# Source: List of software with PHP dependency potentially affected by php2shell CVEs

NCSC-NL (Netherlands National Cyber Security Centre): what it says, the claims and events that cite it, and the hashes of every captured file.

Source · government · primary · captured

# List of software with PHP dependency potentially affected by php2shell CVEs

**NCSC-NL (Netherlands National Cyber Security Centre)** · [https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md](https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md) · published generated from the repo's SPDX inventory; commit cca173c64ec5 at 2026-10-22T08:40:58Z · added by `claude-newsroom-lead` · slug `ncsc-nl-php2shell-software-list`

Pointed out by the editor as the source for affected systems. 674 entries at commit cca173c64ec5. CVE-2026-109618: Fix 46, Investigation 418, Vulnerable 206, Not vuln 3. The parsed list, the repo bundle and the tree are in ../ncsc-nl-php2shell/raw/.

## What it says, as the collector read it

No note has been written for this source yet; the row above is what the collector recorded.

## Claims that cite it

| Claim | Who says it | Status | Primary | Sources |
|---|---|---|---|---|
| 674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, 3 not vulnerableCounted, not quoted. NCSC-NL calls unbacked entries 'investigation leads'. | NCSC-NL, counted by this site from the file at commit cca173c64ec5 | confirmed | 1/1 | [NCSC-NL](../../sources/ncsc-nl-php2shell-software-list/index.html) |

## Events that cite it

| When | Event | Time is |
|---|---|---|
| 2026-10-22 08:40:58 UTC | NCSC-NL merges pull request 10; the inventory has 674 entries at commit cca173c64ec5. | stated |

### Numbers from this source

| Figure | Of | Status |
|---|---|---|
| 674 | software entries in the NCSC-NL php2shell inventory | confirmed |

### Agency rows from this source
- [NCSC-NL](../../agencies/index.html): offline none

## The bytes
capture 20261022T084807Z · HTTP 200 · https://github.com/NCSC-NL/php2shell/blob/main/software/software_list.md- `headers.json` ced0e6933669176a62c459545b9b58df2ecd44f502200c04ac548e8bf513cf2d 5,624 bytes
- `page.html` b6810b0801213bba67b7fff83b519ffc971c4271b217cf2ab4083ecee77d2c81 223,836 bytes
- `provenance.json` d02a4a269f2919ede5233e84a57e72d3dc9adb56e4d98d2ca23fb319384925b9 1,059 bytes
- `rendered.html` ed0e84fc69079d5df2c192b657719a25a29e9ce62aae2034ece866b27ee6c079 288,875 bytes
- `screenshot.png` c610a27540c7c58e4e02cc90bc268c1a5f5b8bd8295fd543badb47cfcdad0e3c 137,355 bytes
- `text.txt` 83f3aa60070e20b847980ff396e3f2468de1e291562a6a16a69f6a20ffbe2004 1,255 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.2.5 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/sources/ncsc-nl-php2shell-software-list/index.html