[source 3](<https://security.paloaltonetworks.com/CVE-2026-109618>)|
|2026-10-21 20:01:23 +0200|Passbolt SA|Passbolt API server|Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport|Fix|Fix|CVE assessment: Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in progress.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://www.passbolt.com/docs/hosting/install/ce/from-source/>)<br>[source 2](<https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2>)|
|2026-10-21 20:01:23 +0200|Roundcube project|Roundcube Webmail Docker image family|Unrebuilt Roundcube Docker variants using pre-fix PHP 8.4 base images|Vulnerable|Vulnerable|CVE assessment: Roundcube's maintainer confirms that image rebuilds are needed after patched PHP base images arrive and reports build failures. No complete set of published fixed Roundcube tags is confirmed in the reviewed thread.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://github.com/roundcube/roundcubemail-docker>)<br>[source 2](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744>)|
|2026-10-21 20:01:23 +0200|Shaarli community|Shaarli|Shaarli Docker distribution awaiting a patched Alpine base at review time|Vulnerable|Vulnerable|CVE assessment: Shaarli's maintainer confirms that its Docker distribution needs the Alpine PHP security fix and that a new release is pending. This finding is scoped to the container runtime, not a Shaarli application-code defect.<br>Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://github.com/shaarli/Shaarli/blob/master/composer.json>)<br>[source 2](<https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435>)|
|2026-10-21 20:01:23 +0200|Shivam Mathur / setup-php project|setup-php GitHub Action external PHP provisioning|Patched setup-php v2-provisioned PHP builds announced 2026-10-21|Fix|Fix|CVE assessment: The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require update=true, and pre-installed disables updates.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://github.com/shivammathur/setup-php/blob/main/action.yml>)<br>[source 2](<https://github.com/shivammathur/setup-php/issues/1139>)|
|2026-10-21 20:01:23 +0200|SUSE|SUSE SLE BCI PHP CLI container||Not vuln|Not vuln|CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.<br>Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://registry.suse.com/repositories/bci-php>)<br>[source 2](<https://lists.suse.com/pipermail/sle-container-updates/2026-September/012564.html>)<br>[source 3](<https://www.suse.com/security/cve/CVE-2026-109618.html>)<br>[source 4](<https://www.suse.com/security/cve/CVE-2026-109619.html>)|
|2026-10-21 20:01:23 +0200|SUSE|SUSE SLE BCI PHP-Apache container||Not vuln|Not vuln|CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.<br>Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://registry.suse.com/repositories/bci-php-apache>)<br>[source 2](<https://lists.suse.com/pipermail/sle-container-updates/2026-September/012562.html>)<br>[source 3](<https://www.suse.com/security/cve/CVE-2026-109618.html>)<br>[source 4](<https://www.suse.com/security/cve/CVE-2026-109619.html>)|
|2026-10-21 20:01:23 +0200|SUSE|SUSE SLE BCI PHP-FPM 8 container||Not vuln|Not vuln|CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.<br>Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://registry.suse.com/repositories/bci-php-fpm>)<br>[source 2](<https://lists.suse.com/pipermail/sle-container-updates/2026-September/012563.html>)<br>[source 3](<https://www.suse.com/security/cve/CVE-2026-109618.html>)<br>[source 4](<https://www.suse.com/security/cve/CVE-2026-109619.html>)|
|2026-10-21 20:01:23 +0200|WebPros / cPanel|cPanel EasyApache 4 / MultiPHP|EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81|Fix|Fix|CVE assessment: EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.cpanel.net/ea4/php/about-php/>)<br>[source 2](<https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/>)|
|2026-10-21 20:01:23 +0200|WebPros / cPanel|cPanel internal PHP for hooks and AppConfig applications|cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27|Fix|Fix|CVE assessment: cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP.<br>Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.|[source 1](<https://docs.cpanel.net/knowledge-base/general-systems-administration/cpanel-php/>)<br>[source 2](<https://api.docs.cpanel.net/guides/guide-to-standardized-hooks/guide-to-standardized-hooks-hook-action-code>)<br>[source 3](<https://docs.cpanel.net/whm/development/apps-managed-by-appconfig/>)<br>[source 4](<https://docs.cpanel.net/changelogs/136-change-log/>)|
|2026-10-21 19:46:32 +0200|Arch Linux package maintainers|Arch Linux Extra php-legacy package|8.3.36-1|Fix|Fix|CVE assessment: Fixed in Arch Linux Extra php-legacy 8.3.36-1<br>Arch Linux states that php-legacy versions before 8.3.36 are affected by both CVEs; the current Extra package page lists php-legacy 8.3.36-1.|[source 1](<https://archlinux.org/packages/extra/x86_64/php-legacy/>)<br>[source 2](<https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/>)|
|2026-10-21 19:46:32 +0200|Bref project|Bref PHP Lambda runtime layers||Investigation|Investigation|CVE assessment: Bref Lambda layer scope is not yet confirmed by the vendor issue<br>Bref documents PHP Lambda runtime layers, but the current CVE issue only confirms v2 Docker image scope; layer impact remains under investigation.|[source 1](<https://bref.sh/docs/runtimes>)<br>[source 2](<https://github.com/brefphp/bref/issues/2222>)|
|2026-10-21 19:46:32 +0200|Canonical / Ubuntu package maintainers|Ubuntu Bionic php7.2-fpm binary package|7.2.24-0ubuntu0.18.04.17+esm14|Fix|Fix|CVE assessment: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14<br>Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 with Ubuntu Pro.|[source](<https://ubuntu.com/security/notices/USN-8948-2>)|
|2026-10-21 19:46:32 +0200|Canonical / Ubuntu package maintainers|Ubuntu Focal php7.4-fpm binary package|7.4.3-4ubuntu2.29+esm5|Fix|Fix|CVE assessment: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5<br>Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 with Ubuntu Pro.|[source](<https://ubuntu.com/security/notices/USN-8948-2>)|
|2026-10-21 19:46:32 +0200|Canonical / Ubuntu package maintainers|Ubuntu Trusty php5-fpm binary package|5.5.9+dfsg-1ubuntu4.29+esm18|Fix|Fix|CVE assessment: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18<br>Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 with Ubuntu Pro Legacy Support.|[source](<https://ubuntu.com/security/notices/USN-8948-2>)|
|2026-10-21 19:46:32 +0200|Canonical / Ubuntu package maintainers|Ubuntu Xenial php7.0-fpm binary package|7.0.33-0ubuntu0.16.04.16+esm22|Fix|Fix|CVE assessment: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22<br>Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 with Ubuntu Pro Legacy Support.|[source](<https://ubuntu.com/security/notices/USN-8948-2>)|
|2026-10-21 19:46:32 +0200|CloudLinux / TuxCare|CloudLinux Alt-PHP 7.4 fixed package set||Fix|Fix|CVE assessment: Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04<br>CloudLinux reports fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, 18.04, 22.04, 24.04 and 26.04.|[source](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)|
|2026-10-21 19:46:32 +0200|CloudLinux / TuxCare|CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23||Fix|Fix|CVE assessment: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23<br>CloudLinux reports a fixed alt-php80 release for Alpine Linux 3.23.|[source](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)|
|2026-10-21 19:46:32 +0200|Red Hat|Red Hat Enterprise Linux 9 PHP RPM/AppStreams||Vulnerable|Vulnerable|CVE assessment: Affected: Red Hat lists the RHEL 9 PHP component family as affected; scoped php:8.2 fix recorded separately<br>Red Hat's CVE pages mark the RHEL 9 PHP component family affected; RHSA-2026:87072 separately fixes the scoped php:8.2 module row.|[source 1](<https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages>)<br>[source 2](<https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle>)<br>[source 3](<https://access.redhat.com/security/cve/cve-2026-109618>)<br>[source 4](<https://access.redhat.com/security/cve/cve-2026-109619>)|
|2026-10-21 19:46:32 +0200|TuxCare / CloudLinux|TuxCare ELS PHP package for CentOS 8.4|7.4.6|Fix|Fix|CVE assessment: Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS<br>CloudLinux reports a fixed TuxCare ELS php-7.4.6 release for CentOS 8.4 ELS.|[source 1](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)<br>[source 2](<https://docs.tuxcare.com/els-for-runtimes/php/>)|
|2026-10-21 19:46:32 +0200|TuxCare / CloudLinux|TuxCare ELS PHP package for CentOS 8.5|7.4.19|Fix|Fix|CVE assessment: Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS<br>CloudLinux reports a fixed TuxCare ELS php-7.4.19 release for CentOS 8.5 ELS.|[source 1](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)<br>[source 2](<https://docs.tuxcare.com/els-for-runtimes/php/>)|
|2026-10-21 19:46:32 +0200|TuxCare / CloudLinux|TuxCare ELS PHP package for Ubuntu 16.04|7.0.33|Fix|Fix|CVE assessment: Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS<br>CloudLinux reports a fixed TuxCare ELS php-7.0.33 release for Ubuntu 16.04 ELS.|[source 1](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)<br>[source 2](<https://docs.tuxcare.com/els-for-runtimes/php/>)|
|2026-10-21 19:46:32 +0200|TuxCare / CloudLinux|TuxCare ELS PHP package for Ubuntu 18.04|7.2.24-0|Fix|Fix|CVE assessment: Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS<br>CloudLinux reports a fixed TuxCare ELS php-7.2.24-0 release for Ubuntu 18.04 ELS.|[source 1](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)<br>[source 2](<https://docs.tuxcare.com/els-for-runtimes/php/>)|
|2026-10-21 19:03:18 +0200|Arch Linux package maintainers|Arch Linux Extra PHP package|8.5.12-1|Fix|Fix|CVE assessment: Fixed in Arch Linux php 8.5.12-1<br>The official package page identifies PHP 8.5.12-1 and distinguishes runtime dependencies from dependencies marked make.|[source 1](<https://archlinux.org/packages/extra/x86_64/php/>)<br>[source 2](<https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/>)|
|2026-10-21 19:03:18 +0200|Google Cloud|Google App Engine Standard PHP runtime|PHP 8.2+ supported runtimes|Fix|Fix|CVE assessment: Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically<br>Google documents its managed Standard PHP runtime, PHP-FPM serving and automatic patch updates within the selected runtime family.|[source 1](<https://docs.cloud.google.com/appengine/docs/standard/php-gen2/runtime>)<br>[source 2](<https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619>)|
|2026-10-21 19:03:18 +0200|Plesk|Plesk Obsidian hosted-site PHP||Vulnerable|Vulnerable|CVE assessment: Affected hosted Plesk PHP in aggregate: Linux PHP 7.4, 8.0 and 8.1 plus Windows PHP 8.2-8.5 remain affected; fixed Linux PHP 8.2-8.5 builds are available<br>Plesk confirms hosted PHP remains affected in aggregate: Linux fixes are available for PHP 8.2-8.5, while Linux EOL branches and Windows builds remain affected.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://docs.plesk.com/en-US/obsidian/administrator-guide/web-hosting/php-management/installing-php.75153/>)<br>[source 3](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-21 19:03:18 +0200|Plesk|Plesk plesk-engine internal PHP management runtime for Windows||Vulnerable|Vulnerable|CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4<br>Plesk confirms that all versions of the Windows internal UI engine component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-21 19:03:18 +0200|Plesk|Plesk sw-engine internal PHP management runtime||Vulnerable|Vulnerable|CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4<br>Plesk confirms that all versions of the Linux sw-engine internal UI component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://support.plesk.com/hc/en-us/articles/31743316866071-The-sw-engine-process-causes-high-CPU-usage-on-a-Plesk-server>)<br>[source 3](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-21 19:03:18 +0200|The PHP Group|PHP core and Zend Engine|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers<br>Pinned source contains PHP lifecycle code in main/main.c and the Zend Engine in Zend/zend.c. Official support dates identify branches 8.2-8.5.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/Zend/zend.c>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/main/main.c>)<br>[source 3](<https://www.php.net/supported-versions.php>)<br>[source 4](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-21 19:03:18 +0200|The PHP Group|PHP LiteSpeed SAPI|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers<br>The released source contains an LSAPI SAPI, and the PHP manual identifies LiteSpeed integration as bundled PHP.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/litespeed/config.m4>)<br>[source 2](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-21 19:03:18 +0200|The PHP Group|PHP-CGI|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers<br>The pinned PHP source declares the cgi SAPI. Built by upstream default unless --disable-cgi; downstream packaging may differ.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cgi/config9.m4>)<br>[source 2](<https://www.php.net/manual/en/install.php>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-21 19:03:18 +0200|The PHP Group|PHP-FPM|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers<br>The pinned PHP source declares the fpm SAPI. Optional --enable-fpm; not evidence of FPM in every PHP build.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fpm/config.m4>)<br>[source 2](<https://www.php.net/manual/en/book.fpm.php>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-21 19:03:18 +0200|The PHP Group / Apache operators|Apache PHP module (mod_php)|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers<br>The pinned PHP source declares the apache2handler SAPI. Optional --with-apxs2; Apache presence alone does not establish PHP.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/apache2handler/config.m4>)<br>[source 2](<https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html>)<br>[source 3](<https://www.php.net/archive/2026.php#2026-10-21-5>)|
|2026-10-21 19:03:18 +0200|The PHP Group / PHP Windows maintainers|Official PHP Windows binary ZIP distribution|8.5.12, 8.4.27, 8.3.36, 8.2.35|Fix|Fix|CVE assessment: Fixed upstream Windows binaries are available for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35<br>Official downloads distinguish NTS/TS roles and list four architecture/thread-safety ZIP choices; the security advisory points users to fixed Windows binaries.|[source 1](<https://www.php.net/downloads.php?os=windows>)<br>[source 2](<https://www.php.net/archive/2026.php#2026-10-21-5>)<br>[source 3](<https://downloads.php.net/~windows/releases/archives/php-8.5.11-nts-Win32-vs17-x64.zip.spdx.json>)|
|2026-10-21 18:06:17 +0200|Canonical / Ubuntu package maintainers|Ubuntu Jammy php8.1-fpm binary package|8.1.2-1ubuntu2.28|Fix|Fix|CVE assessment: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28<br>Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Jammy php8.1-fpm 8.1.2-1ubuntu2.28.|[source](<https://ubuntu.com/security/notices/USN-8948-1>)|
|2026-10-21 18:06:17 +0200|Canonical / Ubuntu package maintainers|Ubuntu Resolute php8.5-fpm binary package|8.5.4-0ubuntu1.5|Fix|Fix|CVE assessment: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5<br>Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Resolute php8.5-fpm 8.5.4-0ubuntu1.5.|[source](<https://ubuntu.com/security/notices/USN-8948-1>)|
|2026-10-21 18:06:17 +0200|Canonical / Ubuntu package maintainers|Ubuntu Stonking php8.5-fpm binary package|8.5.9-0ubuntu2.1|Fix|Fix|CVE assessment: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1<br>Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Stonking php8.5-fpm 8.5.9-0ubuntu2.1.|[source](<https://ubuntu.com/security/notices/USN-8948-1>)|
|2026-10-21 18:03:55 +0200|Canonical / Ubuntu package maintainers|Ubuntu Noble php8.3-fpm binary package|8.3.6-0ubuntu0.24.04.13|Fix|Fix|CVE assessment: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13<br>Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13.|[source 1](<https://packages.ubuntu.com/noble-updates/php8.3-fpm>)<br>[source 2](<https://ubuntu.com/security/notices/USN-8948-1>)|
|2026-10-21 18:03:55 +0200|Debian PHP Maintainers|Debian trixie PHP 8.4 FPM package|8.4.27-1~deb13u1|Fix|Fix|CVE assessment: Fixed in Debian trixie php8.4 8.4.27-1~deb13u1<br>Debian DSA-6574-1 fixes CVE-2026-109618 and CVE-2026-109619 in trixie php8.4 8.4.27-1~deb13u1.|[source 1](<https://packages.debian.org/trixie/php8.4-fpm>)<br>[source 2](<https://lists.debian.org/debian-security-announce/2026/msg00489.html>)|
|2026-10-21 18:03:55 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP Apache/mod_php image variant||Fix|Fix|CVE assessment: Fixed in current Docker Official PHP image tags based on PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12<br>The official guide identifies the Apache variant as PHP loaded into Apache; the tag manifest lists Debian trixie and bookworm builds.|[source 1](<https://github.com/docker-library/docs/blob/master/php/README.md>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)<br>[source 3](<https://github.com/docker-library/php/pull/1694>)|
|2026-10-21 18:03:55 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP CLI image variant||Fix|Fix|CVE assessment: Fixed in current Docker Official PHP image tags based on PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12<br>The tag manifest lists patched stable CLI build directories; the selected Alpine recipe sets PHP_VERSION 8.5.12.|[source 1](<https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/alpine3.24/cli/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)<br>[source 3](<https://github.com/docker-library/php/pull/1694>)|
|2026-10-21 18:03:55 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP FPM image variant||Fix|Fix|CVE assessment: Fixed in current Docker Official PHP image tags based on PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12<br>The immutable trixie recipe starts from debian:trixie-slim, disables CGI and enables FPM.|[source 1](<https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/fpm/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)<br>[source 3](<https://github.com/docker-library/php/pull/1694>)|
|2026-10-21 18:03:55 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP ZTS image variant||Fix|Fix|CVE assessment: Fixed in current Docker Official PHP image tags based on PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12<br>The immutable trixie recipe enables ZTS, embed and phpdbg. The manifest groups four OS build directories under ZTS tags.|[source 1](<https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/zts/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)<br>[source 3](<https://github.com/docker-library/php/pull/1694>)|
|2026-10-21 18:03:55 +0200|Docker Official Images maintainers|Docker Official Image: php||Fix|Fix|CVE assessment: Fixed in current Docker Official PHP image tags based on PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12<br>Official manifests list patched stable PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; four variant records preserve OS/SAPI boundaries.|[source 1](<https://github.com/docker-library/official-images/blob/master/library/php>)<br>[source 2](<https://hub.docker.com/_/php>)<br>[source 3](<https://github.com/docker-library/docs/blob/master/php/README.md>)<br>[source 4](<https://github.com/docker-library/php/pull/1694>)<br>[source 5](<https://raw.githubusercontent.com/docker-library/php/master/versions.json>)|
|2026-10-21 18:03:55 +0200|Nextcloud GmbH / Nextcloud AIO maintainers|Nextcloud AIO Nextcloud application container||Vulnerable|Vulnerable|CVE assessment: Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; rebuilt images pending<br>Nextcloud AIO maintainers state that the PHP issue affects online PHP servers including Nextcloud and advise shutting down the AIO stack until rebuilt images are available.|[source 1](<https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile>)<br>[source 2](<https://github.com/nextcloud/all-in-one/issues/8876>)|
|2026-10-21 17:30:40 +0200|Red Hat|Red Hat Enterprise Linux 9 php:8.2 module|8.2.35-1.module+el9.8.0+25111+a1450321|Fix|Fix|CVE assessment: Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321<br>Red Hat RHSA-2026:87072 provides fixed RHEL 9 php:8.2 module packages for CVE-2026-109618 and CVE-2026-109619.|[source](<https://access.redhat.com/errata/RHSA-2026:87072>)|
|2026-10-21 16:33:41 +0200|Trend Micro|Apex Central||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Trend Micro's hotfix readme lists PHP 8.2.33 among Apex Central third-party modules updated to prevent potential vulnerabilities.|[source](<https://files.trendmicro.com/documentation/readme/CP/apexcentral_win_en_criticalpatch_b7328_Readme.html>)|
|2026-10-21 16:33:41 +0200|Trend Micro|Apex One||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Trend Micro's critical-patch readme states that a PHP module is used in Apex One and records an update to PHP 8.2.30.|[source](<https://files.trendmicro.com/documentation/readme/Apex%20One/2020/apex_one_2019_win_cp_b20105_EN_hotfix_Readme.html>)|
|2026-10-21 16:10:25 +0200|Bref project|Bref PHP Lambda runtime layers and images||Vulnerable|Vulnerable|CVE assessment: Affected: Bref v2 Docker images embedding affected PHP 8.4; layer scope not yet confirmed<br>Bref maintainers acknowledge that current v2 PHP Docker images need rebuilt PHP artifacts for both CVEs and plan a release.|[source 1](<https://bref.sh/docs/runtimes>)<br>[source 2](<https://github.com/brefphp/bref/issues/2222>)|
|2026-10-21 16:10:25 +0200|FrankenPHP|FrankenPHP static builds||Vulnerable|Vulnerable|CVE assessment: Affected: FrankenPHP web-serving builds embedding affected PHP versions; rebuilds pending<br>PHP names FrankenPHP among web-serving installations at risk from both CVEs; FrankenPHP maintainers are preparing rebuilt artifacts.|[source 1](<https://frankenphp.dev/docs/static/>)<br>[source 2](<https://www.php.net/archive/2026.php#2026-10-21-1>)<br>[source 3](<https://github.com/php/frankenphp/issues/2732>)|
|2026-10-21 15:38:10 +0200|iBabs|iBabs bestuursportaal||Not vuln|Not vuln|PHP is not being used in iBabs. This is confirmed by an email of the supplier.||
|2026-10-21 15:05:36 +0200|Nextcloud|Nextcloud Server||Vulnerable|Vulnerable|CVE assessment: Affected: Nextcloud deployments using affected PHP versions; affected PHP versions unspecified<br>Nextcloud states that the PHP issue affects Nextcloud deployments and may allow server compromise and data access; affected PHP versions and Nextcloud updates remain pending.|[source 1](<https://github.com/nextcloud/server/wiki/Releases-and-PHP-versions/d90292c6b2f2d0707fc61571364185fa311525bb>)<br>[source 2](<https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html>)<br>[source 3](<https://docs.nextcloud.com/server/stable/admin_manual/installation/php_configuration.html>)<br>[source 4](<https://github.com/nextcloud/server/releases>)<br>[source 5](<https://github.com/nextcloud/server/commit/ba900af933e61ffa005315b09d6454bfbbcbcc81>)<br>[source 6](<https://github.com/nextcloud/server/issues/65754>)|
|2026-10-21 14:38:51 +0200|F5|BIG-IP APM PHP page templates||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>F5 explicitly documents PHP inside APM UI templates. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html>)<br>[source 2](<https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/advanced-customization-using-logon-page-templates.html>)|
|2026-10-21 14:38:51 +0200|F5|BIG-IP TMOS platform PHP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official issue record confirms PHP in BIG-IP; administration-upload role is described in indexed vendor text. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://cdn.f5.com/product/bugtracker/ID1270257.html>)<br>[source 2](<https://my.f5.com/manage/s/article/K000133753>)|
|2026-10-21 14:38:51 +0200|Fortinet|FortiADC||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>7.4.8 vendor CLI example shows PHP-FPM; web-interface role is corroborated by indexed troubleshooting text. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/db39ff41-6283-11f0-a9d0-d2b0d2e22f7d/fortiadc-v7.4.8-cli-reference-guide.pdf>)<br>[source 2](<https://docs2.fortinet.com/document/fortiadc/7.4.11/handbook/406890/solutions-by-issue-type>)|
|2026-10-21 14:38:51 +0200|Juniper Networks|Junos OS J-Web (EX/SRX scope)||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Juniper-authored CVE record expressly identifies PHP in J-Web; later vendor bulletin corroborates inclusion. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json>)<br>[source 2](<https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software>)|
|2026-10-21 14:38:51 +0200|NetScaler / Citrix, Cloud Software Group|NetScaler ADC||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>14.1 pooled notice includes PHP; separate guide identifies administration PHP controller. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf>)<br>[source 2](<https://prod-docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/signatures/signature-auto-update>)|
|2026-10-21 14:38:51 +0200|Palo Alto Networks|PAN-OS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>12.2 catalogue includes PHP; older-branch advisory identifies management PHP. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing>)<br>[source 2](<https://security.paloaltonetworks.com/CVE-2025-0108>)|
|2026-10-21 14:38:51 +0200|Palo Alto Networks|Panorama||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>12.2 catalogue includes PHP; its precise active function is not established. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.|[source 1](<https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing>)<br>[source 2](<https://docs.paloaltonetworks.com/panorama/getting-started/panorama-overview/about-panorama>)|
|2026-10-21 14:24:36 +0200|CloudLinux|CloudLinux legacy ea-PHP extended-support packages||Vulnerable|Vulnerable|CVE assessment: Affected package streams: CloudLinux ea-php and TuxCare PHP ELS; affected versions unspecified<br>CloudLinux scopes ea-php in its CVE-2026-109618 and CVE-2026-109619 package-availability notice; affected versions are not specified.|[source 1](<https://docs.cloudlinux.com/cloudlinuxos/alt-ea_packages/>)<br>[source 2](<https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability>)|
|2026-10-21 14:24:36 +0200|TuxCare / CloudLinux|TuxCare ELS PHP for Windows distribution||Vulnerable|Vulnerable|CVE assessment: Affected package streams: CloudLinux ea-php and TuxCare PHP ELS; affected versions unspecified<br>CloudLinux scopes TuxCare PHP ELS in its CVE-2026-109618 and CVE-2026-109619 package-availability notice; affected versions are not specified.|[source 1](<https://docs.tuxcare.com/els-for-runtimes/php/>)<br>[source 2](<https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability>)|
|2026-10-21 14:13:06 +0200|CloudLinux / TuxCare|CloudLinux Alt-PHP / PHP Selector runtime family||Vulnerable|Vulnerable|CVE assessment: Affected: CloudLinux OS Components (Alt-PHP); affected versions unspecified<br>CloudLinux identifies Alt-PHP as affected by CVE-2026-109618 and CVE-2026-109619; affected versions are not specified.|[source 1](<https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/>)<br>[source 2](<https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5>)|
|2026-10-21 14:01:56 +0200|Plesk|Plesk for Linux|All shipped PHP versions|Vulnerable|Vulnerable|CVE assessment: Affected: all PHP versions shipped with Plesk<br>Plesk confirms that all PHP versions shipped with Plesk for Linux are affected; patched versions are pending a PHP vendor fix.|[source](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-21 14:01:56 +0200|Plesk|Plesk for Windows|All shipped PHP versions|Vulnerable|Vulnerable|CVE assessment: Affected: all PHP versions shipped with Plesk<br>Plesk confirms that all PHP versions shipped with Plesk for Windows are affected; patched versions are pending a PHP vendor fix.|[source](<https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk>)|
|2026-10-21 13:41:09 +0200|aaPanel|aaPanel PHP Project hosting and CLI selection||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>aaPanel documents per-site PHP selection, adding versions from App Store, and a separately selected command-line PHP version.|[source](<https://www.aapanel.com/docs/Function/php.html>)|
|2026-10-21 13:41:09 +0200|Acquia|Acquia Cloud Platform PHP hosting||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Acquia publishes selectable PHP runtime settings for Cloud Platform environments.|[source](<https://docs.acquia.com/acquia-cloud-platform/configuring-php-settings>)|
|2026-10-21 13:41:09 +0200|Adiscon / LogAnalyzer project|Adiscon LogAnalyzer PHP web application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project identifies LogAnalyzer as a PHP syslog web application; its Composer platform value is only a resolution target.|[source 1](<https://github.com/rsyslog/loganalyzer>)<br>[source 2](<https://github.com/rsyslog/loganalyzer/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|Adobe|Adobe Commerce||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Adobe separately lists PHP modules for its commercial and open-source editions, requires pcntl for parallel indexers, and publishes per-release PHP matrices.|[source 1](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings>)<br>[source 2](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements>)|
|2026-10-21 13:41:09 +0200|Adyen|Adyen API PHP library||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Adyen's library metadata requires PHP >=7.3 and ctype, curl, json, mbstring and openssl in the calling application.|[source](<https://packagist.org/packages/adyen/php-api-library>)|
|2026-10-21 13:41:09 +0200|AfterLogic|AfterLogic WebMail Lite PHP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor requirements were re-read: PHP >=7.4 and mysqlnd-backed database access apply to the Lite PHP webmail application, separately from its mail services and other editions.|[source](<https://afterlogic.com/docs/webmail-lite/system-requirements>)|
|2026-10-21 13:41:09 +0200|Aimeos project|Aimeos Laravel package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official package README requires PHP and adds shop/admin routes and PHP Artisan setup/jobs to Laravel.|[source](<https://github.com/aimeos/aimeos-laravel/blob/master/README.md>)|
|2026-10-21 13:41:09 +0200|Aimeos project|Aimeos TYPO3 extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official 2025.x installation guide requires PHP for its TYPO3 commerce extension.|[source](<https://aimeos.org/docs/2025.x/typo3/setup/>)|
|2026-10-21 13:41:09 +0200|Akaunting|Akaunting self-hosted application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The application's root runtime requirements explicitly declare PHP and thirteen extensions; README separates PHP from the Node asset pipeline.|[source 1](<https://github.com/akaunting/akaunting/blob/master/composer.json>)<br>[source 2](<https://github.com/akaunting/akaunting>)|
|2026-10-21 13:41:09 +0200|Alpine Linux package maintainers|Alpine Linux v3.22 php84 package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Alpine lists the php84 runtime and php84-common dependency, alongside musl and other upstream native libraries. The page separately lists subpackages.|[source](<https://pkgs.alpinelinux.org/package/v3.22/community/x86_64/php84>)|
|2026-10-21 13:41:09 +0200|Amazon Web Services|AWS Elastic Beanstalk PHP platform||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>AWS publishes four PHP AL2023 platform4.13.10 rows with branch-specific PHP patches and Composer2.10.3/PIE1.5.1.|[source](<https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html>)|
|2026-10-21 13:41:09 +0200|Amazon Web Services|AWS SDK for PHP v3||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>AWS SDK 3.401.2 declares PHP >=8.1 and json/pcre/simplexml. aws/aws-crt-php is required as a userland package; it does not prove ext-awscrt is loaded.|[source 1](<https://packagist.org/packages/aws/aws-sdk-php>)<br>[source 2](<https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_installation.html>)|
|2026-10-21 13:41:09 +0200|Amazon Web Services; third-party/customer PHP runtime publisher|AWS Lambda customer PHP custom-runtime option||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Bref explains that its PHP runtime names resolve to provided.al2023 plus a PHP layer, rather than native AWS PHP support.|[source 1](<https://bref.sh/docs/runtimes>)<br>[source 2](<https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html>)|
|2026-10-21 13:41:09 +0200|AMPHP project|AMP asynchronous PHP framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>AMP is a PHP asynchronous programming library with a PHP runtime constraint and a separate event-loop dependency.|[source](<https://packagist.org/packages/amphp/amp>)|
|2026-10-21 13:41:09 +0200|Antagonist|Antagonist DirectAdmin PHP hosting selector||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Antagonist documents a PHP selector covering all sites in one hosting package, per-version modules and extended support.|[source](<https://help.antagonist.nl/hc/nl/articles/8523972848401-Wat-kan-ik-met-de-PHP-selector-in-DirectAdmin>)|
|2026-10-21 13:41:09 +0200|Apache Friends|XAMPP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Apache Friends explicitly lists PHP in its Apache/MariaDB/Perl native bundles. The browser/Endor environment is separated into its own delivery record.|[source 1](<https://www.apachefriends.org/download.html>)<br>[source 2](<https://www.apachefriends.org/index.html>)|
|2026-10-21 13:41:09 +0200|APCu / PHP extension maintainers|APCu native PHP user-cache extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official catalogue identifies APCu as APC User Cache and declares its selected release PHP requirement.|[source](<https://pecl.php.net/package/apcu>)|
|2026-10-21 13:41:09 +0200|API Platform project|API Platform Core||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The API framework core declares PHP and runtime Symfony components; Laravel/Doctrine and tooling entries in require-dev are not automatically mandatory production dependencies.|[source](<https://packagist.org/packages/api-platform/core>)|
|2026-10-21 13:41:09 +0200|Arch Linux package maintainers|Arch Linux Extra PHP package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official package page identifies PHP 8.5.11-1 and distinguishes runtime dependencies from dependencies marked make.|[source](<https://archlinux.org/packages/extra/x86_64/php/>)|
|2026-10-21 13:41:09 +0200|Artefactual Systems / AtoM project|AtoM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 2.9 manual requires PHP for archival description software and distinguishes PHP modules from Elasticsearch, ImageMagick and other external services/tools.|[source](<https://accesstomemory.org/en/docs/2.9/admin-manual/installation/requirements/>)|
|2026-10-21 13:41:09 +0200|Ascensio System SIA / ONLYOFFICE|ONLYOFFICE integration for Nextcloud||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor connector manifest requires PHP; the repository separately describes a required ONLYOFFICE Document Server.|[source 1](<https://github.com/ONLYOFFICE/onlyoffice-nextcloud/blob/master/composer.json>)<br>[source 2](<https://github.com/ONLYOFFICE/onlyoffice-nextcloud>)|
|2026-10-21 13:41:09 +0200|Auth0|Auth0 PHP SDK||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The SDK requires PHP ^8.2, json, mbstring, openssl and PSR HTTP implementations. Cache/event-dispatcher implementations are suggested.|[source](<https://packagist.org/packages/auth0/auth0-php>)|
|2026-10-21 13:41:09 +0200|Automattic / WordPress.com|WordPress.com plugin-enabled PHP hosting environment||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>WordPress.com publishes PHP8.3/8.4 and a module environment for plugin-enabled hosting plans.|[source](<https://wordpress.com/support/php-environment/>)|
|2026-10-21 13:41:09 +0200|AWS SDK Common Runtime team|AWS Common Runtime native PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher requirements distinguish UNIX and Windows PHP minima and document OpenSSL-linked builds versus an AWS-LC build option.|[source 1](<https://pecl.php.net/package/awscrt/1.2.7>)<br>[source 2](<https://github.com/awslabs/aws-crt-php>)|
|2026-10-21 13:41:09 +0200|AWS SDK Common Runtime team|AWS Common Runtime PHP userland binding package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Composer package declares PHP >=5.5 and suggests ext-awscrt while explicitly stating that the native extension is needed to use its functionality.|[source](<https://packagist.org/packages/aws/aws-crt-php>)|
|2026-10-21 13:41:09 +0200|Backdrop CMS project|Backdrop CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Backdrop requires PHP and documents a Drupal 7 upgrade path; OpenSSL is recommended and required by Update Manager.|[source 1](<https://docs.backdropcms.org/documentation/system-requirements>)<br>[source 2](<https://backdropcms.org/>)|
|2026-10-21 13:41:09 +0200|bbPress community / WordPress project|bbPress||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official plugin listing gives PHP and WordPress requirements for the optional server-side forum plugin.|[source](<https://wordpress.org/plugins/bbpress/>)|
|2026-10-21 13:41:09 +0200|Behat project|Behat behavior-driven test framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for behat/behat v4.0.0 declares PHP >=8.2 <8.6 for this tool/library.|[source](<https://packagist.org/packages/behat/behat>)|
|2026-10-21 13:41:09 +0200|Belnet|Belnet FileSender research/education service||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Belnet documents a FileSender service for federation members.|[source 1](<https://belnet.be/nl/communities-diensten/alle-diensten/identity-mobility-federation/filesender>)<br>[source 2](<https://docs.filesender.org/filesender/v3.0/install/>)|
|2026-10-21 13:41:09 +0200|Ben Ramsey / Ramsey project|Ramsey UUID||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PHP UUID package uses PHP math/collection dependencies and suggests native modules only for selected acceleration or generator paths.|[source](<https://packagist.org/packages/ramsey/uuid>)|
|2026-10-21 13:41:09 +0200|Beyond Code in partnership with Laravel|Laravel Herd managed native PHP environment||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Herd describes a native PHP stack without containers; Windows documentation distinguishes shipped tools from downloaded PHP binaries.|[source 1](<https://herd.laravel.com/>)<br>[source 2](<https://herd.laravel.com/docs/windows/advanced-usage/directories-and-files>)|
|2026-10-21 13:41:09 +0200|Blackfire / Platform.sh SAS doing business as Upsun|Blackfire deterministic PHP Probe native extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official docs identify the deterministic PHP probe as a C extension, separate from the agent and browser client.|[source 1](<https://docs.blackfire.io/changelogs/php-probe>)<br>[source 2](<https://docs.blackfire.io/academy/getting-started/installation>)<br>[source 3](<https://docs.blackfire.io/up-and-running/update>)|
|2026-10-21 13:41:09 +0200|Blackfire / Platform.sh SAS doing business as Upsun|Blackfire PHP SDK client library||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The publisher registry identifies a PHP SDK with separate suggested ext-blackfire and ext-zlib capabilities.|[source 1](<https://packagist.org/packages/blackfire/php-sdk>)<br>[source 2](<https://docs.blackfire.io/php/integrations/sdk>)|
|2026-10-21 13:41:09 +0200|Bolt CMS project|Bolt CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Bolt 5.2 documentation explicitly requires PHP and lists core and optional PHP modules.|[source](<https://docs.boltcms.io/5.2/getting-started/requirements>)|
|2026-10-21 13:41:09 +0200|BookStack project|BookStack||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official installation requirements specify a PHP web runtime, a separate PHP CLI installation/maintenance path and required versus optional modules.|[source](<https://www.bookstackapp.com/docs/admin/installation/>)|
|2026-10-21 13:41:09 +0200|Box / Humbug project|Box PHAR build and packaging tool||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for humbug/box 4.7.0 declares PHP ^8.2 for this tool/library.|[source](<https://packagist.org/packages/humbug/box>)|
|2026-10-21 13:41:09 +0200|BoxBilling project|BoxBilling||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The archived project explicitly identifies PHP/MySQL runtime requirements and directs readers to the separately maintained FOSSBilling fork.|[source](<https://github.com/boxbilling/boxbilling>)|
|2026-10-21 13:41:09 +0200|Bref project|Bref PHP Lambda runtime layers and images||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Bref explicitly supplies PHP runtimes as Lambda layers or images and maps its logical PHP names onto the AWS custom-runtime environment.|[source](<https://bref.sh/docs/runtimes>)|
|2026-10-21 13:41:09 +0200|Bref project|Bref PHP serverless application adapter||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The released bref/bref manifest declares PHP>=8.2 and ext-curl for its serverless adapter.|[source 1](<https://packagist.org/packages/bref/bref>)<br>[source 2](<https://github.com/brefphp/bref/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|BuddyPress community / WordPress project|BuddyPress||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Trac r14231 bumps the 14.0 branch to 14.5.2 while retaining the PHP 5.6 declaration. The current plugin listing frames 7.4 as a hosting recommendation, clarifying the earlier apparent floor conflict.|[source 1](<https://buddypress.trac.wordpress.org/changeset/14231>)<br>[source 2](<https://wordpress.org/plugins/buddypress/>)|
|2026-10-21 13:41:09 +0200|bunq|bunq PHP API SDK||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The vendor SDK declares PHP compatibility, curl/json/mbstring, Guzzle and a Composer plugin API constraint.|[source](<https://packagist.org/packages/bunq/sdk_php>)|
|2026-10-21 13:41:09 +0200|CakePHP project|CakePHP framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>CakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages.|[source](<https://packagist.org/packages/cakephp/cakephp>)|
|2026-10-21 13:41:09 +0200|Canonical / Ubuntu package maintainers|Ubuntu Noble php8.3-fpm binary package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Noble FPM package page declares a full distro release and distinguishes binary, native, data/service and suggested dependencies.|[source](<https://packages.ubuntu.com/noble-updates/php8.3-fpm>)|
|2026-10-21 13:41:09 +0200|Canonical / Ubuntu package maintainers|Ubuntu optional PHP package and SAPI family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Ubuntu optional runtime family retained. Fresh package detail resolves the earlier Noble FPM retrieval gap and is separately inventoried as a scoped family member.|[source 1](<https://ubuntu.com/server/docs/how-to/web-services/install-php/>)<br>[source 2](<https://packages.ubuntu.com/noble-updates/php8.3-fpm>)|
|2026-10-21 13:41:09 +0200|CaptainHook / Sebastian Feldmann and contributors|CaptainHook PHP Git-hook manager||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for captainhook/captainhook 5.29.2 declares PHP >=8.0 for this tool/library.|[source](<https://packagist.org/packages/captainhook/captainhook>)|
|2026-10-21 13:41:09 +0200|CarbonPHP project|Carbon date/time library||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Carbon is a PHP DateTime API library with translation, clock and polyfill dependencies.|[source](<https://packagist.org/packages/nesbot/carbon>)|
|2026-10-21 13:41:09 +0200|Catalyst IT / Mahara project|Mahara||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement.|[source 1](<https://manual.mahara.org/en/26.04/administration/config_php.html>)<br>[source 2](<https://mahara.org/interaction/forum/topic.php?id=10051&post38023=>)|
|2026-10-21 13:41:09 +0200|Centreon|Centreon Web and central-server PHP interface||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor installation procedure explicitly enables PHP 8.2 for the central web environment.|[source 1](<https://docs.centreon.com/docs/installation/installation-of-a-central-server/using-packages/>)<br>[source 2](<https://github.com/centreon/centreon-collect>)|
|2026-10-21 13:41:09 +0200|Chamilo Association / Chamilo project|Chamilo||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced.|[source](<https://docs.chamilo.org/administration-guide/admin-guide/installation/server-requirements>)|
|2026-10-21 13:41:09 +0200|CIRCL, Luxembourg|CIRCL-operated MISP threat-sharing service||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>CIRCL publicly states it operates multiple MISP instances; MISP's server PHP relationship is independently documented.|[source 1](<https://www.circl.lu/services/misp-malware-information-sharing-platform/>)<br>[source 2](<https://www.circl.lu/doc/misp/requirements/>)|
|2026-10-21 13:41:09 +0200|CircleCI|CircleCI cimg/php CI runtime image family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>CircleCI states each cimg/php tag contains PHP and Composer for CI jobs.|[source 1](<https://circleci.com/developer/images/image/cimg/php>)<br>[source 2](<https://github.com/CircleCI-Public/cimg-php/blob/main/README.md>)|
|2026-10-21 13:41:09 +0200|CiviCRM project|CiviCRM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release's direct manifest.|[source 1](<https://packagist.org/packages/civicrm/civicrm-core>)<br>[source 2](<https://docs.civicrm.org/installation/en/latest/requirements/>)|
|2026-10-21 13:41:09 +0200|ClassicPress project|ClassicPress||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files.|[source 1](<https://www.classicpress.net/requirements/>)<br>[source 2](<https://docs.classicpress.net/user-guides/installing-classicpress/>)|
|2026-10-21 13:41:09 +0200|Clever Cloud fork of Caucho Technology Quercus|Quercus CleverCloud development branch||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The branch maintainer identifies a Java PHP implementation copied from Caucho Quercus/Resin.|[source](<https://github.com/CleverCloud/Quercus>)|
|2026-10-21 13:41:09 +0200|Cloudflare|Cloudflare Pages v1 legacy PHP build image||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The build-image page retains a legacy PHP row and separately dates v1 migration to v3 before this retrieval.|[source](<https://developers.cloudflare.com/pages/configuration/build-image/>)|
|2026-10-21 13:41:09 +0200|CloudLinux|CloudLinux legacy ea-PHP extended-support packages||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>CloudLinux states it supplies older EOL ea-PHP security patches beyond cPanel's standard support.|[source](<https://docs.cloudlinux.com/cloudlinuxos/alt-ea_packages/>)|
|2026-10-21 13:41:09 +0200|CloudLinux / TuxCare|CloudLinux Alt-PHP / PHP Selector runtime family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>CloudLinux documents separately installed Alt-PHP families and PHP Selector's per-user version and module configuration.|[source](<https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/>)|
|2026-10-21 13:41:09 +0200|Code LTS / William Desportes and contributors|Doctum PHP API documentation generator||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for code-lts/doctum v5.6.0 declares PHP ^8.1 for this tool/library.|[source](<https://packagist.org/packages/code-lts/doctum>)|
|2026-10-21 13:41:09 +0200|Codeception / Michael Bodnarchuk and contributors|Codeception PHP test framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for codeception/codeception 5.3.7 declares PHP ^8.2 for this tool/library.|[source](<https://packagist.org/packages/codeception/codeception>)|
|2026-10-21 13:41:09 +0200|CodeIgniter Foundation|CodeIgniter 4 framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific.|[source](<https://packagist.org/packages/codeigniter4/framework>)|
|2026-10-21 13:41:09 +0200|Combodo|iTop||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official application manifest declares a bounded PHP runtime requirement separately from development packages.|[source](<https://github.com/Combodo/iTop/blob/develop/composer.json>)|
|2026-10-21 13:41:09 +0200|Composer / Packagist project|Packagist.org open-source web application||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation.|[source 1](<https://github.com/composer/packagist/blob/main/composer.json>)<br>[source 2](<https://github.com/composer/packagist/blob/main/README.md>)|
|2026-10-21 13:41:09 +0200|Composer / Satis maintainers|Satis Composer repository generator||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for composer/satis 1.0.0 legacy tag declares PHP ^5.6 \|\| ^7.0 for this tool/library.|[source 1](<https://packagist.org/packages/composer/satis>)<br>[source 2](<https://github.com/composer/satis>)|
|2026-10-21 13:41:09 +0200|Composer / Satis maintainers|Satis official PHP container build recipe||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official Dockerfile uses a Composer build stage and PHP8.4 CLI final runtime.|[source](<https://github.com/composer/satis/blob/main/Dockerfile>)|
|2026-10-21 13:41:09 +0200|Composer project|Composer||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Composer itself runs on PHP, while its platform model describes PHP, ext-* and lib-* requirements separately from the project packages it manages.|[source 1](<https://getcomposer.org/doc/articles/composer-platform-dependencies.md>)<br>[source 2](<https://getcomposer.org/doc/00-intro.md>)|
|2026-10-21 13:41:09 +0200|Composer project / Docker Official Images|Composer default Docker runtime image||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The pinned recipe installs Composer 2.10.3 into a PHP8 Alpine runtime stage, makes default inherit it, and separately defines a scratch standalone-binary stage.|[source 1](<https://github.com/composer/docker/blob/a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1/latest/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/composer>)<br>[source 3](<https://github.com/docker-library/docs/blob/master/composer/README.md>)|
|2026-10-21 13:41:09 +0200|Concrete CMS / PortlandLabs|Concrete CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Concrete states that it is primarily written in PHP and gives a per-release PHP compatibility table.|[source](<https://documentation.concretecms.org/9-x/developers/introduction/system-requirements>)|
|2026-10-21 13:41:09 +0200|Contao project|Contao CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions.|[source](<https://docs.contao.org/5.x/manual/en/installation/system-requirements/>)|
|2026-10-21 13:41:09 +0200|Contao project|Contao Manager||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Contao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation.|[source](<https://docs.contao.org/5.x/manual/en/installation/contao-manager/>)|
|2026-10-21 13:41:09 +0200|Corporation for Digital Scholarship / Omeka project|Omeka Classic||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project provides version-specific PHP requirements and separately requires ImageMagick for image resizing.|[source](<https://omeka.org/classic/docs/Installation/System_Requirements/>)|
|2026-10-21 13:41:09 +0200|Corporation for Digital Scholarship / Omeka project|Omeka S||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends.|[source](<https://omeka.org/s/docs/user-manual/install/>)|
|2026-10-21 13:41:09 +0200|Couchbase, Inc.|Couchbase native PHP SDK extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Version 4.5.0 is a PHP client extension. Vendor notes update its native C++ core to 1.3.1 and drop PHP 8.1 support despite the registry minimum.|[source 1](<https://pecl.php.net/package/couchbase/4.5.0>)<br>[source 2](<https://docs.couchbase.com/php-sdk/current/project-docs/sdk-release-notes.html>)<br>[source 3](<https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html>)<br>[source 4](<https://packages.couchbase.com/clients/php/couchbase-4.5.0.sha256.txt>)|
|2026-10-21 13:41:09 +0200|Couchbase, Inc.|Couchbase PHP Composer SDK package||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The 4.5.0 userland package requires JSON; sockets is require-dev, while gRPC/Protobuf are suggestions.|[source 1](<https://packagist.org/packages/couchbase/couchbase>)<br>[source 2](<https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html>)|
|2026-10-21 13:41:09 +0200|Couchbase, Inc.|Couchbase PHP OpenTelemetry integration||Investigation|Investigation|CVE assessment: Optional PHP path; CVE match unknown<br>The integration requires PHP>=8.2, couchbase/couchbase^4.5, open-telemetry/api^1.0 and exporter-otlp^1.4.|[source](<https://packagist.org/packages/couchbase/couchbase-opentelemetry>)|
|2026-10-21 13:41:09 +0200|Craft CMS / Pixel & Tonic|Craft CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Craft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line.|[source](<https://craftcms.com/docs/5.x/requirements.html>)|
|2026-10-21 13:41:09 +0200|CS-Cart|CS-Cart and Multi-Vendor||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor.|[source](<https://docs.cs-cart.com/latest/install/system_requirements.html>)|
|2026-10-21 13:41:09 +0200|CyberPanel project|CyberPanel hosted PHP / LSPHP options||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>CyberPanel's official README advertises selectable PHP families for hosted applications.|[source 1](<https://github.com/usmannasir/cyberpanel>)<br>[source 2](<https://github.com/usmannasir/cyberpanel/blob/v3.0.5-dev/manage.py>)|
|2026-10-21 13:41:09 +0200|daloRADIUS project|daloRADIUS official Docker distribution recipe||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official Dockerfile declares an Apache PHP package stack separately from the application.|[source](<https://github.com/lirantal/daloradius/blob/master/Dockerfile>)|
|2026-10-21 13:41:09 +0200|daloRADIUS project|daloRADIUS PHP web management application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>daloRADIUS describes its PHP web application and current PDO database integration.|[source](<https://github.com/lirantal/daloradius/blob/master/README.md>)|
|2026-10-21 13:41:09 +0200|Dan Phillimore / Uniter project|Uniter PHP-to-JavaScript runtime stack||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>Uniter combines JavaScript parser, transpiler and runtime components to run PHP code.|[source](<https://phptojs.com/>)|
|2026-10-21 13:41:09 +0200|Datadog / Blackfire integration|Blackfire PHP continuous-profiler integration using Datadog profiling extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The guide loads datadog-profiling.so from a PHP_API_VERSION-specific path, separate from the deterministic Blackfire probe.|[source 1](<https://docs.blackfire.io/continuous-profiling-cookbooks/php>)<br>[source 2](<https://github.com/DataDog/dd-trace-php/releases>)|
|2026-10-21 13:41:09 +0200|DDEV project|DDEV PHP webserver development container||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>DDEV config defines php_version, ddev/ddev-webserver image selection and separate nginx-fpm/apache-fpm/generic modes.|[source](<https://docs.ddev.com/en/stable/users/configuration/config/>)|
|2026-10-21 13:41:09 +0200|Debian PHP Maintainers|Debian trixie PHP 8.4 FPM package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The package page describes FPM and declares dependencies on php8.4-cli, php8.4-common and php8.4-opcache; php-pear is suggested rather than required.|[source](<https://packages.debian.org/trixie/php8.4-fpm>)|
|2026-10-21 13:41:09 +0200|Deployer / Anton Medvedev and contributors|Deployer PHP deployment automation||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for deployer/deployer v8.0.5 declares PHP ^8.3 for this tool/library.|[source](<https://packagist.org/packages/deployer/deployer>)|
|2026-10-21 13:41:09 +0200|DEVSENSE / Phalanger project|Phalanger PHP 5.4 compiler for .NET/Mono||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The archived repository identifies a PHP 5.4 implementation and its PeachPie succession.|[source](<https://github.com/DEVSENSE/Phalanger>)|
|2026-10-21 13:41:09 +0200|Docker Community / Docker Official Images, not WordPress upstream image ownership|WordPress Docker Official Image distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The packaging template derives from official PHP images and installs WordPress-serving native extensions; the repository identifies Docker Community ownership.|[source 1](<https://github.com/docker-library/wordpress/blob/master/Dockerfile.template>)<br>[source 2](<https://github.com/docker-library/wordpress>)|
|2026-10-21 13:41:09 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP Apache/mod_php image variant||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official guide identifies the Apache variant as PHP loaded into Apache; the tag manifest lists Debian trixie and bookworm builds.|[source 1](<https://github.com/docker-library/docs/blob/master/php/README.md>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)|
|2026-10-21 13:41:09 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP CLI image variant||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The tag manifest lists four stable CLI build directories; the immutable Alpine recipe sets PHP_VERSION 8.5.11.|[source 1](<https://github.com/docker-library/php/blob/79320e28b93fdc720d6f07d150709310cf54e757/8.5/alpine3.24/cli/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)|
|2026-10-21 13:41:09 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP FPM image variant||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The immutable trixie recipe starts from debian:trixie-slim, disables CGI and enables FPM.|[source 1](<https://github.com/docker-library/php/blob/79320e28b93fdc720d6f07d150709310cf54e757/8.5/trixie/fpm/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)|
|2026-10-21 13:41:09 +0200|Docker Official Images / docker-library PHP maintainers|Docker Official PHP ZTS image variant||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The immutable trixie recipe enables ZTS, embed and phpdbg. The manifest groups four OS build directories under ZTS tags.|[source 1](<https://github.com/docker-library/php/blob/79320e28b93fdc720d6f07d150709310cf54e757/8.5/trixie/zts/Dockerfile>)<br>[source 2](<https://github.com/docker-library/official-images/blob/master/library/php>)|
|2026-10-21 13:41:09 +0200|Docker Official Images maintainers|Docker Official Image: php||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official manifest maps the selected stable8.5.11 directories to one advertised source commit. Representative immutable CLI/FPM/ZTS recipes were read; four variant records preserve OS/SAPI boundaries.|[source 1](<https://github.com/docker-library/official-images/blob/master/library/php>)<br>[source 2](<https://hub.docker.com/_/php>)<br>[source 3](<https://github.com/docker-library/docs/blob/master/php/README.md>)|
|2026-10-21 13:41:09 +0200|Doctrine project|Doctrine DBAL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>DBAL is a PHP database abstraction layer; official configuration documents alternative native-extension drivers and custom driver classes.|[source 1](<https://packagist.org/packages/doctrine/dbal>)<br>[source 2](<https://www.doctrine-project.org/projects/doctrine-dbal/en/4.4/reference/configuration.html>)|
|2026-10-21 13:41:09 +0200|Doctrine project|Doctrine ORM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PHP ORM release requires DBAL and other PHP packages; database extension choice is inherited from the chosen driver graph, not universal PDO presence.|[source](<https://packagist.org/packages/doctrine/orm>)|
|2026-10-21 13:41:09 +0200|DokuWiki project|DokuWiki official Docker distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Dockerfile starts from php:8.4-apache, allows optional PHP_EXTENSIONS build arguments and creates the DokuWiki image.|[source 1](<https://github.com/dokuwiki/docker/blob/main/Dockerfile>)<br>[source 2](<https://github.com/dokuwiki/docker>)|
|2026-10-21 13:41:09 +0200|DokuWiki project / splitbrain|DokuWiki||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official manifest requires PHP and suggests mbstring for performance and intl for locale-aware sorting.|[source](<https://github.com/dokuwiki/dokuwiki/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|Dolibarr project|Dolibarr ERP CRM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official release compatibility table supplies version-specific PHP boundaries; the repository identifies a PHP web application with JavaScript enhancements.|[source 1](<https://wiki.dolibarr.org/index.php/Releases>)<br>[source 2](<https://github.com/Dolibarr/dolibarr>)|
|2026-10-21 13:41:09 +0200|Drupal Commerce / Centarro|Drupal Commerce||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official module project explicitly depends on Drupal, separates 3.x/2.x/1.x core lineages and lists its current release.|[source](<https://www.drupal.org/project/commerce>)|
|2026-10-21 13:41:09 +0200|Drupal project|Drupal||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The refreshed official compatibility matrix preserves major/minor-specific PHP bands. It directs exact extension requirements to core/composer.json; that linked source rendered only a loading placeholder.|[source 1](<https://www.drupal.org/docs/getting-started/system-requirements/php-requirements>)<br>[source 2](<https://www.drupal.org/project/drupal>)<br>[source 3](<https://www.drupal.org/project/drupal/releases/11.4.10>)<br>[source 4](<https://www.drupal.org/project/drupal/releases/10.6.19>)<br>[source 5](<https://packagist.org/packages/drupal/core>)|
|2026-10-21 13:41:09 +0200|Drush project|Drush Drupal administration CLI||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for drush/drush 13.8.0 declares PHP >=8.3 for this tool/library.|[source](<https://packagist.org/packages/drush/drush>)|
|2026-10-21 13:41:09 +0200|EasyPHP project|EasyPHP PHP Devserver Windows bundle||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project describes a portable PHP development environment with PHP, Apache and modular PHP/version tools.|[source](<https://www.easyphp.org/>)|
|2026-10-21 13:41:09 +0200|EC-CUBE project|EC-CUBE||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher registry provides PHP and direct runtime extension requirements for the explicitly alpha 4.4 sample.|[source 1](<https://packagist.org/packages/ec-cube/ec-cube>)<br>[source 2](<https://github.com/EC-CUBE/ec-cube>)|
|2026-10-21 13:41:09 +0200|EGroupware GmbH / EGroupware project|EGroupware||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher manifest declares PHP, runtime extensions, optional modules and separately versioned suite packages.|[source 1](<https://packagist.org/packages/egroupware/egroupware>)<br>[source 2](<https://github.com/EGroupware/egroupware/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|Elastic|Elasticsearch official PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Fresh v9.5.0 registry review corroborates PHP ^8.1 and transport ^9.0, and separates yaml/zip development dependencies from the runtime list. The broad guide still says PHP 7.4.|[source 1](<https://packagist.org/packages/elasticsearch/elasticsearch>)<br>[source 2](<https://www.elastic.co/docs/reference/elasticsearch/clients/php/installation>)|
|2026-10-21 13:41:09 +0200|Endor; linked by Apache Friends|Endor browser LAMP sandbox / XAMPP for Browsers||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>Apache Friends links its browser bundle to Endor. Endor explicitly describes a browser-run Linux/Apache/MariaDB/PHP emulator and bundled phpMyAdmin.|[source 1](<https://endor.dev/s/lamp>)<br>[source 2](<https://www.apachefriends.org/download.html>)|
|2026-10-21 13:41:09 +0200|Enhancesoft / osTicket project|osTicket||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project installation documentation requires a PHP-capable web server and explicitly lists compatible PHP versions.|[source](<https://docs.osticket.com/en/latest/Getting%20Started/Installation.html>)|
|2026-10-21 13:41:09 +0200|EspoCRM project|EspoCRM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project explicitly requires PHP and distinguishes mandatory extensions, database alternatives and optional feature modules.|[source](<https://docs.espocrm.com/administration/server-configuration/>)|
|2026-10-21 13:41:09 +0200|European Commission|EU Academy Moodle service (2023 evidence)||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>An archived 2023 EU article identifies EU Academy as Moodle-based.|[source 1](<https://interoperable-europe.ec.europa.eu/collection/digital-skills-public-sector/news/eu-academy-platform-nutshell>)<br>[source 2](<https://moodledev.io/general/releases/5.3>)|
|2026-10-21 13:41:09 +0200|European Commission / OpenEuropa contributors|OpenEuropa Authentication Drupal module||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher metadata declares PHP and Drupal; the module integrates with EU Login.|[source 1](<https://packagist.org/packages/openeuropa/oe_authentication>)<br>[source 2](<https://github.com/openeuropa/oe_authentication>)|
|2026-10-21 13:41:09 +0200|European Commission / OpenEuropa contributors|OpenEuropa Content Drupal module||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher metadata declares PHP and Drupal dependencies.|[source](<https://packagist.org/packages/openeuropa/oe_content>)|
|2026-10-21 13:41:09 +0200|European Commission / OpenEuropa contributors|OpenEuropa Task Runner||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher describes a PHP task runner and declares its PHP floor.|[source](<https://packagist.org/packages/openeuropa/task-runner>)|
|2026-10-21 13:41:09 +0200|ExpressionEngine project|ExpressionEngine||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official 7.x requirements identify a PHP/MySQL CMS, required PHP modules and optional PHP-FPM integration.|[source](<https://docs.expressionengine.com/latest/installation/requirements.html>)|
|2026-10-21 13:41:09 +0200|Facebook / HHVM project|HHVM 3.30 PHP-compatible legacy line||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The 3.30 announcement identifies the final PHP-compatible release family.|[source 1](<https://hhvm.com/blog/2018/12/17/hhvm-3.30.html>)<br>[source 2](<https://hhvm.com/blog/2019/02/11/hhvm-4.0.0.html>)<br>[source 3](<https://hhvm.com/blog/2019/11/19/hhvm-4.32.html>)|
|2026-10-21 13:41:09 +0200|Facebook / HipHop project|HipHop for PHP compiler (HPHPc)||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>Facebook describes replacing its PHP-to-C++ HipHop compiler with HHVM in early 2013.|[source](<https://engineering.fb.com/2016/09/22/networking-traffic/redesigning-the-hhvm-jit-compiler-for-better-performance/>)|
|2026-10-21 13:41:09 +0200|Fedora Project PHP maintainers|Fedora PHP distribution package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official package catalogue identifies PHP and gives distinct stable, testing and Rawhide release entries.|[source](<https://packages.fedoraproject.org/pkgs/php/php/>)|
|2026-10-21 13:41:09 +0200|Feng Office|Feng Office Community Edition||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official Community repository explicitly requires a PHP/MySQL web-server environment and documents application installation/cron setup.|[source](<https://github.com/fengoffice/fengoffice>)|
|2026-10-21 13:41:09 +0200|FileCloud|FileCloud Server PHP installation and maintenance||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official upgrade instructions invoke the XAMPP php.exe post-upgrade script and identify PHP web-install and multi-tenant administration files.|[source](<https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only>)|
|2026-10-21 13:41:09 +0200|FileGator project|FileGator||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project requires a PHP web server and ZIP; its sample distro installation also installs mbstring, DOM and XML packages.|[source](<https://docs.filegator.io/install.html>)|
|2026-10-21 13:41:09 +0200|FileRun|FileRun||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor identifies FileRun as PHP software and separates installation-blocking modules from feature-dependent additions.|[source](<https://docs.filerun.com/requirements>)|
|2026-10-21 13:41:09 +0200|FileSender project|FileSender||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 3.x installation guide requires PHP, identifies web/CLI paths and a separately installed SimpleSAMLphp authentication dependency.|[source 1](<https://docs.filesender.org/filesender/v3.0/install/>)<br>[source 2](<https://filesender.org/software/>)|
|2026-10-21 13:41:09 +0200|Flarum project / Flarum Foundation|Flarum||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official 2.x documentation distinguishes PHP, database drivers and CLI/Composer maintenance; 1.x has a separate compatibility scope.|[source 1](<https://docs.flarum.org/install/>)<br>[source 2](<https://docs.flarum.org/1.x/install/>)|
|2026-10-21 13:41:09 +0200|Fly.io; customer runtime-image publisher|Fly.io customer Laravel/PHP Machines deployment||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Fly.io documents Laravel detection, generated nginx/php-fpm container configuration and PHP CLI job/release processes.|[source](<https://fly.io/laravel/>)|
|2026-10-21 13:41:09 +0200|Forma LMS project|Forma LMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project mirror README explicitly lists a PHP server, required extensions and web-based installation.|[source](<https://github.com/formalms/formalms>)|
|2026-10-21 13:41:09 +0200|FOSSBilling project|FOSSBilling||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The current requirements identify PHP and distinguish mandatory modules, recommended media/cache support and the Plesk-only SimpleXML requirement.|[source 1](<https://docs.fossbilling.org/getting-started/requirements/>)<br>[source 2](<https://github.com/boxbilling/boxbilling>)|
|2026-10-21 13:41:09 +0200|FrankenPHP|FrankenPHP static builds||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>FrankenPHP documents binaries embedding PHP and configurable extensions.|[source](<https://frankenphp.dev/docs/static/>)|
|2026-10-21 13:41:09 +0200|FreeBSD Project / ports maintainers|FreeBSD PHP port and mod_php package integration||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The maintained port relationship now has a dated 2026Q3 commit and advertised source checksum, beyond the handbook PHP 7.4 example.|[source 1](<https://lists.freebsd.org/archives/dev-commits-ports-branches/2026-August/014722.html>)<br>[source 2](<https://docs.freebsd.org/en/books/handbook/network-servers/>)|
|2026-10-21 13:41:09 +0200|FreeScout project|FreeScout||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project describes a PHP/Laravel helpdesk and documents both web and CLI requirements.|[source 1](<https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide/393b7d2751835e7ef272f4b09ba5e38a14804ff0>)<br>[source 2](<https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide>)<br>[source 3](<https://github.com/freescout-help-desk/freescout>)|
|2026-10-21 13:41:09 +0200|FrontAccounting project|FrontAccounting||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official project mirror explicitly requires PHP for the accounting application and explains PHP session/web-server configuration.|[source](<https://github.com/FrontAccountingERP/FA>)|
|2026-10-21 13:41:09 +0200|Froxlor Team|Froxlor control panel PHP branches||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The main manifest declares PHP^8.5 and Laravel13, while the separately scoped 2.0 migration guide documents older PHP requirements and PHP CLI helpers.|[source 1](<https://github.com/froxlor/froxlor/blob/main/composer.json>)<br>[source 2](<https://docs.froxlor.org/v2/general/migration-guide.html>)|
|2026-10-21 13:41:09 +0200|FusionDirectory|FusionDirectory||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The versioned manual identifies a PHP identity-management web application with an independently operated LDAP server.|[source](<https://fusiondirectory-user-manual.readthedocs.io/en/1.4/fusiondirectory/prerequisite/prerequisite.html>)|
|2026-10-21 13:41:09 +0200|FusionDirectory|FusionDirectory Orchestrator||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor manual identifies Orchestrator as a PHP web application with its own version requirements and a separate FusionDirectory/LDAP dependency.|[source](<https://fusiondirectory-user-manual.readthedocs.io/en/latest/fusiondirectory-orchestrator/prerequisite/prerequisite.html>)|
|2026-10-21 13:41:09 +0200|FusionPBX project|FusionPBX PHP management application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>FusionPBX publishes a PHP CLI/FPM installation recipe with version-specific package choices.|[source](<https://github.com/fusionpbx/fusionpbx-install.sh/blob/master/debian/resources/php.sh>)|
|2026-10-21 13:41:09 +0200|Gentoo PHP maintainers|Gentoo dev-lang/php runtime package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Gentoo publishes PHP runtime slots and architecture keywords with feature/SAPI USE flags.|[source](<https://packages.gentoo.org/packages/dev-lang/php>)|
|2026-10-21 13:41:09 +0200|GLPI / Teclib|GLPI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official release catalogue and pinned version-bump diff establish GLPI 12.0.0 final. The installation guide still covers only 10/11 PHP minima; the 12 release Composer manifest read was denied.|[source 1](<https://glpi-install.readthedocs.io/en/latest/prerequisites.html>)<br>[source 2](<https://github.com/glpi-project/glpi-agent>)<br>[source 3](<https://github.com/glpi-project/glpi/releases/tag/12.0.0>)<br>[source 4](<https://github.com/glpi-project/glpi/commit/cd812fbc82eaa8d0356d0fb650842069c1c18f4e>)|
|2026-10-21 13:41:09 +0200|Google|Google APIs Client Library for PHP||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The PHP API client requires PHP ^8.1, generated API service classes and Google Auth, with PHP HTTP/JWT dependencies.|[source](<https://packagist.org/packages/google/apiclient>)|
|2026-10-21 13:41:09 +0200|Google|Google Auth Library for PHP||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Publisher metadata declares PHP ^8.1 for OAuth/JWT credential and HTTP client support. phpseclib is suggested for some signing/token paths.|[source](<https://packagist.org/packages/google/auth>)|
|2026-10-21 13:41:09 +0200|Google|Google Cloud Firestore PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Firestore client metadata requires ext-grpc and PHP ^8.2, while ext-protobuf is suggested to improve throughput over pure-PHP serialization.|[source](<https://packagist.org/packages/google/cloud-firestore>)|
|2026-10-21 13:41:09 +0200|Google|Google Cloud Storage PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The client requires PHP ^8.2 and google/cloud-core. Pub/Sub notifications and phpseclib signing are suggestions, not universal requirements.|[source](<https://packagist.org/packages/google/cloud-storage>)|
|2026-10-21 13:41:09 +0200|Google / googleapis contributors|Google Cloud PHP client monolith||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Publisher metadata declares PHP ^8.2 and PHP RPC/serialization dependencies. The project recommends individual client packages and distinguishes optional versus required gRPC transports.|[source](<https://packagist.org/packages/google/cloud>)|
|2026-10-21 13:41:09 +0200|Google / Protocol Buffers project|Protocol Buffers native PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PECL release declares PHP >=8.2.0 for the native extension. Firestore's independent metadata suggests it for throughput rather than requiring it.|[source](<https://pecl.php.net/package/protobuf/5.36.2>)|
|2026-10-21 13:41:09 +0200|Google / Protocol Buffers project|Protocol Buffers PHP userland runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PHP runtime declares PHP >=8.2.0 and suggests bcmath for JSON deserialization. It is separate from the native protobuf extension and protoc generator.|[source](<https://packagist.org/packages/google/protobuf>)|
|2026-10-21 13:41:09 +0200|Google Cloud|Google App Engine Flexible PHP runtime||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Google documents the Flexible PHP stack, its PHP8.5 runtime settings and managed release updates.|[source](<https://docs.cloud.google.com/appengine/docs/flexible/php/runtime>)|
|2026-10-21 13:41:09 +0200|Google Cloud|Google App Engine Standard PHP runtime||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Google documents its managed Standard PHP runtime, PHP-FPM serving and automatic patch updates within the selected runtime family.|[source](<https://docs.cloud.google.com/appengine/docs/standard/php-gen2/runtime>)|
|2026-10-21 13:41:09 +0200|Google Cloud; customer image publisher|Google Cloud Run customer PHP container option||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>The official PHP quickstart uses a customer Dockerfile based on php:8.4-apache.|[source](<https://docs.cloud.google.com/run/docs/quickstarts/build-and-deploy/deploy-php-service>)|
|2026-10-21 13:41:09 +0200|Grav project|Grav CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The current 2.x guide requires PHP 8.3.11+ and describes flat-file storage without a database.|[source 1](<https://learn.getgrav.org/2/basics/requirements>)<br>[source 2](<https://learn.getgrav.org/17/basics/requirements>)|
|2026-10-21 13:41:09 +0200|Grokability / Snipe-IT project|Snipe-IT||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor distinguishes required PHP extensions from LDAP and alternative image-processing requirements.|[source](<https://snipe-it.readme.io/docs/requirements>)|
|2026-10-21 13:41:09 +0200|grommunio GmbH|grommunio Web||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project separates its PHP server from JavaScript/CSS, requires the Gromox MAPI extension and says released packages contain a built tree.|[source](<https://github.com/grommunio/grommunio-web>)|
|2026-10-21 13:41:09 +0200|gRPC project|gRPC native PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PECL identifies a stable PHP extension release. The Windows catalogue distinguishes PHP versions, TS/NTS and x86/x64 builds; quickstart requires it for PHP client calls.|[source 1](<https://pecl.php.net/package/gRPC/1.83.1>)<br>[source 2](<https://pecl.php.net/package/gRPC/1.83.1/windows>)<br>[source 3](<https://grpc.io/docs/languages/php/quickstart/>)<br>[source 4](<https://grpc.io/docs/languages/php/basics/>)|
|2026-10-21 13:41:09 +0200|gRPC project|gRPC PHP Composer support library||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The Composer mirror contains PHP support files and declares PHP >=7.1.0. Official quickstart separately requires the native grpc extension for PHP clients.|[source 1](<https://packagist.org/packages/grpc/grpc>)<br>[source 2](<https://grpc.io/docs/languages/php/quickstart/>)<br>[source 3](<https://grpc.io/docs/languages/php/basics/>)|
|2026-10-21 13:41:09 +0200|Guzzle project|Guzzle HTTP client||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Guzzle declares a PHP HTTP client with promises and PSR-7 packages; cURL is a chosen-handler requirement rather than an unconditional root runtime requirement.|[source](<https://packagist.org/packages/guzzlehttp/guzzle>)|
|2026-10-21 13:41:09 +0200|Heroku / Salesforce|Heroku PHP buildpack and application runtime||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Heroku publishes a PHP-version-by-stack availability table and distinguishes built-in from opt-in modules.|[source](<https://devcenter.heroku.com/articles/php-support>)|
|2026-10-21 13:41:09 +0200|Hestia Control Panel project|HestiaCP hestia-php internal runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release notes name the internal PHP update. This is stronger than the previously observed documentation version label, but not a measured installed package.|[source 1](<https://github.com/hestiacp/hestiacp/releases/tag/1.10.5>)<br>[source 2](<https://hestiacp.com/docs/contributing/building>)<br>[source 3](<https://hestiacp.com/docs/server-administration/configuration>)<br>[source 4](<https://github.com/hestiacp/hestiacp/commit/7d617fd1c5fd3be86458c7f53a6dad4a444b0a82>)<br>[source 5](<https://forum.hestiacp.com/t/hestia-1-10-5-release/22209>)|
|2026-10-21 13:41:09 +0200|Hestia Control Panel project|HestiaCP hosted-site PHP-FPM / MultiPHP option||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>The official installer configuration exposes separate PHP-FPM and MultiPHP options.|[source](<https://hestiacp.com/install>)|
|2026-10-21 13:41:09 +0200|HikaShop project|HikaShop Joomla component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official guide describes PHP installation scripts inside the Joomla administrator component and PHP configuration handling.|[source](<https://www.hikashop.com/support/documentation/hikashop/installation-configuration>)|
|2026-10-21 13:41:09 +0200|HippyVM contributors|HippyVM RPython PHP implementation||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The project implements PHP using RPython and lists php5-cli among its build prerequisites.|[source](<https://github.com/hippyvm/hippyvm>)|
|2026-10-21 13:41:09 +0200|Homebrew maintainers|Homebrew PHP formula and bottles||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official formula page lists stable 8.5.11, php-fpm service commands and Apache module configuration.|[source](<https://formulae.brew.sh/formula/php>)|
|2026-10-21 13:41:09 +0200|Horde Project|Horde Groupware Webmail Edition 5||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The official legacy Webmail manifest identifies the PHP groupware/webmail bundle and its Horde dependency.|[source](<https://github.com/horde/webmail/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|HostBill / HostBillApp|HostBill||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor-hosted requirements distinguish mandatory PHP modules and ionCube from recommended/feature-specific additions.|[source](<https://hostbill.atlassian.net/wiki/spaces/DOCS/pages/53745197/System%2Brequirements>)|
|2026-10-21 13:41:09 +0200|Ibexa|Ibexa DXP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The versioned requirements page lists PHP 8.3/8.4 for DXP 5.0, PHP CLI/FPM packages and runtime extensions.|[source](<https://doc.ibexa.co/en/5.0/getting_started/requirements/>)|
|2026-10-21 13:41:09 +0200|Icinga GmbH|Icinga Certificate Monitoring||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official module guide requires Icinga Web; the release announcement explicitly identifies this PHP module and version support.|[source 1](<https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/02-Installation/>)<br>[source 2](<https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates>)|
|2026-10-21 13:41:09 +0200|Icinga GmbH|Icinga DB Web||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The named web module has its own PHP/module requirements and is installed into Icinga Web.|[source](<https://icinga.com/docs/icinga-db-web/latest/doc/02-Installation/From-Source/>)|
|2026-10-21 13:41:09 +0200|Icinga GmbH|Icinga Director||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official module installation guide supplies PHP and extension requirements for configuration deployment and background work.|[source](<https://icinga.com/docs/icinga-director/latest/doc/02-Installation/From-Source/>)|
|2026-10-21 13:41:09 +0200|Icinga GmbH|Icinga PDF Export||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor explicitly identifies the PHP PDF-export module and separates PHP libraries from its locally installed Chromium process.|[source](<https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates>)|
|2026-10-21 13:41:09 +0200|Icinga GmbH|Icinga Reporting||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The module's own requirements explicitly identify PHP, mbstring and a database PDO connector.|[source 1](<https://icinga.com/docs/icinga-reporting/latest/doc/02-Installation/>)<br>[source 2](<https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates>)|
|2026-10-21 13:41:09 +0200|Icinga GmbH|Icinga Web||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official guide explicitly separates PHP web/CLI requirements from Icinga 2 and Icinga DB monitoring services.|[source 1](<https://icinga.com/docs/icinga-web/latest/doc/02-Installation/From-Source/>)<br>[source 2](<https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates>)|
|2026-10-21 13:41:09 +0200|igbinary project|igbinary native PHP serializer extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release is a PHP binary serializer and states its PHP requirement.|[source 1](<https://pecl.php.net/package/igbinary/3.2.16>)<br>[source 2](<https://pecl.php.net/package/igbinary>)|
|2026-10-21 13:41:09 +0200|ILIAS Society / ILIAS project|ILIAS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official release-branch guide documents mod_php, FCGI/PHP-FPM and PHP CLI setup and cron, with separate required and feature-dependent modules.|[source 1](<https://github.com/ILIAS-eLearning/ILIAS/blob/release_11/docs/configuration/install.md>)<br>[source 2](<https://github.com/ILIAS-eLearning/ILIAS/releases>)|
|2026-10-21 13:41:09 +0200|Imagick project|Imagick native PHP image extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release describes a native PHP wrapper for ImageMagick and declares a PHP minimum; its notes mention PHP 8.5 compilation compatibility.|[source 1](<https://pecl.php.net/package/imagick/3.8.1>)<br>[source 2](<https://pecl.php.net/package/imagick>)|
|2026-10-21 13:41:09 +0200|iNextrix / ASTPP|ASTPP v7 PHP billing and management application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>ASTPP's vendor explicitly identifies PHP8.2 in version7.|[source](<https://astppbilling.org/your-top-questions-from-the-astpp-v7-webinar-answered>)|
|2026-10-21 13:41:09 +0200|Infection project|Infection PHP mutation-testing tool||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for infection/infection 0.35.8 declares PHP ^8.3 for this tool/library.|[source](<https://packagist.org/packages/infection/infection>)|
|2026-10-21 13:41:09 +0200|Invision Community / Invision Power Services|Invision Community Classic||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor explicitly describes PHP requirements for the self-hosted Classic product and customer responsibility for server security patches and version upgrades.|[source](<https://invisioncommunity.com/buy/self-hosted/>)|
|2026-10-21 13:41:09 +0200|Invoice Ninja|Invoice Ninja self-hosted server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The source manifest confirms the PHP server and direct extensions; the repository identifies a Laravel API/client-portal implementation.|[source 1](<https://github.com/invoiceninja/invoiceninja/blob/v5-stable/composer.json>)<br>[source 2](<https://www.invoiceninja.org/getting-started/>)<br>[source 3](<https://github.com/invoiceninja/invoiceninja>)<br>[source 4](<https://invoiceninja.github.io/docs/self-host/self-host-installation>)|
|2026-10-21 13:41:09 +0200|InvoicePlane project|InvoicePlane||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The installation guide confirms PHP web/CLI use; the manifest identifies PHP libraries and a CodeIgniter 3.4 fork separately from development tools.|[source 1](<https://github.com/InvoicePlane/InvoicePlane/blob/develop/.github/docs/INSTALLATION.md>)<br>[source 2](<https://github.com/InvoicePlane/InvoicePlane/blob/develop/composer.json>)|
|2026-10-21 13:41:09 +0200|IONOS|IONOS webhosting PHP and CLI options||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>IONOS documents per-domain PHP versions and a separate CLI version/path table.|[source 1](<https://www.ionos.com/help/hosting/managing-php-versions-in-the-control-panel/displaying-or-changing-php-versions/>)<br>[source 2](<https://www.ionos.com/help/hosting/using-php-for-web-projects/executing-php-files-via-the-command-line-php-cli/>)|
|2026-10-21 13:41:09 +0200|ISPConfig project|ISPConfig 3 control panel UI and scripts||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 3.2.12 announcement removes PHP5.6-and-earlier support for the UI/scripts and requires system PHP's OpenSSL module.|[source](<https://www.ispconfig.org/blog/ispconfig-3-2-12-released/>)|
|2026-10-21 13:41:09 +0200|Issabel|Issabel 5 PHP communications management||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Issabel identifies PHP7.4 as a component of its version5 release.|[source](<https://www.issabel.com/en/release-of-issabel-5-innovation-and-advancement-in-unified-communications/>)|
|2026-10-21 13:41:09 +0200|Jakub Vrana / Adminer project|Adminer||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official site describes a database administration application shipped as a single PHP file and requiring PHP session support.|[source](<https://www.adminer.org/>)|
|2026-10-21 13:41:09 +0200|JBMC Software / DirectAdmin|DirectAdmin CustomBuild hosted PHP||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>DirectAdmin documents multiple installed PHP versions and per-domain/subdomain selection.|[source 1](<https://docs.directadmin.com/webservices/php/multiple-php.html>)<br>[source 2](<https://docs.directadmin.com/webservices/php/php-options.html>)|
|2026-10-21 13:41:09 +0200|JetBrains|PhpStorm external PHP interpreter integration||Investigation|Investigation|CVE assessment: Optional PHP path; CVE match unknown<br>The guide requires a separately installed PHP engine and configures its executable/php.ini, interpreter selection and optional Xdebug integration.|[source](<https://www.jetbrains.com/help/phpstorm/configuring-local-interpreter.html>)|
|2026-10-21 13:41:09 +0200|Joomla project|Joomla 6.x||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The stable/current Joomla documentation identifies version 6.1 and gives a PHP 8.3.0 minimum, PHP 8.4 recommendation and required modules.|[source](<https://manual.joomla.org/docs/get-started/technical-requirements/>)|
|2026-10-21 13:41:09 +0200|Jordi Boggiano / Monolog contributors|Monolog||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Monolog is a PHP logging library; handler-dependent modules and service clients are optional, and several integrations appear only in require-dev.|[source](<https://packagist.org/packages/monolog/monolog>)|
|2026-10-21 13:41:09 +0200|JPHP Group|JPHP JVM compiler and runtime||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>JPHP compiles PHP source to JVM bytecode and distinguishes its own runtime library from Zend PHP.|[source](<https://github.com/jphp-group/jphp>)|
|2026-10-21 13:41:09 +0200|Kanboard project|Kanboard||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The server-side requirements distinguish PHP versions and extensions from ordinary browser/device requirements.|[source](<https://docs.kanboard.org/v1/admin/requirements/>)|
|2026-10-21 13:41:09 +0200|Kevin Papst / Kimai project|Kimai||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official source and registry identify a PHP/Symfony time-tracking application and native module requirements.|[source 1](<https://packagist.org/packages/kimai/kimai>)<br>[source 2](<https://github.com/kimai/kimai>)<br>[source 3](<https://github.com/kimai/kimai/blob/main/composer.json>)<br>[source 4](<https://www.kimai.org/documentation/installation.html>)|
|2026-10-21 13:41:09 +0200|Kinsta|Kinsta managed WordPress PHP hosting||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Kinsta's WordPress hosting guide documents selectable PHP engine families.|[source](<https://kinsta.com/docs/wordpress-hosting/php/>)|
|2026-10-21 13:41:09 +0200|Kirby CMS project|Kirby CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Kirby provides version-specific PHP support and required, recommended and optional extension lists.|[source](<https://getkirby.com/docs/reference/system/requirements>)|
|2026-10-21 13:41:09 +0200|Klemen Stirn / Hesk|Hesk Free self-hosted helpdesk||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor identifies Hesk Free as self-hosted PHP/MySQL software and publishes its version and PHP range.|[source](<https://www.hesk.com/download.php>)|
|2026-10-21 13:41:09 +0200|Kopano / Kopano-dev|Kopano WebApp||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official WebApp mirror explicitly lists PHP server dependencies and a separate native MAPI interface.|[source](<https://github.com/Kopano-dev/kopano-webapp>)|
|2026-10-21 13:41:09 +0200|Ladybird Web Solution / Faveo|Faveo Helpdesk Community Edition||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Edition-labelled vendor installation instructions explicitly provision PHP for the Community helpdesk.|[source 1](<https://docs.faveohelpdesk.com/docs/installation/providers/community/ubuntu-apache/>)<br>[source 2](<https://docs.faveohelpdesk.com/docs/system-requirement/requirement/>)|
|2026-10-21 13:41:09 +0200|Laminas Project / Linux Foundation|Laminas MVC||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The released package declares PHP and MVC application dependencies; official Laminas documentation labels MVC security-only maintenance.|[source 1](<https://packagist.org/packages/laminas/laminas-mvc>)<br>[source 2](<https://docs.laminas.dev/>)|
|2026-10-21 13:41:09 +0200|Laminas Project / Mezzio|Mezzio||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher metadata identifies a PHP PSR-15 middleware framework with router, template and request-handler packages.|[source 1](<https://packagist.org/packages/mezzio/mezzio>)<br>[source 2](<https://docs.laminas.dev/>)|
|2026-10-21 13:41:09 +0200|Lando project|Lando PHP service plugin images||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Lando documents an optional PHP service and custom images; its legacy warning says EOL families can run but should be considered deprecated.|[source](<https://docs.lando.dev/plugins/php/index.html>)|
|2026-10-21 13:41:09 +0200|Laragon project|Laragon Full Windows development bundle||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Laragon explicitly calls PHP bundled, documents terminal PATH use and switching/updating PHP versions in the Full environment.|[source](<https://laragon.org/download>)|
|2026-10-21 13:41:09 +0200|Laravel|Laravel 13 framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Laravel 13 deployment documentation identifies server PHP requirements and web/CLI deployment operations. The separately versioned 12 guide has a lower PHP floor.|[source 1](<https://laravel.com/framework/docs/deployment>)<br>[source 2](<https://laravel.com/framework/docs/12.x/deployment>)|
|2026-10-21 13:41:09 +0200|Laravel|Laravel Cloud PHP runtime option||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Laravel Cloud documents PHP runtime families and an8.5-specific pdo_sqlsrv availability limitation.|[source 1](<https://laravel.com/cloud/docs/runtimes>)<br>[source 2](<https://laravel.com/cloud/docs/environments>)|
|2026-10-21 13:41:09 +0200|Laravel|Laravel Vapor core PHP invocation package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The published package manifest identifies Vapor's PHP invocation handlers and runtime dependencies.|[source](<https://packagist.org/packages/laravel/vapor-core>)|
|2026-10-21 13:41:09 +0200|Laravel|Laravel Vapor PHP Docker base image family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Vapor's Docker instructions name its PHP base-image family and architecture/version tag choices.|[source](<https://docs.vapor.build/projects/environments>)|
|2026-10-21 13:41:09 +0200|Laravel; AWS infrastructure|Laravel Vapor PHP serverless hosting configuration||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Vapor documents separate native and Docker PHP runtime modes and their customization boundaries.|[source](<https://docs.vapor.build/projects/environments>)|
|2026-10-21 13:41:09 +0200|LDAP Account Manager project|LDAP Account Manager||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The manual requires a PHP web environment and separates optional Perl lamdaemon from the PHP application.|[source](<https://www.ldap-account-manager.org/static/doc/manual/ch02.html>)|
|2026-10-21 13:41:09 +0200|Leantime project|Leantime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The root runtime manifest explicitly requires PHP and modules, including LDAP and process-control modules, separately from development tooling.|[source 1](<https://github.com/Leantime/leantime/blob/master/composer.json>)<br>[source 2](<https://github.com/Leantime/leantime>)|
|2026-10-21 13:41:09 +0200|LibreNMS project|LibreNMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The root manifest requires PHP and runtime modules; the guide separately configures PHP-FPM/CLI and Python/native helper packages.|[source 1](<https://docs.librenms.org/Installation/Install-LibreNMS/>)<br>[source 2](<https://github.com/librenms/librenms/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|libsmbclient-php project|SMBClient native PHP Samba binding||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release provides PHP functions and smb streams using Samba's libsmbclient.|[source 1](<https://pecl.php.net/package/smbclient/1.1.2>)<br>[source 2](<https://pecl.php.net/package/smbclient>)|
|2026-10-21 13:41:09 +0200|libvirt-php contributors / Unraid distribution|Unraid libvirt-php management binding||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Unraid independently lists libvirt-php alongside its matching PHP package.|[source 1](<https://docs.unraid.net/unraid-os/release-notes/7.3.2/>)<br>[source 2](<https://docs.unraid.net/unraid-os/release-notes/7.4.0/>)|
|2026-10-21 13:41:09 +0200|Lime Technology / Unraid|Unraid PHP management runtime distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Unraid release notes identify its PHP package and PHP web GUI files.|[source 1](<https://docs.unraid.net/unraid-os/release-notes/7.3.2/>)<br>[source 2](<https://docs.unraid.net/unraid-os/release-notes/7.4.0/>)|
|2026-10-21 13:41:09 +0200|LimeSurvey GmbH / LimeSurvey project|LimeSurvey Community Edition||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The CE installation manual binds PHP bands to major LS versions and separates conditional survey, mail, directory and archive features.|[source 1](<https://www.limesurvey.org/manual/Installation_-_LimeSurvey_CE>)<br>[source 2](<https://www.limesurvey.org/manual/index.php?title=Installation_-_LimeSurvey_CE&oldid=385498>)|
|2026-10-21 13:41:09 +0200|LiveCodes project|LiveCodes PHP (Uniter) browser mode||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The php language mode uses Uniter in the browser and lists version 2.18.0.|[source](<https://livecodes.io/docs/languages/php/>)|
|2026-10-21 13:41:09 +0200|LiveCodes project|LiveCodes PHP (Wasm) browser mode||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The Wasm mode names its php-wasm and PHP versions separately.|[source](<https://livecodes.io/docs/languages/php-wasm/>)|
|2026-10-21 13:41:09 +0200|Lunar project|Lunar administration panel||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher package metadata identifies an admin panel and requires its exact commerce-core and Filament component versions.|[source](<https://packagist.org/packages/lunarphp/lunar>)|
|2026-10-21 13:41:09 +0200|Lunar project|Lunar commerce core||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher metadata declares PHP, three direct extensions and Laravel for the headless commerce core.|[source](<https://packagist.org/packages/lunarphp/core>)|
|2026-10-21 13:41:09 +0200|m0n0wall project|m0n0wall legacy PHP-CGI management appliance||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The project's facts page lists PHP-CGI; its closure announcement ends further development/releases.|[source 1](<https://m0n0.ch/wall/facts.php>)<br>[source 2](<https://m0n0.ch/wall/end_announcement.php>)|
|2026-10-21 13:41:09 +0200|Mage-OS project|Mage-OS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official page lists PHP runtime requirements and identifies the Magento base for Mage-OS release families.|[source](<https://mage-os.org/get-started/system-requirements/>)|
|2026-10-21 13:41:09 +0200|Magento / Adobe|Magento Open Source||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Adobe's shared PHP settings page supplies a separate Magento Open Source extension list and makes pcntl conditional on parallel indexing.|[source 1](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings>)<br>[source 2](<https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements>)|
|2026-10-21 13:41:09 +0200|MailWatch project|MailWatch for MailScanner||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official repository explicitly describes a PHP web front end to the separate MailScanner system.|[source](<https://github.com/mailwatch/MailWatch>)|
|2026-10-21 13:41:09 +0200|MAMP GmbH|MAMP local server environment||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>MAMP describes an installable local stack containing PHP; its downloads distinguish OS-specific installer versions.|[source 1](<https://www.mamp.info/en/mamp/mac/>)<br>[source 2](<https://www.mamp.info/en/downloads/>)|
|2026-10-21 13:41:09 +0200|MantisBT project|MantisBT||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project's own installation requirements explicitly identify PHP for the bug tracker server.|[source](<https://github.com/mantisbt/mantisbt>)|
|2026-10-21 13:41:09 +0200|Matomo|Matomo On-Premise||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor FAQ confirms PHP web/CLI processing and upcoming beta requirements; the 5.x source root preserves a lower declared PHP floor.|[source 1](<https://matomo.org/faq/on-premise/matomo-requirements/>)<br>[source 2](<https://github.com/matomo-org/matomo/blob/5.x-dev/composer.json>)|
|2026-10-21 13:41:09 +0200|Matomo / InnoCraft|Matomo Analytics for WordPress||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher listing identifies server-side analytics processing in WordPress and version-gated PHP requirements for the coming Matomo-6 update.|[source](<https://wordpress.org/plugins/matomo/>)|
|2026-10-21 13:41:09 +0200|Matomo team|Matomo PHP tracking client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The tracking package requires PHP ^8.1 and json, and suggests curl for HTTPS tracking requests.|[source](<https://packagist.org/packages/matomo/matomo-php-tracker>)|
|2026-10-21 13:41:09 +0200|Mautic project|Mautic||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official installation guide documents PHP web settings and console execution for marketing automation.|[source 1](<https://docs.mautic.org/en/7.0/getting_started/how_to_install_mautic.html>)<br>[source 2](<https://github.com/mautic/mautic/blob/7.x/composer.json>)|
|2026-10-21 13:41:09 +0200|MediaWiki project|MediaWiki||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>MediaWiki explicitly requires PHP, lists native modules and distinguishes recommended modules from a 32-bit arithmetic alternative.|[source](<https://www.mediawiki.org/wiki/Manual:Installation_requirements>)|
|2026-10-21 13:41:09 +0200|MessageBird|MessageBird PHP REST API client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The publisher client requires PHP >=8.0, curl/json and Firebase JWT support.|[source](<https://packagist.org/packages/messagebird/php-rest-api>)|
|2026-10-21 13:41:09 +0200|Metaways / tine project|tine groupware||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project requires PHP for the groupware server and lists mandatory and optional modules separately from browser/native clients.|[source](<https://docs.tine-groupware.de/main/operators/System_Requirements/>)|
|2026-10-21 13:41:09 +0200|Microsoft|Azure App Service PHP on Linux||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Microsoft documents Linux PHP workloads and explicitly says Windows PHP support ended in November2022.|[source](<https://learn.microsoft.com/en-us/azure/app-service/configure-language-php>)|
|2026-10-21 13:41:09 +0200|Microsoft Azure Storage|Microsoft Azure Storage PHP blob client package (retired)||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The published blob package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.|[source 1](<https://packagist.org/packages/microsoft/azure-storage-blob>)<br>[source 2](<https://github.com/Azure/azure-storage-php>)|
|2026-10-21 13:41:09 +0200|Microsoft Azure Storage|Microsoft Azure Storage PHP common client package (retired)||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The published common package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.|[source 1](<https://packagist.org/packages/microsoft/azure-storage-common>)<br>[source 2](<https://github.com/Azure/azure-storage-php>)|
|2026-10-21 13:41:09 +0200|Microsoft Azure Storage|Microsoft Azure Storage PHP file client package (retired)||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The published file package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.|[source 1](<https://packagist.org/packages/microsoft/azure-storage-file>)<br>[source 2](<https://github.com/Azure/azure-storage-php>)|
|2026-10-21 13:41:09 +0200|Microsoft Azure Storage|Microsoft Azure Storage PHP queue client package (retired)||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The published queue package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.|[source 1](<https://packagist.org/packages/microsoft/azure-storage-queue>)<br>[source 2](<https://github.com/Azure/azure-storage-php>)|
|2026-10-21 13:41:09 +0200|Microsoft Azure Storage|Microsoft Azure Storage PHP table client package (retired)||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The published table package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.|[source 1](<https://packagist.org/packages/microsoft/azure-storage-table>)<br>[source 2](<https://github.com/Azure/azure-storage-php>)|
|2026-10-21 13:41:09 +0200|Microsoft Graph Client Tooling|Microsoft Graph PHP SDK||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The SDK declares PHP ^8.2 and microsoft/microsoft-graph-core ^3.0.0 for caller-side Graph access.|[source](<https://packagist.org/packages/microsoft/microsoft-graph>)|
|2026-10-21 13:41:09 +0200|MISP project / CIRCL|MISP 2.5 core PHP server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official requirements distinguish mandatory PHP extensions from recommended modules for MISP2.5.|[source 1](<https://www.circl.lu/doc/misp/requirements/>)<br>[source 2](<https://github.com/MISP/MISP>)|
|2026-10-21 13:41:09 +0200|Mockery project|Mockery PHP test-double framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for mockery/mockery 1.6.15 declares PHP >=7.3 for this tool/library.|[source](<https://packagist.org/packages/mockery/mockery>)|
|2026-10-21 13:41:09 +0200|MODX project|MODX Revolution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The guide says MODX is written in PHP and lists the 3.2+ PHP 8.1 floor and required modules.|[source](<https://docs.modx.com/3.x/en/getting-started/server-requirements>)|
|2026-10-21 13:41:09 +0200|Mollie|Mollie Payments for WooCommerce||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher's listing requires PHP, cURL and JSON and documents merchant API keys and payment-status webhooks.|[source](<https://wordpress.org/plugins/mollie-payments-for-woocommerce/>)|
|2026-10-21 13:41:09 +0200|Mollie B.V.|Mollie API PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Mollie's PHP client declares PHP ^8.2, curl/json/openssl and PSR transport interfaces. A separate Mollie OAuth package is suggested for some endpoints.|[source](<https://packagist.org/packages/mollie/mollie-api-php>)|
|2026-10-21 13:41:09 +0200|MongoDB PHP driver team|MongoDB native PHP driver extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PECL identifies the native glue layer and native-library updates; the PHP manual supplies a version-qualified family minimum and default bundled/native options. Userland mongodb/mongodb requirements remain separate.|[source 1](<https://pecl.php.net/package/mongodb/2.5.0>)<br>[source 2](<https://www.php.net/manual/en/mongodb.requirements.php>)|
|2026-10-21 13:41:09 +0200|MongoDB PHP driver team|MongoDB PHP userland library||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The userland library requires PHP ^8.1 and ext-mongodb ^2.5; its metadata replaces mongodb/builder.|[source](<https://packagist.org/packages/mongodb/mongodb>)|
|2026-10-21 13:41:09 +0200|Montala / ResourceSpace|ResourceSpace||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor identifies PHP as the server language, gives per-release bands and required distro packages, and separates external media tools.|[source](<https://www.resourcespace.com/knowledge-base/systemadmin/general_requirements?from_rs=true>)|
|2026-10-21 13:41:09 +0200|Moodle project|Moodle||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official 5.3 notes specify PHP 8.3.0+, additional 8.4.x support, sodium and 64-bit PHP. The download catalogue separates the 5.3 release from weekly 5.3+ packages and publishes a release checksum.|[source 1](<https://moodledev.io/general/releases/5.3>)<br>[source 2](<https://docs.moodle.org/503/en/PHP>)<br>[source 3](<https://download.moodle.org/releases/latest/>)<br>[source 4](<https://packaging.moodle.org/stable503/moodle-5.3.tgz.sha256>)|
|2026-10-21 13:41:09 +0200|Moodle project / complete-installer packagers|Moodle Windows complete installer family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Moodle publishes Windows installers containing Apache, MySQL and PHP, built using XAMPP. Its catalogue warns of component requirements mismatches and against production use.|[source](<https://download.moodle.org/windows/>)|
|2026-10-21 13:41:09 +0200|Moodle project / Ralf Krause|Moodle4Mac complete installer family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Moodle publishes MAMP-based installers containing Apache, MySQL and PHP. The linked guide restricts them to local testing/development and documents modified environment checks.|[source 1](<https://download.moodle.org/macosx/>)<br>[source 2](<https://docs.moodle.org/503/en/Installation_Package_for_OS_X>)|
|2026-10-21 13:41:09 +0200|msgpack-php project|MessagePack native PHP serialization extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official catalogue describes a PHP MessagePack API and declares the selected 3.0.1 release minimum.|[source](<https://pecl.php.net/package/msgpack>)|
|2026-10-21 13:41:09 +0200|MyBB Group|MyBB||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official MyBB 1.8 installation requirements identify PHP and three named extensions plus a selected database driver.|[source](<https://docs.mybb.com/1.8/install/requirements/>)|
|2026-10-21 13:41:09 +0200|MyBB Group|MyBB Merge System||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official requirements name Merge System separately from the running MyBB forum and require PHP for the migration tool.|[source](<https://docs.mybb.com/1.8/install/requirements/>)|
|2026-10-21 13:41:09 +0200|Nagios Enterprises|Nagios Fusion web component subsystem||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor explains how PHP component files are included during Fusion application instantiation and register web-page callbacks.|[source](<https://assets.nagios.com/downloads/nagiosfusion/guides/developer/components.php>)|
|2026-10-21 13:41:09 +0200|Nagios Enterprises|Nagios XI web configuration-wizard subsystem||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official development guide identifies PHP scripts and callback functions loaded by the XI configuration-wizard interface.|[source](<https://assets.nagios.com/downloads/nagiosxi/docs/Writing-Custom-Wizards-2024.pdf>)|
|2026-10-21 13:41:09 +0200|Neos project|Neos CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Neos publishes a Neos/Flow/PHP matrix and requires matching web and CLI PHP versions for class precompilation.|[source](<https://docs.neos.io/guide/installation-development-setup/system-requirements>)|
|2026-10-21 13:41:09 +0200|Netgate / pfSense|pfSense management components||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Netgate explicitly identifies the legacy GUI as PHP, the new Plus GUI as Go, and continued availability of both during transition. Nexus controller options are separately enabled.|[source 1](<https://www.netgate.com/blog/the-new-gui-for-pfsense-plus>)<br>[source 2](<https://docs.netgate.com/pfsense/en/latest/development/additional-php-modules.html>)<br>[source 3](<https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html>)<br>[source 4](<https://docs.netgate.com/pfsense/en/latest/releases/26-07.html>)<br>[source 5](<https://docs.netgate.com/pfsense/en/latest/nexus/options.html>)|
|2026-10-21 13:41:09 +0200|Netlify|Netlify PHP build environment and Composer integration||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Netlify documents PHP_VERSION for building a site and Composer handling when composer.json is present.|[source](<https://docs.netlify.com/build/configure-builds/manage-dependencies/>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>MVC kernel and application request dispatch are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/application>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Assets||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP-side asset mapping, versioning and storage integration are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/assets>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Bootstrap||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP application bootstrap and configuration loading are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/bootstrap>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Caching||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP caching abstractions and selected storage are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/caching>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Command Line||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP command-line interface utilities are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/command-line>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Database||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP database access and abstraction are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/database>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette DI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP dependency injection and container compilation are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/di>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Forms||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Server PHP form handling and validation are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/forms>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette HTTP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP requests, uploaded-file handling, URLs and sessions are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/http>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Mail||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP mail construction and sending are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/mail>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette PHP Generator||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>PHP source generation and optional source-body parsing are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/php-generator>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette RobotLoader||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP class discovery, source analysis, autoloading and cache are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/robot-loader>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette SafeStream||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP safe/atomic file stream handling are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/safe-stream>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Security||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP authentication, authorization and ACL handling are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/security>)|
|2026-10-21 13:41:09 +0200|Nette community|Nette Utils||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP utility functions and selected image/string/JSON helpers are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/nette/utils>)|
|2026-10-21 13:41:09 +0200|Nette community / Latte|Latte template engine||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP template compilation and rendering are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/latte/latte>)|
|2026-10-21 13:41:09 +0200|Nette community / Tracy|Tracy debugger||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>PHP debugging, diagnostics and error handling are implemented in this independently identifiable PHP package.|[source](<https://packagist.org/packages/tracy/tracy>)|
|2026-10-21 13:41:09 +0200|Nette Foundation / Nette community|Nette framework metapackage||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Nette 3.3.0 is a metapackage with a finite seventeen-name direct runtime package list; each name was independently checked for PHP use.|[source](<https://packagist.org/packages/nette/nette>)|
|2026-10-21 13:41:09 +0200|Nextcloud|Nextcloud Office integration app||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official integration app has PHP runtime dependencies distinct from its development tools and the external document-editing server.|[source](<https://github.com/nextcloud/richdocuments/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud|Nextcloud Server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>A pinned official-repository wiki revision gives the compatibility matrix. The 35.0.2 release commit changes version.php from RC2 to the final release; this confirms an actual release identity beyond a moving manual label.|[source 1](<https://github.com/nextcloud/server/wiki/Releases-and-PHP-versions/d90292c6b2f2d0707fc61571364185fa311525bb>)<br>[source 2](<https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html>)<br>[source 3](<https://docs.nextcloud.com/server/stable/admin_manual/installation/php_configuration.html>)<br>[source 4](<https://github.com/nextcloud/server/releases>)<br>[source 5](<https://github.com/nextcloud/server/commit/ba900af933e61ffa005315b09d6454bfbbcbcc81>)|
|2026-10-21 13:41:09 +0200|Nextcloud|Nextcloud Talk server app||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official application manifest contains a production PHP namespace/autoload tree and runtime dependencies, distinct from development tools.|[source](<https://github.com/nextcloud/spreed/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud Calendar project|Nextcloud Calendar server app||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The prior release-publisher version pin is retained. A dated official FreeBSD ports commit independently records Calendar 6.6.2 and its advertised source-archive checksum; it does not supply the missing app/core PHP compatibility pair.|[source 1](<https://lists.freebsd.org/archives/dev-commits-ports-main/2026-October/215291.html>)<br>[source 2](<https://github.com/nextcloud/calendar/blob/main/composer.json>)<br>[source 3](<https://github.com/nextcloud/calendar/blob/main/README.md>)<br>[source 4](<https://github.com/nextcloud-releases/calendar/releases>)<br>[source 5](<https://github.com/nextcloud-releases/calendar/commit/1b34383d4cb89ae1f2312caad20677e5c7797285>)<br>[source 6](<https://github.com/nextcloud/calendar/releases>)|
|2026-10-21 13:41:09 +0200|Nextcloud Collectives project|Nextcloud Collectives server app||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official manifest separates PHP runtime requirements and collaboration libraries from development-only DOM and test tools.|[source](<https://github.com/nextcloud/collectives/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud Contacts project|Nextcloud Contacts server app||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official app manifest declares its PHP runtime constraint separately from development dependencies and the Composer platform target.|[source](<https://github.com/nextcloud/contacts/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud Deck project|Nextcloud Deck||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official repository explicitly documents PHP dependency installation and PHP tooling for the Deck app.|[source 1](<https://github.com/nextcloud/deck>)<br>[source 2](<https://github.com/nextcloud/deck/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud Docker community volunteers / Docker Official Images|Nextcloud community Docker image distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The repository distinguishes community maintenance from Nextcloud GmbH AIO, and explicitly bases its FPM variant on php-fpm.|[source](<https://github.com/nextcloud/docker>)|
|2026-10-21 13:41:09 +0200|Nextcloud GmbH / Nextcloud AIO maintainers|Nextcloud AIO Nextcloud application container||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The AIO Nextcloud recipe names its PHP 8.4.26 FPM Alpine base and compiles/enables native modules, including separately installed PECL imap for PHP 8.4.|[source](<https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile>)|
|2026-10-21 13:41:09 +0200|Nextcloud Mail project|Nextcloud Mail server app||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The app manifest declares PHP and OpenSSL plus separate mail-processing libraries; its README requires a Nextcloud server and PHP dependency management.|[source](<https://github.com/nextcloud/mail/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud Notes project|Nextcloud Notes||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official Notes manifest confirms PHP development tooling and distinguishes require-dev from a Composer resolution target.|[source](<https://github.com/nextcloud/notes/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Nextcloud Snap maintainers|Nextcloud Snap bundled PHP runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Snap recipe has an explicit PHP autotools part with FPM enabled and separate Redis6.3.0/APCu5.1.28 extension builds.|[source](<https://github.com/nextcloud-snap/nextcloud-snap/blob/master/snap/snapcraft.yaml>)|
|2026-10-21 13:41:09 +0200|NextcloudPi project / Nextcloud community|NextcloudPi turnkey PHP stack||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The NextcloudPi feature list explicitly includes PHP 8.1, Apache, APCu and Zend OPcache file cache.|[source](<https://github.com/nextcloud/nextcloudpi>)|
|2026-10-21 13:41:09 +0200|Nikita Popov / PHP-Parser contributors|PHP-Parser userland parser||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>PHP-Parser is implemented in PHP and declares native tokenizer/json requirements for parsing source into an abstract syntax tree.|[source](<https://packagist.org/packages/nikic/php-parser>)|
|2026-10-21 13:41:09 +0200|NixOS / Nixpkgs maintainers|Nixpkgs PHP runtime environments||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Nixpkgs documents a minimal PHP base wrapped with selected extensions and generated php.ini; PHP-built tools inherit their owning runtime.|[source 1](<https://nixos.org/manual/nixpkgs/stable/>)<br>[source 2](<https://wiki.nixos.org/w/index.php?title=PHP&oldid=33628>)|
|2026-10-21 13:41:09 +0200|Observium Limited / Observium project|Observium||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official installation guide explicitly provisions both the PHP web SAPI and command-line runtime.|[source](<https://docs.observium.org/install_debian/>)|
|2026-10-21 13:41:09 +0200|October CMS project|October CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 4.x guide explicitly calls October a PHP web application and requires PHP 8.2 with named modules.|[source](<https://docs.octobercms.com/4.x/setup/installation.html>)|
|2026-10-21 13:41:09 +0200|Open eClass project / GUnet|Open eClass||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 4.1 installation page requires PHP and names modules; it explicitly says the current package does not include phpMyAdmin.|[source](<https://docs.openeclass.org/en/4.1/install>)|
|2026-10-21 13:41:09 +0200|Open Social project|Open Social Drupal installation profile||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official repository manifest identifies a drupal-profile and explicitly declares PHP ^8.3 and Drupal core dependencies.|[source](<https://github.com/goalgorilla/open_social/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|Open Web Analytics project|Open Web Analytics||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official analytics application manifest explicitly requires PHP and a Composer merge plugin for module requirements.|[source](<https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|OpenBSD ports maintainers / PHP documentation team|OpenBSD optional PHP package and ports family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP documentation confirms split optional OpenBSD packages; dated7.9 release notes list four PHP source-version families.|[source 1](<https://www.php.net/manual/en/install.unix.openbsd.php>)<br>[source 2](<https://www.openbsd.org/79.html>)|
|2026-10-21 13:41:09 +0200|OpenCart project|OpenCart||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher package metadata for 4.1.0.4 explicitly requires PHP >=8.1.0. The official repository describes the PHP server and runtime modules.|[source 1](<https://packagist.org/packages/opencart/opencart>)<br>[source 2](<https://github.com/opencart/opencart/blob/master/docs/getting-started/system-requirements.md>)|
|2026-10-21 13:41:09 +0200|OpenConext / SURF|OpenConext EngineBlock SAML proxy||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The SAML proxy manifest declares PHP ^8.5 and runtime extensions.|[source 1](<https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json>)<br>[source 2](<https://github.com/OpenConext/OpenConext-engineblock>)<br>[source 3](<https://github.com/OpenConext/OpenConext-engineblock/releases>)<br>[source 4](<https://openconext.org/openconext-building-blocks/>)|
|2026-10-21 13:41:09 +0200|OpenDocMan project|OpenDocMan||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The source manifest requires PHP, while official README and website requirements show different generations of guidance.|[source 1](<https://github.com/opendocman/opendocman/blob/master/composer.json>)<br>[source 2](<https://github.com/opendocman/opendocman>)<br>[source 3](<https://www.opendocman.com/documentation/>)|
|2026-10-21 13:41:09 +0200|OpenMage project|OpenMage||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official requirements establish PHP and intl. Publisher registry metadata separately identifies OpenMage as a Magento-1 fork.|[source 1](<https://docs.openmage.org/users/requirements/>)<br>[source 2](<https://packagist.org/packages/openmage/magento-lts>)|
|2026-10-21 13:41:09 +0200|openmediavault project|openmediavault PHP management backend||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official web GUI deployment state configures a dedicated PHP-FPM pool running as openmediavault-webgui.|[source](<https://github.com/openmediavault/openmediavault/blob/master/deb/openmediavault/srv/salt/omv/deploy/phpfpm/10webgui.sls>)|
|2026-10-21 13:41:09 +0200|OpenSearch Contributors; inherited Elastic client lineage|OpenSearch PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The PHP client declares PHP ^8.2, curl/json and PSR HTTP implementations. AWS SDK is suggested for the signing decorator and appears in require-dev.|[source](<https://packagist.org/packages/opensearch-project/opensearch-php>)|
|2026-10-21 13:41:09 +0200|OpenSwoole project|OpenSwoole native PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release declares PHP >=8.3 and documents its native Zend Fiber integration.|[source](<https://pecl.php.net/package/openswoole/26.2.0>)|
|2026-10-21 13:41:09 +0200|OpenWrt packages feed maintainers|OpenWrt selectable PHP8 package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>OpenWrt recipe separates configuration, runtime binaries, startup integration and extension modules, rather than bundling an interpreter in every php8 package.|[source](<https://github.com/openwrt/packages/blob/master/lang/php8/Makefile>)|
|2026-10-21 13:41:09 +0200|OPNsense / Deciso|OPNsense WebGUI and API||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Versioned release entries distinguish the PHP8.5.11/Phalcon5.22.1 declaration in26.7.6 from the newer26.7.7 release identity; no patch payload is inferred from absence of a changed-package line.|[source 1](<https://docs.opnsense.org/releases/CE_26.7.html>)<br>[source 2](<https://docs.opnsense.org/development/frontend/routing.html>)|
|2026-10-21 13:41:09 +0200|OrangeHRM Inc.|OrangeHRM Starter||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The edition-labelled Starter repository links to vendor prerequisites that explicitly install the PHP web environment.|[source 1](<https://starterhelp.orangehrm.com/hc/en-us/articles/6187572000540-Prerequisites-for-installing-OrangeHRM-Starter-in-Linux>)<br>[source 2](<https://github.com/orangehrm/orangehrm>)|
|2026-10-21 13:41:09 +0200|Oro Inc.|OroCommerce||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor separates server PHP/CLI and extension requirements from client-side browsers, cookies and JavaScript.|[source](<https://doc.oroinc.com/backend/setup/system-requirements/>)|
|2026-10-21 13:41:09 +0200|Oro, Inc.|OroCRM Community Edition application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The product-specific package metadata confirms PHP for the CRM Community application and distinguishes it from Enterprise, Commerce and Platform distributions.|[source 1](<https://packagist.org/packages/oro/crm-application>)<br>[source 2](<https://github.com/oroinc/crm-application/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|osCommerce|osCommerce 4||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor explicitly states that its V4 commerce platform uses PHP 8.3 and also supports older PHP from 7.4.|[source](<https://www.oscommerce.com/>)|
|2026-10-21 13:41:09 +0200|osCommerce legacy project|osCommerce Online Merchant 2.3||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The archived v2.3 manual requires a PHP-enabled web server and describes compatibility with PHP 4/5.|[source](<https://library.oscommerce.com/Online&en&oscom_2_3&getting_started&requirements>)|
|2026-10-21 13:41:09 +0200|OVHcloud|OVHcloud webhosting PHP / .ovhconfig runtime||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>OVHcloud documents PHP hosting families, environment/architecture boundaries and provider versus website-owner responsibilities.|[source](<https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/configure-your-web-hosting>)|
|2026-10-21 13:41:09 +0200|ownCloud / Kiteworks|ownCloud Classic 11||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor's 11.0 guide confirms that supported Docker installations include PHP 8 and Apache and replace native Linux installation.|[source](<https://doc.owncloud.com/server/11.0/admin_manual/installation/installing_with_docker.html>)|
|2026-10-21 13:41:09 +0200|ownCloud / Kiteworks|ownCloud Server 10||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The versioned vendor requirements identify PHP 7.4 for the classic server branch.|[source](<https://doc.owncloud.com/server/10.16/admin_manual/installation/system_requirements.html>)|
|2026-10-21 13:41:09 +0200|OXID eSales|OXID eShop||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 7.3 vendor requirements name PHP 8.2-8.4 and required modules for the documented eShop editions.|[source](<https://docs.oxid-esales.com/eshop/de/7.3/installation/neu-installation/server-und-systemvoraussetzungen.html>)|
|2026-10-21 13:41:09 +0200|Pantheon|Pantheon managed PHP application runtime||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Pantheon documents current PHP families and separately describes legacy7.4 availability.|[source 1](<https://docs.pantheon.io/guides/php>)<br>[source 2](<https://docs.pantheon.io/release-notes/2026/09/php-82-83-84-85-security-updates>)|
|2026-10-21 13:41:09 +0200|ParaTest / Brian Scaturro, Filippo Tessarotto and contributors|ParaTest parallel PHPUnit runner||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for brianium/paratest v7.27.2 declares PHP ~8.4.0 \|\| ~8.5.0 \|\| ~8.6.0 for this tool/library.|[source](<https://packagist.org/packages/brianium/paratest>)|
|2026-10-21 13:41:09 +0200|Part-DB project|Part-DB server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official server manifest declares PHP and direct native modules; README separates server execution from Node/yarn browser-asset building.|[source 1](<https://github.com/Part-DB/Part-DB-server/blob/master/composer.json>)<br>[source 2](<https://github.com/Part-DB/Part-DB-server>)|
|2026-10-21 13:41:09 +0200|Passbolt SA|Passbolt API server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor requires PHP and GNUPG for server-key verification/authentication, distinguishes FPM from modules and names database/image dependencies.|[source](<https://www.passbolt.com/docs/hosting/install/ce/from-source/>)|
|2026-10-21 13:41:09 +0200|PayPal|PayPal Server SDK for PHP||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The PHP Server SDK requires curl/json and APIMatic support packages. Its README names five supported controller groups.|[source](<https://packagist.org/packages/paypal/paypal-server-sdk>)|
|2026-10-21 13:41:09 +0200|PCOV / Joe Watkins and contributors|PCOV PHP native code-coverage driver||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official release catalogue requires PHP for PCOV; upstream documents enabled versus disabled executor hooks.|[source 1](<https://pecl.php.net/package/pcov>)<br>[source 2](<https://github.com/krakjoe/pcov>)<br>[source 3](<https://github.com/krakjoe/pcov/blob/develop/INSTALL.md>)|
|2026-10-21 13:41:09 +0200|PeachPie / iolevel|PeachPie PHP compiler and .NET runtime||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>PeachPie compiles PHP programs to assemblies using its reimplemented .NET runtime.|[source 1](<https://docs.peachpie.io/about/>)<br>[source 2](<https://www.peachpie.io/blog/2024/08/22/peachpie-1110/>)|
|2026-10-21 13:41:09 +0200|PeachPie / WpDotNet project|WpDotNet compiled WordPress on PeachPie||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The release announcement describes WpDotNet executing compiled WordPress without a php executable.|[source](<https://www.peachpie.io/blog/2024/08/22/peachpie-1110/>)|
|2026-10-21 13:41:09 +0200|PEAR project / PHP Group|PEAR Base System||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The official PEAR package page identifies the installer/base PHP error-handling classes and published version/runtime dependencies.|[source 1](<https://pear.php.net/package/PEAR>)<br>[source 2](<https://github.com/pear/pear-core>)<br>[source 3](<https://pecl.php.net/>)|
|2026-10-21 13:41:09 +0200|PECL XHProf / longxinH and contributors|XHProf native PHP collection extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release page separates a C data-collection extension from an all-PHP reporting layer.|[source](<https://pecl.php.net/package/xhprof/2.3.10>)|
|2026-10-21 13:41:09 +0200|PECL XHProf / longxinH and contributors|XHProf PHP reporting and navigation UI||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The publisher explicitly states that XHProf reporting/UI is PHP, distinct from the native collector.|[source](<https://pecl.php.net/package/xhprof/2.3.10>)|
|2026-10-21 13:41:09 +0200|PestPHP / Nuno Maduro and contributors|Pest PHP testing framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for pestphp/pest v5.3.2 declares PHP ^8.4 for this tool/library.|[source 1](<https://packagist.org/packages/pestphp/pest>)<br>[source 2](<https://pestphp.com/docs/installation>)|
|2026-10-21 13:41:09 +0200|Phalcon project|Phalcon framework PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official installation guides describe Phalcon as a compiled PHP extension, with distinct web/CLI loading and feature-specific companion modules.|[source 1](<https://docs.phalcon.io/5.23/installation/>)<br>[source 2](<https://docs.phalcon.io/5.9/installation/>)<br>[source 3](<https://pecl.php.net/>)|
|2026-10-21 13:41:09 +0200|PHAR.io / Arne Blankerts, Sebastian Heuer and contributors|Phive PHAR installation and verification tool||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phar-io/phive 0.16.0 declares PHP ^8.0 for this tool/library.|[source](<https://packagist.org/packages/phar-io/phive>)|
|2026-10-21 13:41:09 +0200|Phillips Data / Blesta|Blesta billing platform||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Versioned vendor requirements explicitly identify PHP, encoded-code loader and native extensions for the billing platform.|[source](<https://docs.blesta.com/installation/>)|
|2026-10-21 13:41:09 +0200|Phing project / Michiel Rook and contributors|Phing PHP build system||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phing/phing 3.1.2 declares PHP >=8.1 for this tool/library.|[source](<https://packagist.org/packages/phing/phing>)|
|2026-10-21 13:41:09 +0200|PHP CS Fixer project|PHP CS Fixer||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The selected fixer release declares PHP and direct modules; official docs distinguish Composer/shim, PHAR and image use.|[source 1](<https://packagist.org/packages/friendsofphp/php-cs-fixer>)<br>[source 2](<https://cs.symfony.com/doc/installation.html>)|
|2026-10-21 13:41:09 +0200|PHP CS Fixer project|PHP CS Fixer official PHP container image family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The installation guide documents PHP-version-qualified fixer images for local, GitHub and GitLab CI use.|[source](<https://cs.symfony.com/doc/installation.html>)|
|2026-10-21 13:41:09 +0200|PHP Depend project|PHP Depend source-metrics analyzer||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for pdepend/pdepend 3.0.0 declares PHP >=8.1 with php-64bit capability for this tool/library.|[source](<https://packagist.org/packages/pdepend/pdepend>)|
|2026-10-21 13:41:09 +0200|PHP Ev extension project|Ev native PHP libev binding||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release exposes libev event-loop functionality to PHP and declares a PHP minimum.|[source 1](<https://pecl.php.net/package/ev/1.2.3>)<br>[source 2](<https://pecl.php.net/package/ev>)|
|2026-10-21 13:41:09 +0200|PHP Event extension project|Event native PHP libevent binding||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release exposes native libevent scheduling APIs. The PHP manual makes OpenSSL conditional on OpenSSL features.|[source 1](<https://pecl.php.net/package/event/3.1.6>)<br>[source 2](<https://pecl.php.net/package/event>)<br>[source 3](<https://www.php.net/manual/en/event.requirements.php>)|
|2026-10-21 13:41:09 +0200|PHP Gearman extension project|Gearman native PHP client and worker extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Selected 2.2.1 exposes libgearman clients/workers and declares PHP 7.2.0 through 8.6.99.|[source 1](<https://pecl.php.net/package/gearman/2.2.1>)<br>[source 2](<https://www.php.net/manual/en/gearman.requirements.php>)|
|2026-10-21 13:41:09 +0200|PHP gnupg extension project|GnuPG native PHP GPGME binding||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Selected release identifies a GPGME binding and fixes PHP 8.5 and GPGME 2.0 build compatibility.|[source 1](<https://pecl.php.net/package/gnupg/1.5.4>)<br>[source 2](<https://www.php.net/manual/en/gnupg.requirements.php>)<br>[source 3](<https://www.gnupg.org/software/gpgme/index.html>)|
|2026-10-21 13:41:09 +0200|PHP Mailparse extension project|Mailparse native PHP MIME parser extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release parses RFC822/MIME messages and still lists mbstring. The official installation manual requires mbstring to load first.|[source 1](<https://pecl.php.net/package/mailparse/3.2.0>)<br>[source 2](<https://pecl.php.net/package/mailparse>)<br>[source 3](<https://www.php.net/manual/en/mailparse.installation.php>)|
|2026-10-21 13:41:09 +0200|PHP OAuth extension project|OAuth native PHP consumer extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release identifies an OAuth consumer extension and requires hash, now part of PHP core.|[source 1](<https://pecl.php.net/package/oauth/2.0.10>)<br>[source 2](<https://pecl.php.net/package/oauth>)|
|2026-10-21 13:41:09 +0200|PHP SSH2 extension project|SSH2 native PHP client binding||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release provides PHP bindings to libssh2 for SSH2 and declares a PHP minimum.|[source 1](<https://pecl.php.net/package/ssh2/1.5.0>)<br>[source 2](<https://pecl.php.net/package/ssh2>)|
|2026-10-21 13:41:09 +0200|PHP YAML extension project|YAML native PHP parser and emitter extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release provides YAML 1.1 parsing/emission using LibYAML. The catalogue names date but does not render required/optional classification.|[source 1](<https://pecl.php.net/package/yaml/2.3.0>)<br>[source 2](<https://pecl.php.net/package/yaml>)<br>[source 3](<https://packagist.org/packages/pecl/yaml>)|
|2026-10-21 13:41:09 +0200|php-amqp project|AMQP native PHP messaging client extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release provides AMQP 0-9-1 client APIs. The official project documents native librabbitmq requirements separately from the test broker.|[source 1](<https://pecl.php.net/package/amqp/2.2.0>)<br>[source 2](<https://pecl.php.net/package/amqp>)<br>[source 3](<https://github.com/php-amqp/php-amqp>)|
|2026-10-21 13:41:09 +0200|PHP-FIG|PSR logging interfaces package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The package distributes PHP interfaces/classes/traits for PSR-3 and explicitly does not provide a logger implementation.|[source](<https://packagist.org/packages/psr/log>)|
|2026-10-21 13:41:09 +0200|php-memcached project|Memcached native PHP client extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PECL identifies the libmemcached-based PHP client. The official 3.x README explicitly makes igbinary/msgpack serializer support optional, despite the flat PECL dependency list.|[source 1](<https://pecl.php.net/package/memcached/3.4.0>)<br>[source 2](<https://pecl.php.net/package/memcached>)<br>[source 3](<https://github.com/php-memcached-dev/php-memcached>)|
|2026-10-21 13:41:09 +0200|PHP-PM project|PHP-PM process manager||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release declares PHP and pcntl and describes retaining application bootstraps in worker processes.|[source](<https://packagist.org/packages/php-pm/php-pm>)|
|2026-10-21 13:41:09 +0200|php-rdkafka project|rdkafka native PHP Kafka client extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected stable release is a librdkafka-based PHP client. The catalogue separately lists 7.0.0alpha1 with a higher PHP minimum.|[source 1](<https://pecl.php.net/package/rdkafka/6.0.5>)<br>[source 2](<https://pecl.php.net/package/rdkafka>)|
|2026-10-21 13:41:09 +0200|Phpactor project|Phpactor PHP language server and refactoring tool||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Phpactor's manifest requires PHP ^8.2, mbstring, posix and tokenizer. Its README describes language-server/refactoring functionality and Linux/macOS or WSL.|[source](<https://packagist.org/packages/phpactor/phpactor>)|
|2026-10-21 13:41:09 +0200|phpBB Limited / phpBB project|phpBB||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher package declares PHP and direct extensions for its displayed 4.0 alpha release, with separate runtime and development dependencies.|[source](<https://packagist.org/packages/phpbb/phpbb>)|
|2026-10-21 13:41:09 +0200|PHPBench / Daniel Leech and contributors|PHPBench benchmarking framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpbench/phpbench 1.7.0 declares PHP ^8.2 for this tool/library.|[source](<https://packagist.org/packages/phpbench/phpbench>)|
|2026-10-21 13:41:09 +0200|PHPCSStandards / PHP_CodeSniffer project|PHP_CodeSniffer and PHP Code Beautifier/Fixer||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for squizlabs/php_codesniffer 4.0.4 declares PHP >=7.2.0 for this tool/library.|[source 1](<https://packagist.org/packages/squizlabs/php_codesniffer>)<br>[source 2](<https://packagist.org/packages/phpcsstandards/php_codesniffer>)|
|2026-10-21 13:41:09 +0200|phpDocumentor project|phpDocumentor documentation generator||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpdocumentor/phpdocumentor v3.10.0 declares PHP ^8.1 for this tool/library.|[source](<https://packagist.org/packages/phpdocumentor/phpdocumentor>)|
|2026-10-21 13:41:09 +0200|phpIPAM project|phpIPAM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project supplies branch-specific PHP ranges and separately documents PHP modules and optional CLI functions.|[source 1](<https://github.com/phpipam/phpipam>)<br>[source 2](<https://phpipam.net/documents/installation/>)|
|2026-10-21 13:41:09 +0200|phpLDAPadmin / leenooks project|phpLDAPadmin||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The current source manifest explicitly requires PHP and LDAP-related extensions for the directory administration web application.|[source 1](<https://github.com/leenooks/phpLDAPadmin/blob/master/composer.json>)<br>[source 2](<https://github.com/leenooks/phpLDAPadmin>)|
|2026-10-21 13:41:09 +0200|phpList project|phpList||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official requirements explicitly identify PHP and warn that some functionality/modules and plugin requirements are conditional.|[source](<https://resources.phplist.com/system/start>)|
|2026-10-21 13:41:09 +0200|PHPMailer project|PHPMailer||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PHP mail creation/transport class declares three direct extension requirements and feature-specific mail/encoding integrations.|[source](<https://packagist.org/packages/phpmailer/phpmailer>)|
|2026-10-21 13:41:09 +0200|PHPMD project|PHPMD PHP Mess Detector||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpmd/phpmd 3.0.0 declares PHP ^8.1 for this tool/library.|[source](<https://packagist.org/packages/phpmd/phpmd>)|
|2026-10-21 13:41:09 +0200|phpMyAdmin project|phpMyAdmin||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Registry metadata provides a release-specific PHP/module subset while the development manual separates optional archive/media/authentication features.|[source 1](<https://docs.phpmyadmin.net/en/latest/require.html>)<br>[source 2](<https://packagist.org/packages/phpmyadmin/phpmyadmin>)|
|2026-10-21 13:41:09 +0200|phpPgAdmin project|phpPgAdmin||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official application manifest explicitly declares PHP and the PostgreSQL PHP extension.|[source](<https://github.com/phppgadmin/phppgadmin/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|PhpRedis project / Michael Grunder and contributors|PhpRedis native PHP client extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The develop build declarations make native compression conditional. The installation guide distinguishes optional serializer builds from the feature-limited initial Windows PIE binaries.|[source 1](<https://pecl.php.net/package/redis/6.3.0>)<br>[source 2](<https://github.com/phpredis/phpredis/blob/develop/INSTALL.md>)<br>[source 3](<https://github.com/phpredis/phpredis/blob/develop/config.m4>)|
|2026-10-21 13:41:09 +0200|PHPro / GrumPHP contributors|GrumPHP Git quality-check orchestration||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpro/grumphp v2.26.0 declares PHP ~8.2.0 \|\| ~8.3.0 \|\| ~8.4.0 \|\| ~8.5.0 for this tool/library.|[source](<https://packagist.org/packages/phpro/grumphp>)|
|2026-10-21 13:41:09 +0200|phpseclib project|phpseclib||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The library implements cryptography and secure communications in PHP; native crypto acceleration and XML-key features are optional.|[source](<https://packagist.org/packages/phpseclib/phpseclib>)|
|2026-10-21 13:41:09 +0200|PhpSpec project|PhpSpec specification test runner||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpspec/phpspec 9.0.0-rc.4.4 declares PHP 8.3.* \|\| 8.4.* \|\| 8.5.* \|\| 8.6.* for this tool/library.|[source](<https://packagist.org/packages/phpspec/phpspec>)|
|2026-10-21 13:41:09 +0200|PHPStan / Ondrej Mirtes and contributors|PHPStan static analyzer||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpstan/phpstan 2.3.1 declares PHP ^7.4\|^8.0 for this tool/library.|[source 1](<https://packagist.org/packages/phpstan/phpstan>)<br>[source 2](<https://phpstan.org/user-guide/getting-started>)|
|2026-10-21 13:41:09 +0200|PHPStan project|PHPStan PHPDoc parser library||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpstan/phpdoc-parser 2.3.6 declares PHP ^7.4 \|\| ^8.0 for this tool/library.|[source](<https://packagist.org/packages/phpstan/phpdoc-parser>)|
|2026-10-21 13:41:09 +0200|PHPUnit project|PHPUnit test framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>PHPUnit is a PHP CLI test runner; release-specific metadata refines broad manual requirements.|[source 1](<https://packagist.org/packages/phpunit/phpunit>)<br>[source 2](<https://docs.phpunit.de/en/12.5/installation.html>)<br>[source 3](<https://docs.phpunit.de/en/13.4/installation.html>)|
|2026-10-21 13:41:09 +0200|PHPUnit project / Sebastian Bergmann|PHPUnit PHP code-coverage library||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpunit/php-code-coverage 14.4.1 declares PHP >=8.4 for this tool/library.|[source](<https://packagist.org/packages/phpunit/php-code-coverage>)|
|2026-10-21 13:41:09 +0200|phpVirtualBox project|phpVirtualBox server-side administration application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project describes a PHP web administration interface for VirtualBox.|[source](<https://github.com/phpvirtualbox/phpvirtualbox>)|
|2026-10-21 13:41:09 +0200|Pi-hole project|Pi-hole v5 legacy PHP web interface||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>Pi-hole's version6 announcement explicitly removes the former lighttpd/PHP dependency.|[source](<https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/>)|
|2026-10-21 13:41:09 +0200|Pimcore project|Pimcore Platform||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Versioned platform requirements list PHP 8.5+ for 2026.2; the 2025.1 page specifies PHP 8.3/8.4.|[source 1](<https://docs.pimcore.com/platform/2026.2/Getting_Started/Installation/System_Requirements/>)<br>[source 2](<https://docs.pimcore.com/platform/2025.1/Pimcore/Installation_and_Upgrade/System_Requirements/>)|
|2026-10-21 13:41:09 +0200|PluXml project|PluXml 5.8 documented branch||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PluXml 5.8 installation guide requires a PHP interpreter and GD for images.|[source](<https://wiki.pluxml.org/docs/install/install.html>)|
|2026-10-21 13:41:09 +0200|PmWiki project|PmWiki||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project requires PHP on the web server and describes its PHP compatibility range.|[source](<https://www.pmwiki.org/wiki/PmWiki/Requirements>)|
|2026-10-21 13:41:09 +0200|PostfixAdmin project|PostfixAdmin||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project identifies a PHP-capable web application used to administer virtual users for a separate Postfix mail server.|[source](<https://github.com/postfixadmin/postfixadmin>)|
|2026-10-21 13:41:09 +0200|Predis project / Till Kruss and contributors|Predis PHP Redis and Valkey client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>Predis declares PHP compatibility and a PSR message interface; Relay is suggested as an optional faster connection implementation.|[source](<https://packagist.org/packages/predis/predis>)|
|2026-10-21 13:41:09 +0200|PrestaShop project|PrestaShop||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The version-9 requirements identify PHP, required modules and separate compatibility bands for 9.0 and 9.1.|[source](<https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/>)|
|2026-10-21 13:41:09 +0200|PrivateBin project|PrivateBin||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official manifest requires PHP; the project separately states that paste encryption/decryption occurs in the browser.|[source 1](<https://github.com/PrivateBin/PrivateBin/blob/master/composer.json>)<br>[source 2](<https://github.com/PrivateBin/PrivateBin>)|
|2026-10-21 13:41:09 +0200|ProcessWire project|ProcessWire CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official requirements list PHP 8.x as recommended, PHP 7.x compatibility, and image-processing support.|[source 1](<https://processwire.com/about/requirements/>)<br>[source 2](<https://processwire.com/docs/front-end/include/>)|
|2026-10-21 13:41:09 +0200|ProjectSend project|ProjectSend||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The current source installation guide lists PHP web/CLI requirements; LDAP is required even without configured LDAP use.|[source 1](<https://github.com/projectsend/projectsend/blob/main/INSTALL.md>)<br>[source 2](<https://docs.projectsend.org/about/installation/requirements>)|
|2026-10-21 13:41:09 +0200|Prophecy / PhpSpec project|Prophecy PHP mocking library||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for phpspec/prophecy v1.26.1 declares PHP 8.2.* \|\| 8.3.* \|\| 8.4.* \|\| 8.5.* for this tool/library.|[source](<https://packagist.org/packages/phpspec/prophecy>)|
|2026-10-21 13:41:09 +0200|Psalm project / Daniil Gentili|Psalm official custom-PHP container image||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Psalm's official installation guide describes an image containing a custom PHP build and its analyzer.|[source](<https://psalm.dev/docs/running_psalm/installation/>)|
|2026-10-21 13:41:09 +0200|Psalm project / Matthew Brown, Daniil Gentili and contributors|Psalm PHP static analyzer||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for vimeo/psalm 7.0.0-rc2 declares PHP ~8.1.31 \|\| ~8.2.27 \|\| ~8.3.16 \|\| ~8.4.3 \|\| ~8.5.0 for this tool/library.|[source 1](<https://packagist.org/packages/vimeo/psalm>)<br>[source 2](<https://psalm.dev/docs/running_psalm/installation/>)|
|2026-10-21 13:41:09 +0200|PsySH / Justin Hileman and contributors|PsySH interactive PHP shell||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for psy/psysh v0.12.24 declares PHP ^8.0 \|\| ^7.4 for this tool/library.|[source](<https://packagist.org/packages/psy/psysh>)|
|2026-10-21 13:41:09 +0200|Pterodactyl project|Pterodactyl Panel PHP application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Panel manifest declares PHP, Laravel and required PHP extensions for the management application.|[source 1](<https://github.com/pterodactyl/panel/blob/1.0-develop/composer.json>)<br>[source 2](<https://github.com/pterodactyl/wings/blob/develop/go.mod>)|
|2026-10-21 13:41:09 +0200|Public Knowledge Project (PKP)|Open Journal Systems||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official OJS README requires PHP and supplies a platform-check example while warning that its sample version numbers are not minimum versions.|[source](<https://github.com/pkp/ojs/blob/main/README.md>)|
|2026-10-21 13:41:09 +0200|Public Knowledge Project (PKP)|Open Monograph Press||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official OMP README requires PHP and distinguishes PHP platform requirements from illustrative module version numbers.|[source](<https://github.com/pkp/omp>)|
|2026-10-21 13:41:09 +0200|Public Knowledge Project (PKP)|Open Preprint Systems||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official OPS README requires PHP for the preprint server and identifies web-versus-CLI configuration differences.|[source](<https://github.com/pkp/ops>)|
|2026-10-21 13:41:09 +0200|Pydio|Pydio 8 Enterprise Distribution||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The vendor's legacy Enterprise guide explicitly requires PHP, modules and ionCube, and recommends a PHP CLI path.|[source 1](<https://docs.pydio.com/pydio-v8/admin-guide/installation-guide/pydio-requirements/>)<br>[source 2](<https://github.com/pydio/cells>)|
|2026-10-21 13:41:09 +0200|QNAP|QNAP PHP7.4 optional application before5.2 migration||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>QNAP documents a separate PHP7.4 application and its firmware-transition disablement.|[source](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)|
|2026-10-21 13:41:09 +0200|QNAP|QNAP QTS built-in PHP runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Prior built-in firmware mappings are retained. A separate QNAP FAQ documents retirement/disablement of the optional PHP7.4 application after5.1.x->5.2.0; this is not a replacement built-in PHP version table.|[source 1](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)<br>[source 2](<https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero>)|
|2026-10-21 13:41:09 +0200|QNAP|QNAP QuTS hero built-in PHP runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Prior built-in firmware mappings are retained. A separate QNAP FAQ documents retirement/disablement of the optional PHP7.4 application after5.1.x->5.2.0; this is not a replacement built-in PHP version table.|[source 1](<https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520>)<br>[source 2](<https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero>)|
|2026-10-21 13:41:09 +0200|RainLoop Team|RainLoop Webmail||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The vendor requirements explicitly specify PHP and distinguish optional contact-database support from the mail UI.|[source 1](<https://www.rainloop.net/docs/system-requirements/>)<br>[source 2](<https://github.com/RainLoop/rainloop-webmail>)|
|2026-10-21 13:41:09 +0200|RaspAP project|RaspAP PHP network-management web GUI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>RaspAP's manual installation configures a PHP-CGI web management interface.|[source](<https://docs.raspap.com/get-started/manual/>)|
|2026-10-21 13:41:09 +0200|ReactPHP project|ReactPHP EventLoop||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>ReactPHP provides a PHP event loop with a stream_select default that works without installing a separate event-loop extension.|[source](<https://packagist.org/packages/react/event-loop>)|
|2026-10-21 13:41:09 +0200|Rector project|Rector automated PHP refactoring tool||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for rector/rector 2.7.0 declares PHP ^7.4\|^8.0 for this tool/library.|[source](<https://packagist.org/packages/rector/rector>)|
|2026-10-21 13:41:09 +0200|Red Hat|Red Hat Enterprise Linux 9 PHP RPM/AppStreams||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The guide distinguishes common/minimal/devel profiles. Red Hat lifecycle policy separately lists PHP 8.2 and 8.3 ending May 2029.|[source 1](<https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages>)<br>[source 2](<https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle>)|
|2026-10-21 13:41:09 +0200|Render; customer/base-image publisher|Render customer PHP Docker hosting||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Render's PHP deployment guide uses Docker and nginx/php-fpm for a Laravel application.|[source 1](<https://render.com/docs/deploy-php-laravel-docker>)<br>[source 2](<https://render.com/docs/docker>)|
|2026-10-21 13:41:09 +0200|RoadRunner PHP community|RoadRunner common PHP worker package||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The common worker declares PHP and extension requirements; the old Composer name is replaced.|[source 1](<https://packagist.org/packages/roadrunner/worker>)<br>[source 2](<https://packagist.org/packages/spiral/roadrunner-worker>)|
|2026-10-21 13:41:09 +0200|RoadRunner project|RoadRunner configured PHP worker-pool integration||Investigation|Investigation|CVE assessment: Optional PHP path; CVE match unknown<br>The documented pool starts PHP CLI processes and applies only to six named plugin paths.|[source](<https://docs.roadrunner.dev/docs/php-worker/pool>)|
|2026-10-21 13:41:09 +0200|Roave|Roave backward-compatibility checker||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for roave/backward-compatibility-check 8.23.0 declares PHP ~8.4.0 \|\| ~8.5.0 for this tool/library.|[source](<https://packagist.org/packages/roave/backward-compatibility-check>)|
|2026-10-21 13:41:09 +0200|Roundcube project|Roundcube Webmail||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official project identifies a PHP/JavaScript webmail server with an internal IMAP library; registry supplies a named release and bounded PHP range.|[source 1](<https://github.com/roundcube/roundcubemail>)<br>[source 2](<https://packagist.org/packages/roundcube/roundcubemail>)<br>[source 3](<https://github.com/roundcube/roundcubemail/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|Roundcube project|Roundcube Webmail Docker image family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Roundcube documents three image variants based on official PHP images, plus separate nonroot configuration restrictions.|[source](<https://github.com/roundcube/roundcubemail-docker>)|
|2026-10-21 13:41:09 +0200|SalesAgility / SuiteCRM project|SuiteCRM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Version-specific SuiteCRM 7 and 8 compatibility tables explicitly identify the PHP server runtime.|[source 1](<https://docs.suitecrm.com/8.x/admin/compatibility-matrix/>)<br>[source 2](<https://docs.suitecrm.com/admin/compatibility-matrix/>)|
|2026-10-21 13:41:09 +0200|Sangoma|PBXact 17 PHP management edition||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Sangoma describes PBXact17 as its commercial FreePBX-based system with PHP8.2.|[source](<https://www.freepbx.org/pbxact-17-general-availability-announcement/>)|
|2026-10-21 13:41:09 +0200|Sangoma / FreePBX project|FreePBX 17 management framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>FreePBX17 documents PHP8.2 as its supported tested platform, distinct from its installer minimum guard.|[source 1](<https://sangomakb.atlassian.net/wiki/spaces/FP/pages/279052296>)<br>[source 2](<https://github.com/FreePBX/framework/blob/release/17.0/install.php>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|php-cgi-wasm package (Sean Morris)||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The publisher lists php-cgi-wasm as a separate package.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|php-cli-wasm package (Sean Morris)||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The publisher lists php-cli-wasm as a separate package.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|php-cloud-wasm package (Sean Morris)||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The publisher lists php-cloud-wasm as a separate package.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|php-dbg-wasm package (Sean Morris)||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The publisher lists php-dbg-wasm as a separate package.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|php-sdl-wasm package (Sean Morris)||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The publisher lists php-sdl-wasm as a separate package.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|php-wasm-builder package (Sean Morris)||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The publisher lists php-wasm-builder as a separate package.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Sean Morris / php-wasm project|Sean Morris php-wasm runtime package||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The project documents embedded PHP WebAssembly packages.|[source](<https://github.com/seanmorris/php-wasm>)|
|2026-10-21 13:41:09 +0200|Semantic MediaWiki project|Semantic MediaWiki||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher manifest declares PHP and mbstring and explicitly requires MediaWiki and its dependencies.|[source](<https://packagist.org/packages/mediawiki/semantic-media-wiki>)|
|2026-10-21 13:41:09 +0200|Sendy|Sendy self-hosted application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor describes Sendy as a PHP-hosted application and separately identifies Amazon SES for sending mail.|[source 1](<https://sendy.co/>)<br>[source 2](<https://sendy.co/get-started>)|
|2026-10-21 13:41:09 +0200|Serendipity project|Serendipity Blog System||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project calls Serendipity a PHP web application and specifies PHP 7.3+, cookie/session support and extensions.|[source](<https://docs.s9y.org/docs/users/getting-started/fresh-installation.html>)|
|2026-10-21 13:41:09 +0200|Shaarli community|Shaarli||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official manifest declares PHP and runtime modules and separately suggests modules for thumbnails, fetching, translation and Unicode support.|[source](<https://github.com/shaarli/Shaarli/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|Shivam Mathur / setup-php project|setup-php GitHub Action external PHP provisioning||Investigation|Investigation|CVE assessment: Optional PHP path; CVE match unknown<br>The action descriptor runs dist/index.js with node24 and takes inputs for PHP version, extensions, tools and php.ini values.|[source](<https://github.com/shivammathur/setup-php/blob/main/action.yml>)|
|2026-10-21 13:41:09 +0200|Shlink project|Shlink||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official package metadata identifies a PHP URL-shortening application with CLI/REST interfaces and direct runtime modules.|[source 1](<https://packagist.org/packages/shlinkio/shlink>)<br>[source 2](<https://github.com/shlinkio/shlink>)|
|2026-10-21 13:41:09 +0200|Shopify|Shopify API Library for PHP deprecated line||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>Published metadata identifies the PHP client and its extension subset. The README marks it deprecated and directs users to shopify/shopify-app-php.|[source](<https://packagist.org/packages/shopify/shopify-api>)|
|2026-10-21 13:41:09 +0200|Shopify|Shopify App PHP package||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The app package declares PHP >=8.2 with Firebase JWT and Guzzle dependencies for PHP Shopify app integration.|[source](<https://packagist.org/packages/shopify/shopify-app-php>)|
|2026-10-21 13:41:09 +0200|Shopware 5 project / shopware AG lineage|Shopware 5||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The v5.7.20 package declares PHP and its extension requirements. The project README says active maintenance is no longer guaranteed.|[source](<https://packagist.org/packages/shopware/shopware>)|
|2026-10-21 13:41:09 +0200|shopware AG|Shopware 6||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official 6.7 update guide requires PHP 8.2/8.3/8.4 and separately describes the Vue/Vite administration frontend.|[source 1](<https://docs.shopware.com/en/shopware-6-en/update-guides/update-guide-shopware-67>)<br>[source 2](<https://developer.shopware.com/docs/v6.6/guides/installation/requirements.html>)|
|2026-10-21 13:41:09 +0200|Silverstripe CMS project|Silverstripe CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 6.x manual requires a PHP web server, PHP 8.3-8.5 and specific extensions.|[source](<https://docs.silverstripe.org/en/6/getting_started/server_requirements/>)|
|2026-10-21 13:41:09 +0200|Simple Machines / SMF project|Simple Machines Forum||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official application manifest declares a PHP runtime constraint separately from PHP-CS-Fixer and PHPUnit development dependencies.|[source](<https://github.com/SimpleMachines/SMF/blob/release-3.0/composer.json>)|
|2026-10-21 13:41:09 +0200|SimpleRisk|SimpleRisk PHP GRC application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SimpleRisk publishes PHP version and extension requirements plus supported Apache/nginx execution modes.|[source](<https://support.simplerisk.com/kb/01-01-system-requirements>)|
|2026-10-21 13:41:09 +0200|SimpleSAMLphp project|SimpleSAMLphp||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SimpleSAMLphp is a PHP SAML service-provider/identity-provider application with explicit PHP and extension requirements.|[source](<https://packagist.org/packages/simplesamlphp/simplesamlphp>)|
|2026-10-21 13:41:09 +0200|Slim project|Slim framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Slim is a PHP HTTP microframework; its package requires a separately chosen PSR-7 implementation and identifies XML parser modules as optional.|[source](<https://packagist.org/packages/slim/slim>)|
|2026-10-21 13:41:09 +0200|SnappyMail project|SnappyMail||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project documents PHP for its server-side webmail implementation and identifies its RainLoop lineage.|[source](<https://github.com/the-djmaze/snappymail>)|
|2026-10-21 13:41:09 +0200|SolidWorx / SolidInvoice project|SolidInvoice application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official runtime manifest requires PHP and native extensions; source and binary installation methods have different packaging boundaries.|[source 1](<https://github.com/SolidInvoice/SolidInvoice/blob/3.2.x/composer.json>)<br>[source 2](<https://github.com/SolidInvoice/SolidInvoice>)|
|2026-10-21 13:41:09 +0200|SolidWorx / SolidInvoice project|SolidInvoice self-contained binary||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor explicitly documents a bundled PHP runtime and FrankenPHP worker controls; no separately installed host PHP is required.|[source](<https://solidinvoice.co/docs/installation-guide/quick-install/>)|
|2026-10-21 13:41:09 +0200|SPIP project|SPIP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official configuration table gives PHP compatibility and extension requirements separately for SPIP 4.4, 4.3 and 4.2.|[source](<https://www.spip.net/en_article6659.html>)|
|2026-10-21 13:41:09 +0200|Spryker Systems GmbH|Spryker Commerce OS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor documents PHP-backed commerce and marketplace applications; its upgrade guide distinguishes the 8.3 floor from the 8.5 recommendation.|[source 1](<https://docs.spryker.com/docs/dg/dev/system-requirements/latest/system-requirements.html>)<br>[source 2](<https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/upgrade-to-php-85>)|
|2026-10-21 13:41:09 +0200|SquirrelMail project|SquirrelMail legacy documented webmail||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The old official installation manual explicitly requires a PHP-capable web server for the webmail application.|[source](<https://www.squirrelmail.org/docs/admin/admin-3.html>)|
|2026-10-21 13:41:09 +0200|Statamic project|Statamic CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Statamic describes itself as a PHP application installed as a Laravel package and lists PHP 8.3+ requirements.|[source](<https://statamic.dev/getting-started/requirements>)|
|2026-10-21 13:41:09 +0200|Statamic project|Statamic static-site generator||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The official guide installs statamic/ssg, invokes PHP/Artisan during the build and publishes storage/app/static.|[source](<https://statamic.dev/getting-started/deploying/netlify>)|
|2026-10-21 13:41:09 +0200|Stripe and contributors|Stripe PHP client library||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The displayed beta release requires PHP >=7.4.0 and curl, json and mbstring extensions in the PHP caller.|[source](<https://packagist.org/packages/stripe/stripe-php>)|
|2026-10-21 13:41:09 +0200|SugarAI / SugarCRM|Sugar application server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor's supported-platforms page explicitly lists PHP among application server requirements, separately from end-user browser requirements.|[source](<https://support.sugarai.com/resources/supported_platforms/>)|
|2026-10-21 13:41:09 +0200|Sulu project|Sulu CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Sulu 3.x requirements explicitly require PHP 8.2+ and DOM/XML extensions.|[source](<https://docs.sulu.io/3.x/reference/requirements.html>)|
|2026-10-21 13:41:09 +0200|SURF|SURF Research Access Management EngineBlock proxy||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SURF's architecture names EngineBlock as the SRAM proxy.|[source 1](<https://servicedesk.surf.nl/wiki/spaces/IAM/pages/74226103/Conceptual%2Boverview%2Bof%2BSURF%2BResearch%2BAccess%2BManagement>)<br>[source 2](<https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json>)<br>[source 3](<https://github.com/SURFscz/SBS>)|
|2026-10-21 13:41:09 +0200|SURF|SURF Research Drive Nextcloud server component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SURF's domain-vision PDF identifies Research Drive among Nextcloud-based services.|[source 1](<https://www.surf.nl/files/2026-04/surf-dienstdomeinvisies-slidedeck.pdf>)<br>[source 2](<https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html>)|
|2026-10-21 13:41:09 +0200|SURF|SURFconext OpenConext EngineBlock proxy role||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Project showcase and architecture connect SURFconext with OpenConext's EngineBlock proxy.|[source 1](<https://openconext.org/openconext-showcases/>)<br>[source 2](<https://openconext.org/openconext-building-blocks/>)<br>[source 3](<https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json>)|
|2026-10-21 13:41:09 +0200|SURF|SURFdrive Nextcloud server component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SURF states that SURFdrive is based on Nextcloud.|[source 1](<https://www.surf.nl/diensten/opslag-datamanagement/surfdrive>)<br>[source 2](<https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html>)|
|2026-10-21 13:41:09 +0200|SURF|SURFfilesender FileSender server component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SURF identifies FileSender as the origin of SURFfilesender.|[source 1](<https://www.surf.nl/diensten/opslag-datamanagement/surffilesender>)<br>[source 2](<https://docs.filesender.org/filesender/v3.0/install/>)|
|2026-10-21 13:41:09 +0200|SURF / SURFnet|SURFconext Service Provider Dashboard||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The registration/management application declares PHP ^8.2 in its root manifest.|[source 1](<https://github.com/SURFnet/sp-dashboard/blob/main/composer.json>)<br>[source 2](<https://github.com/SURFnet/sp-dashboard>)|
|2026-10-21 13:41:09 +0200|SUSE|SUSE Linux Enterprise PHP8 package families||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SUSE release notes establish PHP 8.2 availability; its published update lists versioned php8 runtime, FPM and extension packages.|[source 1](<https://documentation.suse.com/releasenotes/sles/15-SP6/index.html>)<br>[source 2](<https://www.suse.com/support/update/announcement/2026/suse-su-20264651-1/>)|
|2026-10-21 13:41:09 +0200|SUSE|SUSE SLE BCI PHP CLI container||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Vendor describes an interpreter-entrypoint image and a dated update notice identifies its release and bundled Composer change.|[source 1](<https://registry.suse.com/repositories/bci-php>)<br>[source 2](<https://lists.suse.com/pipermail/sle-container-updates/2026-September/012564.html>)|
|2026-10-21 13:41:09 +0200|SUSE|SUSE SLE BCI PHP-Apache container||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SUSE explicitly ships Apache and mod_php; dated image release26.6 includes a Composer package update.|[source 1](<https://registry.suse.com/repositories/bci-php-apache>)<br>[source 2](<https://lists.suse.com/pipermail/sle-container-updates/2026-September/012562.html>)|
|2026-10-21 13:41:09 +0200|SUSE|SUSE SLE BCI PHP-FPM 8 container||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Vendor catalogue confirms FPM/FastCGI and RPM-based extension installation. Dated image notice identifies a Composer package update within a PHP image.|[source 1](<https://registry.suse.com/repositories/bci-php-fpm>)<br>[source 2](<https://lists.suse.com/pipermail/sle-container-updates/2026-September/012563.html>)|
|2026-10-21 13:41:09 +0200|Swoole project|Swoole native PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release identifies an asynchronous PHP networking engine and explicit PHP-version bounds.|[source](<https://pecl.php.net/package/swoole/6.2.3>)|
|2026-10-21 13:41:09 +0200|Sylius project|Sylius||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official prerequisites require PHP 8.2+ and five named extensions for the Symfony-based commerce application.|[source](<https://docs.sylius.com/public/getting-started/before-you-begin>)|
|2026-10-21 13:41:09 +0200|Sylvain Lassaut / NoiseByNorthwest|SPX native PHP profiling extension and built-in report UI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The maintainer README describes a loaded PHP extension with HTTP profiling/UI and CLI modes; build configuration links native zlib.|[source 1](<https://github.com/NoiseByNorthwest/php-spx/blob/master/README.md>)<br>[source 2](<https://github.com/NoiseByNorthwest/php-spx/blob/master/config.m4>)|
|2026-10-21 13:41:09 +0200|Symfony|Symfony Console component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP command-line application framework is distributed as an independently installable PHP package.|[source](<https://packagist.org/packages/symfony/console>)|
|2026-10-21 13:41:09 +0200|Symfony|Symfony framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The current Symfony setup guide identifies PHP and six extensions; the official component catalogue and separate manifests distinguish reusable packages from the full framework.|[source 1](<https://symfony.com/doc/current/setup.html>)<br>[source 2](<https://symfony.com/components>)<br>[source 3](<https://packagist.org/packages/symfony/http-foundation>)|
|2026-10-21 13:41:09 +0200|Symfony|Symfony HttpFoundation component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP request, response, session and upload abstractions is distributed as an independently installable PHP package.|[source](<https://packagist.org/packages/symfony/http-foundation>)|
|2026-10-21 13:41:09 +0200|Symfony|Symfony HttpKernel component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP HTTP kernel and request/response conversion pipeline is distributed as an independently installable PHP package.|[source](<https://packagist.org/packages/symfony/http-kernel>)|
|2026-10-21 13:41:09 +0200|Symfony|Symfony mbstring polyfill||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PHP package provides the ext-mbstring Composer platform capability while implementing a fallback and directly requiring iconv.|[source](<https://packagist.org/packages/symfony/polyfill-mbstring>)|
|2026-10-21 13:41:09 +0200|Symfony|Symfony Process component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PHP API for invoking and managing system subprocesses is distributed as an independently installable PHP package.|[source](<https://packagist.org/packages/symfony/process>)|
|2026-10-21 13:41:09 +0200|Symplify|Easy Coding Standard PHP style tool||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for symplify/easy-coding-standard 13.3.7 declares PHP >=7.2 for this tool/library.|[source](<https://packagist.org/packages/symplify/easy-coding-standard>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 5.6 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP5.6/5.6.40-0131>)<br>[source 2](<https://archive.synology.com/download/Package/PHP5.6>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 7.0 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP7.0/7.0.33-0131>)<br>[source 2](<https://archive.synology.com/download/Package/PHP7.0>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 7.2 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP7.2/7.2.34-0131>)<br>[source 2](<https://archive.synology.com/download/Package/PHP7.2>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 7.3 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP7.3/7.3.33-0173>)<br>[source 2](<https://archive.synology.com/download/Package/PHP7.3>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 7.4 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP7.4/7.4.33-0140>)<br>[source 2](<https://archive.synology.com/download/Package/PHP7.4>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 8.0 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP8.0/8.0.30-0121>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.0>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 8.1 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP8.1/8.1.34-0110>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.1>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 8.2 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP8.2/8.2.30-0170>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.2>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 8.3 archived package family||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.|[source 1](<https://archive.synology.com/download/Package/PHP8.3/8.3.30-0050>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.3>)|
|2026-10-21 13:41:09 +0200|Synology|Synology PHP 8.4 package distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Fresh archive metadata confirms the existing8.4 package identity. It is one of ten PHP branch families, not PHP installed by default throughout DSM.|[source 1](<https://archive.synology.com/download/Package/PHP8.4/8.4.19-0050>)<br>[source 2](<https://archive.synology.com/download/Package/PHP8.4>)|
|2026-10-21 13:41:09 +0200|Synology|Synology Web Station optional PHP hosting||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Web Station supports separately installed PHP backends and PHP profiles for hosted sites.|[source](<https://www.synology.com/en-global/dsm/7.4/software_spec/web_station>)|
|2026-10-21 13:41:09 +0200|TeamPass project|TeamPass||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project identifies a PHP/MySQL credential vault, lists native modules and separates the server from a browser extension.|[source 1](<https://github.com/nilsteampassnet/TeamPass>)<br>[source 2](<https://github.com/nilsteampassnet/TeamPass/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|TerraMaster|TerraMaster TOS6 Web Server optional PHP hosting||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>The Web Server guide documents optional PHP instances, virtual-host version selection and configurable extensions.|[source](<https://help.terra-master.com/docs/TOS6/application/web-server>)|
|2026-10-21 13:41:09 +0200|Textpattern project|Textpattern CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Textpattern lists PHP, MySQL and required/optional PHP modules for its 4.9 line.|[source 1](<https://textpattern.com/about/system-requirements>)<br>[source 2](<https://textpattern.com/weblog/textpattern-490-released-php-85-mysql-84-features-fixes-fine-tuning-and-much-more>)|
|2026-10-21 13:41:09 +0200|The Cacti Group|Cacti||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The source manifest and README confirm PHP for the web application and built-in poller, with differing table/develop minima.|[source 1](<https://github.com/Cacti/cacti/blob/develop/composer.json>)<br>[source 2](<https://github.com/Cacti/cacti>)|
|2026-10-21 13:41:09 +0200|The PHP Foundation / PHP PIE project|PHP Installer for Extensions (PIE)||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The official README identifies a PHP-based extension installer, distinguishes its PHP execution version from the target, and points to the paginated Packagist extension catalogue.|[source 1](<https://github.com/php/pie>)<br>[source 2](<https://pecl.php.net/>)<br>[source 3](<https://packagist.org/extensions>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP BCMath||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>BCMath: Arbitrary precision arithmetic. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP built-in development web server||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official manual documents the CLI SAPI built-in HTTP server and says it is for controlled development/testing use. The server implementation is present in the pinned CLI source.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/php_cli_server.c>)<br>[source 2](<https://www.php.net/manual/en/features.commandline.webserver.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Bzip2||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Bzip2: Bzip2 streams, filters and compression. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Calendar||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Calendar: Calendar and date conversions. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Clang fuzzer SAPI||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>The released fuzzer manifest declares developer harnesses for PHP parser, execution, JIT, serialization and selected extensions.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fuzzer/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP CLI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The pinned PHP source declares the cli SAPI. Built by upstream default unless --disable-cli; jobs may also run in production.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/config.m4>)<br>[source 2](<https://docs.phpunit.de/en/12.5/installation.html>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP COM and .NET||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>COM and .NET: Windows COM automation and native interoperation. The released build manifest declares this PHP component.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/com_dotnet/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP core and Zend Engine||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Pinned source contains PHP lifecycle code in main/main.c and the Zend Engine in Zend/zend.c. Official support dates identify branches 8.2-8.5.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/Zend/zend.c>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/main/main.c>)<br>[source 3](<https://www.php.net/supported-versions.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Ctype||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Ctype: Character classification. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP cURL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>cURL: Outbound URL transfers via libcurl. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Date/Time||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Date/Time: Date parsing, time zones and timelib. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config0.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP DBA||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>DBA: Database-file handlers and local key-value storage. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP dl_test||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>dl_test: Dynamic-extension loading test fixture. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP DOM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>DOM: XML and HTML document manipulation. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Embed SAPI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The released embed build manifest creates a shared or static PHP library for use inside a host application.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/embed/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Enchant||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Enchant: Spell-checking provider bridge. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Exif||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Exif: Image metadata parsing. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP FFI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>FFI: Native C library and memory interface. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Fileinfo||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Fileinfo: File-type and MIME identification. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Filter||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Filter: Validation and sanitization of input values. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP FTP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>FTP: FTP client and optional TLS transfer. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP GD||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>GD: Image decode, transform and encode. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Gettext||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Gettext: Translation catalogues and locale messages. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP GMP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>GMP: Multiple-precision arithmetic bridge. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Hash||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Hash: Hashing and compatibility mhash APIs. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Iconv||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Iconv: Character-set conversions. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP IMAP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Selected release notes build fixes for PHP 8.4; package minimum is 8.3.0.|[source 1](<https://pecl.php.net/package/imap/1.0.3>)<br>[source 2](<https://www.php.net/manual/en/migration84.removed-extensions.php>)<br>[source 3](<https://www.php.net/manual/en/imap.installation.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Intl||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Intl: ICU-backed internationalization. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP JSON||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>JSON: JSON parsing and serialization. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP LDAP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>LDAP: LDAP directory client. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Lexbor support bridge||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Lexbor support bridge: Internal PHP glue for HTML and URL parsing. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.w32>)<br>[source 3](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/php_lexbor.c>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Libxml bridge||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Libxml bridge: PHP integration with libxml-based parsers. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config0.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP LiteSpeed SAPI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The released source contains an LSAPI SAPI, and the PHP manual identifies LiteSpeed integration as bundled PHP.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/litespeed/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Mbstring||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Mbstring: Multibyte conversion and optional regex. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP MySQLi||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>MySQLi: MySQL client API through mysqlnd. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Mysqlnd||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Mysqlnd: PHP-native MySQL protocol client. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config9.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP OCI8 extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Release states testing with PHP 8.2-8.5 and requires Oracle Client 11.2+.|[source 1](<https://pecl.php.net/package/oci8/3.4.1>)<br>[source 2](<https://www.php.net/manual/en/migration84.removed-extensions.php>)<br>[source 3](<https://www.php.net/manual/en/oci8.installation.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP ODBC||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>ODBC: ODBC database client. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP OPcache||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>OPcache: Bytecode caching and optimization. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.w32>)<br>[source 3](<https://www.php.net/manual/en/migration85.incompatible.php#migration85.incompatible.opcache>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP OPcache JIT||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The pinned OPcache manifest has a separate JIT build switch and compiles JIT sources conditionally. The runtime manual exposes opcache.jit controls.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4>)<br>[source 2](<https://www.php.net/manual/en/opcache.configuration.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP OpenSSL extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>OpenSSL extension: Cryptography and TLS stream integration. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config0.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PCNTL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PCNTL: Process control for CLI and CGI jobs. The released build manifest declares this PHP component.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcntl/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PCRE||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PCRE: Regular expressions and PCRE2 integration. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config0.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO: Database API and driver abstraction. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_DBLIB||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO_DBLIB: FreeTDS/DB-Library database client for PDO. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_FIREBIRD||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO_FIREBIRD: Firebird client for PDO. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_MYSQL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO_MYSQL: MySQL client for PDO. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_OCI extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The selected release uses PDO APIs and Oracle Client 11.2+ libraries.|[source 1](<https://pecl.php.net/package/PDO_OCI/1.2.0>)<br>[source 2](<https://www.php.net/manual/en/migration84.removed-extensions.php>)<br>[source 3](<https://pecl.php.net/package/PDO_OCI>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_ODBC||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO_ODBC: ODBC client for PDO. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_PGSQL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO_PGSQL: PostgreSQL client for PDO. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PDO_SQLITE||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PDO_SQLITE: SQLite-backed database operations for PDO. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Phar||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Phar: Executable and data archive handling. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP phpdbg||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The released phpdbg manifest declares a debugger SAPI; the manual documents PHP debugging and optional remote-console controls.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/phpdbg/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP POSIX||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>POSIX: POSIX identity, process and resource APIs. The released build manifest declares this PHP component.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/posix/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP PostgreSQL extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>PostgreSQL extension: PostgreSQL client API. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Pspell extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Selected PECL release minimum is separate from the PHP 8.4 packaging transition.|[source 1](<https://pecl.php.net/package/pspell/1.0.1>)<br>[source 2](<https://www.php.net/manual/en/migration84.removed-extensions.php>)<br>[source 3](<https://www.php.net/manual/en/pspell.installation.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Random||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Random: Random-number generation APIs. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Readline||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Readline: Interactive command-line input. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Reflection||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Reflection: Runtime type and symbol inspection. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Session||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Session: Session identifiers, serialization and storage handlers. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Shmop||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Shmop: Shared-memory segment access. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP SimpleXML||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SimpleXML: XML document access. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP SNMP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SNMP: Network-management protocol client. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP SOAP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SOAP: SOAP client/server and XML message processing. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Sockets||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Sockets: Low-level socket API. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Sodium||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Sodium: Libsodium cryptography APIs. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP SPL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SPL: Standard PHP Library objects and iterators. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP SQLite3||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>SQLite3: SQLite database access. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config0.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Standard functions||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Standard functions: Core strings, files, streams, URLs and serialization functions. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Sysvmsg||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Sysvmsg: System V message queues. The released build manifest declares this PHP component.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvmsg/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Sysvsem||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Sysvsem: System V semaphores. The released build manifest declares this PHP component.|[source](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvsem/config.m4>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Sysvshm||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Sysvshm: System V shared memory. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Tidy||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Tidy: HTML repair and parsing bridge. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Tokenizer||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Tokenizer: PHP source tokenization. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP URI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>URI: RFC 3986 and WHATWG URL parsing. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.w32>)<br>[source 3](<https://www.php.net/releases/8.5/en.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP XML parser||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>XML parser: Event-based XML parsing. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP XMLReader||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>XMLReader: Streaming XML reader. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP XMLWriter||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>XMLWriter: XML output generation. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP XSL||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>XSL: XML stylesheet transformation. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP zend_test||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>zend_test: Zend Engine test hooks and fixtures. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Zip||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Zip: Zip archive parsing and creation. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP Zlib extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Zlib extension: Compressed streams and filters. The released build manifest declares this PHP component.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config0.m4>)<br>[source 2](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config.w32>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP-CGI||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The pinned PHP source declares the cgi SAPI. Built by upstream default unless --disable-cgi; downstream packaging may differ.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cgi/config9.m4>)<br>[source 2](<https://www.php.net/manual/en/install.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group|PHP-FPM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The pinned PHP source declares the fpm SAPI. Optional --enable-fpm; not evidence of FPM in every PHP build.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fpm/config.m4>)<br>[source 2](<https://www.php.net/manual/en/book.fpm.php>)|
|2026-10-21 13:41:09 +0200|The PHP Group / Apache operators|Apache PHP module (mod_php)||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The pinned PHP source declares the apache2handler SAPI. Optional --with-apxs2; Apache presence alone does not establish PHP.|[source 1](<https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/apache2handler/config.m4>)<br>[source 2](<https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html>)|
|2026-10-21 13:41:09 +0200|The PHP Group / PHP Windows maintainers|Official PHP Windows binary ZIP distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official downloads distinguish NTS/TS roles and list four architecture/thread-safety ZIP choices. The x64NTS SBOM describes php8.5.11 and declares upstream dependency edges.|[source 1](<https://www.php.net/downloads.php?os=windows>)<br>[source 2](<https://downloads.php.net/~windows/releases/archives/php-8.5.11-nts-Win32-vs17-x64.zip.spdx.json>)|
|2026-10-21 13:41:09 +0200|The PHP League|Flysystem||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Flysystem supplies a PHP storage abstraction with a separately documented adapter set and distinct require-dev integrations.|[source](<https://packagist.org/packages/league/flysystem>)|
|2026-10-21 13:41:09 +0200|Thelia project|Thelia||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official 3.0 guide requires PHP and modules; migration notes distinguish the root application from the lower-level core package floor.|[source 1](<https://doc.thelia.net/docs/3.0/getting-started/installation>)<br>[source 2](<https://doc.thelia.net/docs/3.0/upgrading/migrate>)|
|2026-10-21 13:41:09 +0200|thirty development llc / thirty bees project|thirty bees||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The release/download page gives a PHP-specific build selection and runtime requirements; the repository identifies its PrestaShop 1.6.1.11 fork point.|[source 1](<https://thirtybees.com/download/>)<br>[source 2](<https://github.com/thirtybees/thirtybees/blob/main/README.md>)|
|2026-10-21 13:41:09 +0200|Thunder project|Thunder Drupal distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official FAQ defines Thunder as a Drupal distribution for professional publishers, inheriting the PHP application runtime.|[source](<https://www.thunder.org/frequently-asked-questions>)|
|2026-10-21 13:41:09 +0200|Tideways / open-source fork contributors|Tideways XHProf archived native extension fork||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>Maintainer archive notice directs users to PECL XHProf and says this fork is not compatible with the commercial Tideways service.|[source](<https://github.com/tideways/php-xhprof-extension>)|
|2026-10-21 13:41:09 +0200|Tideways GmbH|Tideways commercial PHP profiling extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Vendor requirements distinguish the PHP extension from its daemon and describe separate platform and libc scopes.|[source 1](<https://support.tideways.com/documentation/compatibility-and-requirements.html>)<br>[source 2](<https://tideways.com/profiler/downloads>)|
|2026-10-21 13:41:09 +0200|Tiki Software Community Association / Tiki project|Tiki Wiki CMS Groupware||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project documents a PHP 7.4-to-8.1 migration boundary and PHP-dependent Composer libraries.|[source](<https://doc.tiki.org/PHP-8>)|
|2026-10-21 13:41:09 +0200|Totara|Totara||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor requires a PHP server and separates supported PHP branches, mandatory modules and recommended modules.|[source](<https://totara.help/docs/server-system-requirements>)|
|2026-10-21 13:41:09 +0200|TransIP|TransIP API PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The client declares PHP, json/openssl and HTTP dependencies. A Guzzle adapter and Symfony cache are suggested separately.|[source](<https://packagist.org/packages/transip/transip-api-php>)|
|2026-10-21 13:41:09 +0200|TransIP|TransIP shared webhosting PHP option||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>TransIP states its webhosting packages include PHP and documents changing the package's selected version.|[source](<https://www.transip.nl/knowledgebase/5987-wil-php-versie-mijn-website-wijzigen>)|
|2026-10-21 13:41:09 +0200|TurnKey Linux|TurnKey Linux LAMP appliance PHP stack||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The LAMP appliance page includes PHP, CLI tooling and an upstream Composer installation.|[source](<https://www.turnkeylinux.org/lamp/>)|
|2026-10-21 13:41:09 +0200|TurnKey Linux|TurnKey Linux LAPP appliance PHP stack||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The LAPP appliance page documents PHP and PostgreSQL client support with Debian-packaged Composer.|[source](<https://www.turnkeylinux.org/lapp/>)|
|2026-10-21 13:41:09 +0200|TuxCare / CloudLinux|TuxCare ELS PHP for Windows distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>TuxCare documents a Windows PHP distribution with its installer, runtime archives and built-in versus loadable extensions.|[source](<https://docs.tuxcare.com/els-for-runtimes/php/>)|
|2026-10-21 13:41:09 +0200|Twig / Symfony community|Twig template engine||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Twig compiles templates to PHP; its stable 3.x documentation and the registry default alpha describe distinct compatibility scopes.|[source 1](<https://packagist.org/packages/twig/twig>)<br>[source 2](<https://twig.symfony.com/doc/3.x/intro.html>)|
|2026-10-21 13:41:09 +0200|Twilio API Team|Twilio PHP helper SDK||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The helper SDK declares PHP >=7.1.0; Guzzle is suggested as an HTTP client and appears separately in require-dev.|[source](<https://packagist.org/packages/twilio/sdk>)|
|2026-10-21 13:41:09 +0200|Twilio SendGrid|Twilio SendGrid PHP client||Investigation|Investigation|CVE assessment: Caller PHP runtime only; CVE match unknown<br>The client declares PHP >=7.3, five extensions, HTTP-client and ECDSA packages; it replaces the sendgrid/sendgrid-php package name.|[source](<https://packagist.org/packages/sendgrid/sendgrid>)|
|2026-10-21 13:41:09 +0200|TYPO3 project|TYPO3 13.4||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official 13.4.36 download page publishes a PHP 8.2-8.5 requirement and source-archive checksums. Versioned 13.4 documentation describes required and optional modules.|[source 1](<https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/Installation/SystemRequirements/Index.html>)<br>[source 2](<https://get.typo3.org/version/13>)|
|2026-10-21 13:41:09 +0200|Upsun|Upsun PHP application containers||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Upsun documents managed PHP application runtimes and periodic patch delivery through deployment/maintenance.|[source](<https://developer.upsun.com/docs/languages/php>)|
|2026-10-21 13:41:09 +0200|Utrecht University / Yoda|Yoda v1.5 legacy PHP web portal||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>Version 1.5 notes explicitly document the PHP portal upgrade.|[source](<https://utrechtuniversity.github.io/yoda/release-notes/release-1.5.html>)|
|2026-10-21 13:41:09 +0200|Uwe Steinmann / SeedDMS project|SeedDMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The project identifies a PHP-based document-management application with MySQL, SQLite or PostgreSQL and separately publishes two branch families.|[source 1](<https://www.seeddms.org/about/>)<br>[source 2](<https://www.seeddms.org/download/>)|
|2026-10-21 13:41:09 +0200|Vance Lucas / Graham Campbell / phpdotenv contributors|phpdotenv||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The PHP library loads .env configuration and depends on PHP polyfill packages; boolean validation adds an optional filter requirement.|[source](<https://packagist.org/packages/vlucas/phpdotenv>)|
|2026-10-21 13:41:09 +0200|Vanderbilt University / REDCap Consortium|REDCap||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients.|[source](<https://projectredcap.org/software/requirements/>)|
|2026-10-21 13:41:09 +0200|Vardot / Varbase project|Varbase Drupal distribution||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The guide uses PHP/Composer in DDEV and describes automatic Drupal installation and recipe application.|[source](<https://docs.varbase.vardot.com/developers/installing-varbase>)|
|2026-10-21 13:41:09 +0200|Virtualmin|Virtualmin hosted PHP execution modes||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>Virtualmin documents PHP-FPM and FCGId/CGI wrapper execution for customer PHP applications.|[source](<https://www.virtualmin.com/docs/server-components/php-execution-modes/>)|
|2026-10-21 13:41:09 +0200|VirtueMart project|VirtueMart||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official description states that Joomla and VirtueMart are PHP applications and distinguishes the component from a preinstalled Joomla bundle.|[source](<https://virtuemart.net/component/content/article/what-is-virtuemart?Itemid=144&catid=159>)|
|2026-10-21 13:41:09 +0200|VitalPBX|VitalPBX 4.0 PHP management runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor's4.0.0R4 announcement explicitly records a PHP8.1 upgrade.|[source](<https://forums.vitalpbx.org/t/vitalpbx-4-0-0-r4-is-now-available/1863/1>)|
|2026-10-21 13:41:09 +0200|VitalPBX|VitXi server-side PHP component||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The VitXi changelog separately documents PHP8.2 support and later Swoole integration.|[source](<https://vitalpbx.com/cbxchangelog/vitxi-v4-5-vitalpbx-4-5/>)|
|2026-10-21 13:41:09 +0200|VK / VKCOM KPHP project|KPHP compiler and native runtime||Investigation|Investigation|CVE assessment: Independent engine; no automatic inheritance<br>The architecture separates a compiler, native runtime, HTTP server and development extension.|[source 1](<https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/>)<br>[source 2](<https://vkcom.github.io/kphp/kphp-language/kphp-vs-php/kphp-vs-php-differences.html>)|
|2026-10-21 13:41:09 +0200|VK / VKCOM KPHP project|KPHP vkext development PHP extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>vkext exposes network and TL/RPC functions to PHP for development and is separate from the compiler.|[source 1](<https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/internals-vkext.html>)<br>[source 2](<https://vkcom.github.io/kphp/kphp-basics/installation.html>)|
|2026-10-21 13:41:09 +0200|Vtiger|Vtiger CRM Open Source||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor's Open Source installation FAQ explicitly requires PHP and several modules.|[source](<https://help.vtiger.com/article/158054339-Vtiger-Open-Source-FAQs>)|
|2026-10-21 13:41:09 +0200|VuFind project / Villanova University|VuFind||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components.|[source](<https://github.com/vufind-org/vufind/blob/dev/composer.json>)|
|2026-10-21 13:41:09 +0200|WampServer maintainers / Aviatechno|WampServer Windows development bundle||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher distinguishes the full installer, manager updates and separately downloadable PHP add-ons; Apache/PHP and database administration tools are bundled.|[source](<https://wampserver.aviatechno.net/>)|
|2026-10-21 13:41:09 +0200|webERP project|webERP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions.|[source](<https://www.weberp.org/downloads/webERP.Manual.4.15.2.2025-09-03.pdf>)|
|2026-10-21 13:41:09 +0200|Webkul|Bagisto||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5.|[source 1](<https://devdocs.bagisto.com/getting-started/before-you-start.html>)<br>[source 2](<https://devdocs.bagisto.com/getting-started/installation>)|
|2026-10-21 13:41:09 +0200|Webkul / UVdesk|UVdesk Community Helpdesk||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance.|[source 1](<https://github.com/uvdesk/community-skeleton>)<br>[source 2](<https://github.com/uvdesk/community-skeleton/blob/master/composer.json>)|
|2026-10-21 13:41:09 +0200|webonyx / GraphQL-PHP project|webonyx GraphQL-PHP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>This package implements GraphQL in PHP and declares optional AMPHP/ReactPHP integrations separately.|[source](<https://packagist.org/packages/webonyx/graphql-php>)|
|2026-10-21 13:41:09 +0200|WebPros / cPanel|cPanel EasyApache 4 / MultiPHP||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>cPanel documents EA4 PHP packages and handler/CLI management; it distinguishes supported update profiles from retained unsupported mirror packages.|[source](<https://docs.cpanel.net/ea4/php/about-php/>)|
|2026-10-21 13:41:09 +0200|WebPros / cPanel|cPanel internal PHP for hooks and AppConfig applications||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The internal-package guide explicitly separates these packages from EasyApache. Its named SQL library links are mapped in the upstream register.|[source 1](<https://docs.cpanel.net/knowledge-base/general-systems-administration/cpanel-php/>)<br>[source 2](<https://api.docs.cpanel.net/guides/guide-to-standardized-hooks/guide-to-standardized-hooks-hook-action-code>)<br>[source 3](<https://docs.cpanel.net/whm/development/apps-managed-by-appconfig/>)|
|2026-10-21 13:41:09 +0200|WebPros / Plesk|Plesk Obsidian hosted-site PHP||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>The dated PHP Updates entry supplies hosted-handler patch declarations. It is separate from the named Linux and Windows internal engines.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://docs.plesk.com/en-US/obsidian/administrator-guide/web-hosting/php-management/installing-php.75153/>)|
|2026-10-21 13:41:09 +0200|WebPros / Plesk|Plesk plesk-engine internal PHP management runtime for Windows||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>A release-labelled Windows entry explicitly updates PHP inside plesk-engine.|[source](<https://docs.plesk.com/release-notes/obsidian/change-log/>)|
|2026-10-21 13:41:09 +0200|WebPros / Plesk|Plesk sw-engine internal PHP management runtime||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Release-labelled Linux entries pin an internal PHP declaration and a later client-library update. Windows plesk-engine is separately scoped as PHP-0611.|[source 1](<https://docs.plesk.com/release-notes/obsidian/change-log/>)<br>[source 2](<https://support.plesk.com/hc/en-us/articles/31743316866071-The-sw-engine-process-causes-high-CPU-usage-on-a-Plesk-server>)|
|2026-10-21 13:41:09 +0200|Whirl-i-Gig / CollectiveAccess project|CollectiveAccess Providence||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools.|[source](<https://docs.collectiveaccess.org/providence/user/setup/systemReq>)|
|2026-10-21 13:41:09 +0200|WHMCS Ltd.|WHMCS self-hosted application||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor's 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches.|[source 1](<https://docs.whmcs.com/9-0/installation-guide/system-requirements/>)<br>[source 2](<https://docs.whmcs.com/8-13/installation-guide/system-requirements/>)|
|2026-10-21 13:41:09 +0200|Wikimedia / MediaWiki Platform maintainers|Excimer native PHP interrupting timer and sampling profiler||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Publisher PIE metadata identifies a C php-ext package; a fixed project-document revision explains the registry transition.|[source 1](<https://packagist.org/packages/wikimedia/excimer>)<br>[source 2](<https://pecl.php.net/package/excimer/1.2.6>)<br>[source 3](<https://www.mediawiki.org/w/index.php?oldid=8546270&title=Excimer>)|
|2026-10-21 13:41:09 +0200|Wikimedia / MediaWiki project|Parsoid PHP||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Parsoid is a PHP library converting wikitext and HTML; the older JavaScript implementation is explicitly historical.|[source](<https://www.mediawiki.org/wiki/Parsoid>)|
|2026-10-21 13:41:09 +0200|Wikimedia Foundation|Wikimedia MediaWiki application-server PHP tier||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Wikimedia documents MediaWiki request execution through PHP-FPM.|[source 1](<https://wikitech.wikimedia.org/wiki/Application_servers>)<br>[source 2](<https://www.mediawiki.org/wiki/Compatibility/en>)|
|2026-10-21 13:41:09 +0200|Winter CMS project|Winter CMS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork.|[source 1](<https://wintercms.com/docs/v1.2/docs/setup/installation>)<br>[source 2](<https://wintercms.com/en/>)<br>[source 3](<https://wintercms.com/blog/post/we-have-forked-october-cms>)|
|2026-10-21 13:41:09 +0200|WoltLab GmbH|WoltLab Suite||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases.|[source 1](<https://manual.woltlab.com/en/requirements/>)<br>[source 2](<https://manual.woltlab.com/en/php-compatibility/>)|
|2026-10-21 13:41:09 +0200|WooCommerce|WooCommerce||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The vendor distinguishes its recommended PHP stack from a still-compatible legacy floor and names optional integration requirements.|[source](<https://woocommerce.com/document/server-requirements/>)|
|2026-10-21 13:41:09 +0200|WooCommerce|WooCommerce PayPal Payments||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official plugin listing requires installed WooCommerce and PHP to connect a merchant store to PayPal.|[source](<https://wordpress.org/plugins/woocommerce-paypal-payments/>)|
|2026-10-21 13:41:09 +0200|WooCommerce|WooCommerce Stripe Payment Gateway||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The publisher-controlled plugin listing explicitly requires PHP for the WooCommerce Stripe integration.|[source](<https://wordpress.org/plugins/woocommerce-gateway-stripe/>)|
|2026-10-21 13:41:09 +0200|WooCommerce|WooPayments merchant plugin||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official develop header labels version 11.2.0 and declares PHP 7.4, alongside separate WooCommerce and WordPress prerequisites. This corroborates registry metadata, not a verified release archive.|[source 1](<https://github.com/Automattic/woocommerce-payments/blob/develop/woocommerce-payments.php>)<br>[source 2](<https://wordpress.org/plugins/woocommerce-payments/>)<br>[source 3](<https://github.com/Automattic/woocommerce-payments/blob/develop/readme.txt>)|
|2026-10-21 13:41:09 +0200|WordPress Playground contributors|PHP.wasm browser platform adapter||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The web adapter selects a browser-specific compiled PHP package.|[source](<https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/>)|
|2026-10-21 13:41:09 +0200|WordPress Playground contributors|PHP.wasm Node.js platform adapter||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The Node adapter loads version-specific compiled PHP packages.|[source 1](<https://developer.wordpress.org/playground/developers/local-development/php-wasm-node/>)<br>[source 2](<https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/>)|
|2026-10-21 13:41:09 +0200|WordPress Playground contributors|PHP.wasm universal JavaScript API||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The universal package supplies the shared API without choosing a platform-specific PHP binary.|[source](<https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/>)|
|2026-10-21 13:41:09 +0200|WordPress Playground contributors|WordPress Playground browser and local runtime||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>Playground uses a WebAssembly build of the PHP interpreter to run WordPress.|[source](<https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/>)|
|2026-10-21 13:41:09 +0200|WordPress Playground contributors|WordPress Playground PHP.wasm binary family||Investigation|Investigation|CVE assessment: PHP Wasm scope; CVE match unknown<br>The architecture compiles the PHP interpreter to WebAssembly rather than reimplementing it in JavaScript.|[source 1](<https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/>)<br>[source 2](<https://github.com/WordPress/wordpress-playground/blob/trunk/packages/php-wasm/universal/src/lib/supported-php-versions.ts>)|
|2026-10-21 13:41:09 +0200|WordPress project|WordPress||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Current WordPress requirements recommend PHP 8.3+ and allow legacy PHP 7.4+. The Hosting Handbook distinguishes required JSON/mysqli from recommended modules.|[source 1](<https://wordpress.org/about/requirements/>)<br>[source 2](<https://make.wordpress.org/hosting/handbook/server-environment/>)|
|2026-10-21 13:41:09 +0200|WP Engine|WP Engine managed WordPress PHP hosting||Investigation|Investigation|CVE assessment: Hosted PHP option; CVE match unknown<br>WP Engine's guide documents PHP environment selection, staged version availability and forced EOL upgrades with a legacy exception.|[source](<https://wpengine.com/support/php-guide/>)|
|2026-10-21 13:41:09 +0200|WP-CLI / WordPress project|WP-CLI WordPress administration framework||Investigation|Investigation|CVE assessment: Dev/CI/admin scope; CVE match unknown<br>Publisher metadata for wp-cli/wp-cli v2.12.0 declares PHP ^5.6 \|\| ^7.0 \|\| ^8.0 for this tool/library.|[source 1](<https://packagist.org/packages/wp-cli/wp-cli>)<br>[source 2](<https://make.wordpress.org/cli/handbook/guides/installing/>)|
|2026-10-21 13:41:09 +0200|X-Cart|X-Cart 5||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The versioned developer page requires PHP 8.3-8.4, lists runtime extensions and separately recommends Xdebug for development.|[source](<https://developer.x-cart.com/getting_started/requirements>)|
|2026-10-21 13:41:09 +0200|Xdebug / Derick Rethans and contributors|Xdebug PHP Zend instrumentation extension||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Xdebug documents loading its Zend extension into the chosen PHP SAPI configuration.|[source 1](<https://xdebug.org/docs/install>)<br>[source 2](<https://xdebug.org/docs/compat>)|
|2026-10-21 13:41:09 +0200|Xdebug / vscode-php-debug contributors|VS Code PHP Debug adapter external PHP/Xdebug integration||Investigation|Investigation|CVE assessment: Optional PHP path; CVE match unknown<br>The debug-adapter descriptor uses node and out/phpDebug.js. Official README describes Xdebug connections, PHP CLI launch and built-in PHP web-server launch.|[source 1](<https://github.com/xdebug/vscode-php-debug/blob/main/package.json>)<br>[source 2](<https://github.com/xdebug/vscode-php-debug>)|
|2026-10-21 13:41:09 +0200|XenForo Ltd|XenForo||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Vendor documentation identifies PHP web-server requirements, GD JPEG support and a PHP CLI command interface.|[source](<https://docs.xenforo.com/devs>)|
|2026-10-21 13:41:09 +0200|XigmaNAS project|XigmaNAS bundled PHP components||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>XigmaNAS lists PHP and PHP-based administration tools among software used.|[source](<https://www.xigmanas.com/wiki/doku.php?id=features>)|
|2026-10-21 13:41:09 +0200|YetiForce S.A.|YetiForce CRM||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 7.x guide identifies PHP, mandatory modules and optional/integration-specific libraries.|[source 1](<https://doc.yetiforce.com/en/introduction/requirements/>)<br>[source 2](<https://github.com/YetiForceCompany/YetiForceCRM>)<br>[source 3](<https://github.com/YetiForceCompany/YetiForce>)|
|2026-10-21 13:41:09 +0200|Yii Software / Yii project|Yii 2 framework||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Yii 2 release metadata declares a server PHP framework and separately lists lib-pcre and browser asset packages.|[source](<https://packagist.org/packages/yiisoft/yii2>)|
|2026-10-21 13:41:09 +0200|Yii Software / Yii project|Yii Web extension abandoned prototype||Investigation|Investigation|CVE assessment: Historical scope; current use unknown<br>The package registry explicitly marks this old PHP web extension abandoned and recommends yiisoft/yii-middleware instead.|[source](<https://packagist.org/packages/yiisoft/yii-web>)|
|2026-10-21 13:41:09 +0200|YOURLS project|YOURLS||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official project explicitly describes PHP scripts providing self-hosted URL shortening, statistics and plugins.|[source](<https://github.com/YOURLS/YOURLS>)|
|2026-10-21 13:41:09 +0200|Zabbix|Zabbix web frontend||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The 7.4 guide identifies the PHP frontend, its PHP version range and conditional authentication/database modules separately from native server/proxy/agent requirements.|[source 1](<https://www.zabbix.com/documentation/7.4/en/manual/installation/frontend>)<br>[source 2](<https://www.zabbix.com/documentation/7.4/en/manual/installation/requirements>)|
|2026-10-21 13:41:09 +0200|Zen Cart project|Zen Cart||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>Official requirements distinguish core release compatibility, the 1.5.8 installer exception and extension introduction dates.|[source](<https://docs.zen-cart.com/user/first_steps/server_requirements/>)|
|2026-10-21 13:41:09 +0200|ZoneMinder project|ZoneMinder PHP web and API components||Investigation|Investigation|CVE assessment: PHP relationship confirmed; CVE match unknown<br>The official packaging spec separately declares PHP dependencies for web frontends.|[source](<https://github.com/ZoneMinder/zoneminder/blob/master/distros/redhat/zoneminder.spec>)|