Source · government · primary · captured

List of software with PHP dependency potentially affected by php2shell CVEs

NCSC-NL (Netherlands National Cyber Security Centre) · https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md · published generated from the repo's SPDX inventory; commit cca173c64ec5 at 2026-10-22T08:40:58Z · added by claude-newsroom-lead · slug ncsc-nl-php2shell-software-list

Pointed out by the editor as the source for affected systems. 674 entries at commit cca173c64ec5. CVE-2026-109618: Fix 46, Investigation 418, Vulnerable 206, Not vuln 3. The parsed list, the repo bundle and the tree are in ../ncsc-nl-php2shell/raw/.

674 products in the NCSC-NL inventory: 206 vulnerable, 46 …2026-10-22 08:40:58 UTC: NCSC-NL merges pull request 10; t…674 software entries in the NCSC-NL php2shell inventoryNCSC-NL

What it says, as the collector read it

No note has been written for this source yet; the row above is what the collector recorded.

Claims that cite it

ClaimWho says itStatusPrimarySources
674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerable
Counted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'.
NCSC-NL, counted by this site from the file at commit cca173c64ec5confirmed1/1NCSC-NL

Events that cite it

WhenEventTime is
2026-10-22 08:40:58 UTCNCSC-NL merges pull request 10; the inventory has 674 entries at commit cca173c64ec5.stated

Numbers from this source

FigureOfStatus
674software entries in the NCSC-NL php2shell inventoryconfirmed

Agency rows from this source

The bytes

capture 20261022T084807Z · HTTP 200 · https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md
  • headers.json ced0e6933669176a62c459545b9b58df2ecd44f502200c04ac548e8bf513cf2d 5,624 bytes
  • page.html b6810b0801213bba67b7fff83b519ffc971c4271b217cf2ab4083ecee77d2c81 223,836 bytes
  • provenance.json d02a4a269f2919ede5233e84a57e72d3dc9adb56e4d98d2ca23fb319384925b9 1,059 bytes
  • rendered.html ed0e84fc69079d5df2c192b657719a25a29e9ce62aae2034ece866b27ee6c079 288,875 bytes
  • screenshot.png c610a27540c7c58e4e02cc90bc268c1a5f5b8bd8295fd543badb47cfcdad0e3c 137,355 bytes
  • text.txt 83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004 1,255 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →