# List of software with PHP dependency potentially affected by php2shell CVEs
[About this list](README.md)

[0-9](software_list_0-9.md) [A](software_list_a.md) [B](software_list_b.md) [C](software_list_c.md) [D](software_list_d.md) [E](software_list_e.md) [F](software_list_f.md) [G](software_list_g.md) [H](software_list_h.md) [I](software_list_i.md) [J](software_list_j.md) [K](software_list_k.md) [L](software_list_l.md) [M](software_list_m.md) [N](software_list_n.md) [O](software_list_o.md) [P](software_list_p.md) [Q](software_list_q.md) [R](software_list_r.md) [S](software_list_s.md) [T](software_list_t.md) [U](software_list_u.md) [V](software_list_v.md) [W](software_list_w.md) [X](software_list_x.md) [Y](software_list_y.md) [Z](software_list_z.md)

### R

| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|:---------|:--------|:--------------------:|:----------------------:|:----------------------:|:------|------:|
|RainLoop Team|RainLoop Webmail||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>The vendor requirements explicitly specify PHP and distinguish optional contact-database support from the mail UI.|[source 1](<https://www.rainloop.net/docs/system-requirements/>)<br>[source 2](<https://github.com/RainLoop/rainloop-webmail>)|
|RaspAP project|RaspAP PHP network-management web GUI||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.<br>RaspAP's manual installation configures a PHP-CGI web management interface.|[source](<https://docs.raspap.com/get-started/manual/>)|
|ReactPHP project|ReactPHP EventLoop||Runtime-dependent|Runtime-dependent|CVE assessment: Runtime-scoped: assess the linked PHP runtime or deployment; no direct product VEX status is asserted.<br>ReactPHP provides a PHP event loop with a stream_select default that works without installing a separate event-loop extension.|[source](<https://packagist.org/packages/react/event-loop>)|
|Rector project|Rector automated PHP refactoring tool||Runtime-dependent|Runtime-dependent|CVE assessment: Runtime-scoped: assess the linked PHP runtime or deployment; no direct product VEX status is asserted.<br>Publisher metadata for rector/rector 2.7.0 declares PHP ^7.4\|^8.0 for this tool/library.|[source](<https://packagist.org/packages/rector/rector>)|
|Red Hat|Red Hat Enterprise Linux 9 PHP 8.0 packages|php-0:8.0.30-8.el9_8.1 (RHSA-2026:87151)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:87151 and php-0:8.0.30-8.el9_8.1 as a fixed release for both CVEs. This backport is specific to RHEL 9 PHP 8.0; the broader RHEL 9 PHP family still includes an affected PHP 8.4 stream.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://access.redhat.com/errata/RHSA-2026:87151>)<br>[source 2](<https://access.redhat.com/security/cve/cve-2026-109618>)<br>[source 3](<https://access.redhat.com/security/cve/cve-2026-109619>)|
|Red Hat|Red Hat Enterprise Linux 9 PHP RPM/AppStreams|Unpatched PHP builds; fixed release scopes listed separately|Vulnerable|Vulnerable|CVE assessment: Red Hat lists fixed RHEL 9 PHP 8.0 and php:8.3 packages in RHSA-2026:87151 and RHSA-2026:87079, alongside the existing php:8.2 fix. The php:8.4/php stream remains Affected for both CVEs, so the family stays Vulnerable; fixed package scopes are separate entries.<br>The broader RHEL 9 PHP family retains its affected scope, including PHP 8.4. Additional fixed SAP Update Services and EUS packages are recorded separately in PHP-0945, PHP-0946, PHP-0947, PHP-0948, PHP-0949, PHP-0950.|[source 1](<https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages>)<br>[source 2](<https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle>)<br>[source 3](<https://access.redhat.com/security/cve/cve-2026-109618>)<br>[source 4](<https://access.redhat.com/security/cve/cve-2026-109619>)<br>[source 5](<https://access.redhat.com/errata/RHSA-2026:87151>)<br>[source 6](<https://access.redhat.com/errata/RHSA-2026:87079>)<br>[source 7](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 8](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)<br>[source 9](<https://access.redhat.com/errata/RHSA-2026:89111>)<br>[source 10](<https://access.redhat.com/errata/RHSA-2026:88835>)<br>[source 11](<https://access.redhat.com/errata/RHSA-2026:88720>)|
|Red Hat|Red Hat Enterprise Linux 9 php:8.2 module|8.2.35-1.module+el9.8.0+25111+a1450321|Fix|Fix|CVE assessment: Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321<br>Red Hat RHSA-2026:87072 provides fixed RHEL 9 php:8.2 module packages for CVE-2026-109618 and CVE-2026-109619.|[source](<https://access.redhat.com/errata/RHSA-2026:87072>)|
|Red Hat|Red Hat Enterprise Linux 9 php:8.3 module|php:8.3-9080020261020115403.9 (RHSA-2026:87079)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:87079 and php:8.3-9080020261020115403.9 as a fixed release for both CVEs. This assessment covers the RHEL 9 php:8.3 module only; it does not cover the still-affected PHP 8.4 stream.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://access.redhat.com/errata/RHSA-2026:87079>)<br>[source 2](<https://access.redhat.com/security/cve/cve-2026-109618>)<br>[source 3](<https://access.redhat.com/security/cve/cve-2026-109619>)|
|Red Hat|Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions PHP 8.0 packages|php-0:8.0.30-1.el9_2.2 (RHSA-2026:88659)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:88659 and php-0:8.0.30-1.el9_2.2 as the released fix for both CVEs in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. This backport applies only to the named RHEL minor version, subscription channel and package/module stream. Other channels, unpatched packages and the still-affected RHEL 9 PHP 8.4 scope are excluded. Package installation and running services were not tested.<br>Red Hat lists RHSA-2026:88659 and php-0:8.0.30-1.el9_2.2 as the released fix for both CVEs in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.|[source 1](<https://access.redhat.com/errata/RHSA-2026:88659>)<br>[source 2](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 3](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)|
|Red Hat|Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions PHP 8.0 packages|php-0:8.0.30-1.el9_4.2 (RHSA-2026:88725)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:88725 and php-0:8.0.30-1.el9_4.2 as the released fix for both CVEs in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. This backport applies only to the named RHEL minor version, subscription channel and package/module stream. Other channels, unpatched packages and the still-affected RHEL 9 PHP 8.4 scope are excluded. Package installation and running services were not tested.<br>Red Hat lists RHSA-2026:88725 and php-0:8.0.30-1.el9_4.2 as the released fix for both CVEs in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.|[source 1](<https://access.redhat.com/errata/RHSA-2026:88725>)<br>[source 2](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 3](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)|
|Red Hat|Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions php:8.2 module|php:8.2-9040020261023103113.9 (RHSA-2026:88835)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:88835 and php:8.2-9040020261023103113.9 as the released fix for both CVEs in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. This backport applies only to the named RHEL minor version, subscription channel and package/module stream. Other channels, unpatched packages and the still-affected RHEL 9 PHP 8.4 scope are excluded. Package installation and running services were not tested.<br>Red Hat lists RHSA-2026:88835 and php:8.2-9040020261023103113.9 as the released fix for both CVEs in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.|[source 1](<https://access.redhat.com/errata/RHSA-2026:88835>)<br>[source 2](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 3](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)|
|Red Hat|Red Hat Enterprise Linux 9.6 Extended Update Support PHP 8.0 packages|php-0:8.0.30-3.el9_6.2 (RHSA-2026:88720)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:88720 and php-0:8.0.30-3.el9_6.2 as the released fix for both CVEs in Red Hat Enterprise Linux 9.6 Extended Update Support. This backport applies only to the named RHEL minor version, subscription channel and package/module stream. Other channels, unpatched packages and the still-affected RHEL 9 PHP 8.4 scope are excluded. Package installation and running services were not tested.<br>Red Hat lists RHSA-2026:88720 and php-0:8.0.30-3.el9_6.2 as the released fix for both CVEs in Red Hat Enterprise Linux 9.6 Extended Update Support.|[source 1](<https://access.redhat.com/errata/RHSA-2026:88720>)<br>[source 2](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 3](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)|
|Red Hat|Red Hat Enterprise Linux 9.6 Extended Update Support php:8.2 module|php:8.2-9060020261023092136.9 (RHSA-2026:88834)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:88834 and php:8.2-9060020261023092136.9 as the released fix for both CVEs in Red Hat Enterprise Linux 9.6 Extended Update Support. This backport applies only to the named RHEL minor version, subscription channel and package/module stream. Other channels, unpatched packages and the still-affected RHEL 9 PHP 8.4 scope are excluded. Package installation and running services were not tested.<br>Red Hat lists RHSA-2026:88834 and php:8.2-9060020261023092136.9 as the released fix for both CVEs in Red Hat Enterprise Linux 9.6 Extended Update Support.|[source 1](<https://access.redhat.com/errata/RHSA-2026:88834>)<br>[source 2](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 3](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)|
|Red Hat|Red Hat Enterprise Linux 9.6 Extended Update Support php:8.3 module|php:8.3-9060020261022173106.9 (RHSA-2026:89111)|Fix|Fix|CVE assessment: Red Hat lists RHSA-2026:89111 and php:8.3-9060020261022173106.9 as the released fix for both CVEs in Red Hat Enterprise Linux 9.6 Extended Update Support. This backport applies only to the named RHEL minor version, subscription channel and package/module stream. Other channels, unpatched packages and the still-affected RHEL 9 PHP 8.4 scope are excluded. Package installation and running services were not tested.<br>Red Hat lists RHSA-2026:89111 and php:8.3-9060020261022173106.9 as the released fix for both CVEs in Red Hat Enterprise Linux 9.6 Extended Update Support.|[source 1](<https://access.redhat.com/errata/RHSA-2026:89111>)<br>[source 2](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109618.json>)<br>[source 3](<https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-109619.json>)|
|Render; customer/base-image publisher|Render customer PHP Docker hosting|Customer PHP Docker services running unpatched affected runtimes|Vulnerable|Vulnerable|CVE assessment: Render's official advisory directs customers to patch and redeploy their PHP Docker services for both CVEs. This is customer-container exposure, not a vulnerability assertion about Render's control plane or every deployed service.<br>Rebuild or obtain patched PHP images, redeploy each affected service, and verify the runtime serving web requests; Render does not automatically patch customer images.|[source 1](<https://render.com/docs/deploy-php-laravel-docker>)<br>[source 2](<https://render.com/docs/docker>)<br>[source 3](<https://render.com/docs/advisory-php2shell>)|
|RoadRunner PHP community|RoadRunner common PHP worker package||Runtime-dependent|Runtime-dependent|CVE assessment: Runtime-scoped: assess the linked PHP runtime or deployment; no direct product VEX status is asserted.<br>The common worker declares PHP and extension requirements; the old Composer name is replaced.|[source 1](<https://packagist.org/packages/roadrunner/worker>)<br>[source 2](<https://packagist.org/packages/spiral/roadrunner-worker>)|
|RoadRunner project|RoadRunner configured PHP worker-pool integration||Investigation|Investigation|CVE assessment: Optional PHP path; CVE match unknown<br>The documented pool starts PHP CLI processes and applies only to six named plugin paths.|[source](<https://docs.roadrunner.dev/docs/php-worker/pool>)|
|Roave|Roave backward-compatibility checker||Runtime-dependent|Runtime-dependent|CVE assessment: Runtime-scoped: assess the linked PHP runtime or deployment; no direct product VEX status is asserted.<br>Publisher metadata for roave/backward-compatibility-check 8.23.0 declares PHP ~8.4.0 \|\| ~8.5.0 for this tool/library.|[source](<https://packagist.org/packages/roave/backward-compatibility-check>)|
|Rocky Linux|Rocky Linux 10 PHP 8.3 packages|8.3.36-1.el10_2 (RLSA-2026:87070)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87070 (rebuild of RHSA-2026:87070) and 8.3.36-1.el10_2 as the released fix for both CVEs in Rocky Linux 10 default php (8.3). This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87070>)|
|Rocky Linux|Rocky Linux 10 PHP 8.4 packages (php8.4)|8.4.27-1.el10_2 (RLSA-2026:87071)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87071 (rebuild of RHSA-2026:87071) and 8.4.27-1.el10_2 as the released fix for both CVEs in Rocky Linux 10 php8.4. This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87071>)|
|Rocky Linux|Rocky Linux 8 PHP RPM/AppStreams||Investigation|Investigation|CVE assessment: Investigation for Rocky Linux 8 php:7.2, php:7.3 and php:8.0: no explicit vendor assessment found for either CVE in the reviewed sources. The separate php:7.4 and php:8.2 fixed scopes do not determine the status of these streams.<br>Investigation for Rocky Linux 8 php:7.2, php:7.3 and php:8.0: no explicit vendor assessment was found for these streams; php:7.4 and php:8.2 fixes are recorded separately in PHP-0964 and PHP-0965.|[source 1](<https://errata.almalinux.org/8/ALSA-2026-A011.html>)<br>[source 2](<https://errata.almalinux.org/8/ALSA-2026-A012.html>)<br>[source 3](<https://errata.almalinux.org/8/ALSA-2026-A013.html>)<br>[source 4](<https://dl.rockylinux.org/pub/rocky/8/AppStream/x86_64/os/Packages/p/>)|
|Rocky Linux|Rocky Linux 8 php:7.4 module|7.4.33-8.module+el8.10.0+40393+c071e357 (RLSA-2026:87080)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87080 (rebuild of RHSA-2026:87080) and 7.4.33-8.module+el8.10.0+40393+c071e357 as the released fix for both CVEs in Rocky Linux 8 php:7.4. This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87080>)|
|Rocky Linux|Rocky Linux 8 php:8.2 module|8.2.35-1.module+el8.10.0+40394+d21b33fb (RLSA-2026:87073)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87073 (rebuild of RHSA-2026:87073) and 8.2.35-1.module+el8.10.0+40394+d21b33fb as the released fix for both CVEs in Rocky Linux 8 php:8.2. This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87073>)|
|Rocky Linux|Rocky Linux 9 PHP 8.0 packages|8.0.30-8.el9_8.1 (RLSA-2026:87151)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87151 (rebuild of RHSA-2026:87151) and 8.0.30-8.el9_8.1 as the released fix for both CVEs in Rocky Linux 9 default php (8.0). This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87151>)|
|Rocky Linux|Rocky Linux 9 PHP RPM/AppStreams||Investigation|Investigation|CVE assessment: Investigation for Rocky Linux 9 php:8.1: no explicit vendor assessment found for either CVE in the reviewed sources. The separate PHP 8.0, php:8.2 and php:8.3 fixed scopes do not determine the status of these streams.<br>Investigation for Rocky Linux 9 php:8.1: no explicit vendor assessment was found for these streams; PHP 8.0, php:8.2 and php:8.3 fixes are recorded separately in PHP-0966, PHP-0967 and PHP-0968.|[source 1](<https://errata.almalinux.org/9/ALSA-2026-A014.html>)<br>[source 2](<https://dl.rockylinux.org/pub/rocky/9/AppStream/x86_64/os/Packages/p/>)|
|Rocky Linux|Rocky Linux 9 php:8.2 module|8.2.35-1.module+el9.8.0+40395+2f706e64 (RLSA-2026:87072)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87072 (rebuild of RHSA-2026:87072) and 8.2.35-1.module+el9.8.0+40395+2f706e64 as the released fix for both CVEs in Rocky Linux 9 php:8.2. This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87072>)|
|Rocky Linux|Rocky Linux 9 php:8.3 module|8.3.36-1.module+el9.8.0+40396+4e680bb7 (RLSA-2026:87079)|Fix|Fix|CVE assessment: Rocky Linux lists RLSA-2026:87079 (rebuild of RHSA-2026:87079) and 8.3.36-1.module+el9.8.0+40396+4e680bb7 as the released fix for both CVEs in Rocky Linux 9 php:8.3. This fix is specific to the named release and stream; retired or unpatched Rocky Linux streams are assessed separately.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package scope.|[source](<https://errata.rockylinux.org/RLSA-2026:87079>)|
|Roundcube project|Roundcube official 1.7.x-fpm-alpine Docker image|1.7.x-fpm-alpine rebuilt 2026-10-23 09:45 UTC (PHP 8.4.27)|Fix|Fix|CVE assessment: Roundcube's maintainer confirms correction of a regression that reintroduced an old fpm-alpine base. The published 1.7.x-fpm-alpine index was replaced on 23 October at 09:45 UTC; all five Linux platform configurations declare PHP 8.4.27. Scope is this verified index, not every historical tag or a running deployment.<br>Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope.|[source 1](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6361850134>)<br>[source 2](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6361860529>)<br>[source 3](<https://hub.docker.com/v2/repositories/roundcube/roundcubemail/tags/1.7.x-fpm-alpine>)|
|Roundcube project|Roundcube Webmail||Vulnerable|Vulnerable|CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.<br>The official project identifies a PHP/JavaScript webmail server with an internal IMAP library; registry supplies a named release and bounded PHP range.|[source 1](<https://github.com/roundcube/roundcubemail>)<br>[source 2](<https://packagist.org/packages/roundcube/roundcubemail>)<br>[source 3](<https://github.com/roundcube/roundcubemail/blob/master/composer.json>)|
|Roundcube project|Roundcube Webmail Docker image family|Unpatched PHP builds; fixed release scopes listed separately|Vulnerable|Vulnerable|CVE assessment: Roundcube reports rebuilt images, followed by an fpm-alpine regression corrected on 23 October. The republished 1.7.x-fpm-alpine index with PHP 8.4.27 is recorded separately in PHP-0747. The broad family remains Vulnerable for old or unrebuilt variants; this review does not verify every historical tag.<br>Roundcube published replacement images after an fpm-alpine regression; the verified 1.7.x-fpm-alpine rebuild is recorded separately.|[source 1](<https://github.com/roundcube/roundcubemail-docker>)<br>[source 2](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744>)<br>[source 3](<https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6361850134>)<br>[source 4](<https://hub.docker.com/v2/repositories/roundcube/roundcubemail/tags/1.7.x-fpm-alpine>)|