{"schema":"sgit.newsroom.stack-catalogue/1","site":"0.8.1","data_as_of":"2026-10-22T11:34Z","kinds":[{"id":"internet","name":"The internet","col":0,"what":"Anyone, anywhere. Put it in the stack and connect it to what it can reach."},{"id":"edge","name":"Edge: CDN, WAF or proxy","col":1,"what":"What requests pass through before they reach an application."},{"id":"app","name":"Application","col":2,"what":"Something that answers requests: a CMS, a framework app, an admin panel, an API."},{"id":"platform","name":"Hosting, image or panel","col":3,"what":"Where the PHP comes from when you do not build it yourself: a distribution package, a container image, a control panel, a managed host."},{"id":"runtime","name":"PHP runtime","col":3,"what":"The PHP that runs the application: its version, how it serves requests (SAPI) and its settings."},{"id":"data","name":"Data store","col":4,"what":"A database, a bucket, a file share: what the application reads and writes."},{"id":"secret","name":"Secrets and credentials","col":4,"what":"Keys, passwords and tokens the application holds: in its config, its environment, its disk."},{"id":"service","name":"Internal service","col":4,"what":"Another system the application can call: an API, a queue, a directory, a payment service."}],"links":[{"id":"routes","name":"sends requests to","from":["internet","edge"],"to":["edge","app"]},{"id":"runs_on","name":"runs on","from":["app"],"to":["runtime","platform"]},{"id":"provides","name":"provides","from":["platform"],"to":["runtime"]},{"id":"reaches","name":"can reach","from":["app","runtime","service"],"to":["data","secret","service"]}],"sensitivity":[["personal","personal data"],["payment","payment data"],["credentials","credentials or keys"],["internal","internal only"],["public","public anyway"]],"controls":[{"id":"memory_unlimited","label":"memory_limit=-1, set where applications cannot override it","vulns":["CVE-2026-109618"],"sapis":["Apache mod_php","PHP-FPM","php-cgi","FrankenPHP","LiteSpeed (LSAPI)"],"what":"memory_limit=-1, set where applications cannot override it (php_admin_value in the FPM pool or Apache config); check no pool, directory or app setting restores a finite limit.","caveat":"Removes the controllable memory-limit failure; an underlying allocation failure can still reach the vulnerable path.","for":"CVE-2026-109618 (OOM corruption)"},{"id":"request_limits","label":"Low post_max_size and upload limits, and request-size limits at the web server or proxy","vulns":["CVE-2026-109618"],"what":"A low post_max_size (8M without uploads, 32M with), upload_max_filesize below it, and web-server or proxy limits on decoded request size, field count, multipart part count, header count and nesting depth, including for requests without a usable Content-Length.","caveat":"Reduces exposure to specific attack paths; does not make an installation safe.","for":"CVE-2026-109618"},{"id":"cgroup_memory","label":"A container or cgroup memory limit as an availability boundary","vulns":["CVE-2026-109618"],"what":"A container or cgroup memory limit as an availability boundary, killing only the affected worker.","caveat":"Do not use RLIMIT_AS or RLIMIT_DATA: they can cause the vulnerable allocation failure.","for":"CVE-2026-109618"},{"id":"upload_progress_off","label":"session.upload_progress.enabled=0 in php.ini or the pool, workers restarted","vulns":["CVE-2026-109619"],"what":"session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, then restart every worker.","caveat":"Blocks the confirmed session paths only. ini_set() and .user.ini are too late.","for":"CVE-2026-109619 (stale global state)"},{"id":"fatal_backtraces_off","label":"fatal_error_backtraces=0 (PHP 8.5), workers restarted","vulns":["CVE-2026-109619"],"branches":["8.5"],"what":"fatal_error_backtraces=0, then restart every worker.","caveat":"Blocks the confirmed fatal-backtrace path only.","for":"CVE-2026-109619, PHP 8.5 only"},{"id":"diagnostics_fixed","label":"Invalid per-request settings and reachable fatal errors removed","vulns":["CVE-2026-109619"],"what":"Remove invalid or deprecated per-request settings that emit diagnostics before initialisation; fix attacker-reachable fatal errors and execution timeouts.","caveat":"Hiding diagnostics with error_reporting, display_errors or @ does not help.","for":"CVE-2026-109619"},{"id":"fpm_max_requests_1","label":"pm.max_requests=1 on PHP-FPM","vulns":["CVE-2026-109618","CVE-2026-109619"],"sapis":["PHP-FPM"],"what":"pm.max_requests=1 on FPM (GitHub advisory).","caveat":"'Updating is the only reliable mitigation.'","for":"both"}],"vulns":[{"id":"CVE-2026-109618","name":"php2shell: RCE via OOM corruption","product":"php","scope":"web-serving PHP","impact":"remote code execution as the PHP worker, before any application code runs (mod_php, demonstrated)","inventory":"status_109618","page":"flaws/index.html#CVE-2026-109618","sources":["cve-cve-2026-109618","github-ghsa-w8hw-w9fx-j79w","php-net-advisory"]},{"id":"CVE-2026-109619","name":"php2shell: RCE via stale global state","product":"php","scope":"web-serving PHP","impact":"remote code execution as the PHP worker, across requests on the same worker (mod_php and FPM, demonstrated)","inventory":"status_109619","page":"flaws/index.html#CVE-2026-109619","sources":["cve-cve-2026-109619","github-ghsa-6wmf-4rv5-p3rp","php-net-advisory"]}],"ranges":[{"branch":"8.5","affected":"< 8.5.12","fixed":"8.5.12","in_cve":true},{"branch":"8.4","affected":"< 8.4.27","fixed":"8.4.27","in_cve":true},{"branch":"8.3","affected":"< 8.3.36","fixed":"8.3.36","in_cve":true},{"branch":"8.2","affected":"< 8.2.35","fixed":"8.2.35","in_cve":true},{"branch":"8.1","affected":"end of life; minimal source backport branch PHP-8.1-CVE-2026-109618-109619","fixed":"no release","in_cve":false},{"branch":"8.0","affected":"end of life; minimal source backport branch","fixed":"no release","in_cve":false},{"branch":"7.4","affected":"end of life; minimal source backport branch PHP-7.4-CVE-2026-109618-109619, commit 2026-10-18T18:10:24Z","fixed":"no release","in_cve":false},{"branch":"5.x to 7.3","affected":"'all versions from 5 onwards' (NCSC-NL); 'all PHP versions >= 5.4' (Wiz); 'toutes versions 5.x, 6.x, 7.x' (CERT-FR)","fixed":"no release, no backport","in_cve":false}],"ranges_note":"The CVE records carry defaultStatus 'unaffected' and list only 8.2 to 8.5, so an automated scanner reading the CVE will call 7.4 to 8.1 unaffected. The php.net advisory, the backport branches and a Greenbone reply on oss-security say otherwise.","fixed":["8.5.12","8.4.27","8.3.36","8.2.35"],"sapis":[{"sapi":"Apache mod_php","risk":"highest","text":"Unauthenticated RCE demonstrated over HTTP with default input and memory limits, before any application code runs."},{"sapi":"PHP-FPM","risk":"susceptible","text":"For CVE-2026-109618 the GitHub advisory says no complete FPM exploit has been demonstrated; the PHP Foundation blog says RCE was confirmed on FPM through application-level paths. For CVE-2026-109619 the session path was validated against FPM."},{"sapi":"php-cgi","risk":"at risk","text":"Listed by php.net among installations serving web requests."},{"sapi":"FrankenPHP","risk":"likely susceptible","text":"'likely susceptible' per the GitHub advisory."},{"sapi":"LiteSpeed (LSAPI)","risk":"likely, unvalidated","text":"'application-specific exploits being likely but unvalidated'."},{"sapi":"CLI, cron, queue workers","risk":"not web-serving","text":"The advisory scopes the risk to installations serving web requests. A CLI process that parses untrusted input is not covered either way by the primary sources."}],"edge":[{"vendor":"Cloudflare","what":"Seven WAF rules per ruleset plus a response-side rule, live for every plan including Free","when":"2026-10-21T03:02Z, about nine hours before disclosure","caveat":"'This is a STOPGAP only' (CTO Dane Knecht); attackers mutated payloads; rules only cover traffic routed through Cloudflare; patch anyway"},{"vendor":"Akamai","what":"Adaptive Security Engine rule 3000991 v1, 'PHP Remote Code Execution Attack Detected', both CVEs; existing command-injection rules also catching weaponised payloads","when":"2026-10-21","caveat":"'The most effective defense continues to be the prompt application of vendor patches'"},{"vendor":"Fastly","what":"A CVE-specific templated rule in the Next-Gen WAF that customers must enable; looks for 'bodies and parameters shaped in ways that differ from legitimate traffic'","when":"2026-10-21","caveat":"'assume active mitigation will only serve as partial protection and may require blocking a substantial portion of legitimate traffic'"},{"vendor":"Imperva","what":"Cloud WAF protected 'out of the box'; Elastic WAF and WAF Gateway after updates; inspects anomalous multipart payloads, repeated session fields, abnormal response headers, upload-progress activity","when":"2026-10-21","caveat":"Had the details under embargo; saw no matching traffic before disclosure"},{"vendor":"AWS","what":"No managed rule found; guidance to consider blocking multipart file uploads on PHP deployments that cannot be patched, after checking the application impact","when":"2026-10-21","caveat":"AWS's own PHP builds for managed distributions reportedly lagged the release (a reader's comment under the post, unverified)"},{"vendor":"Fortinet FortiWeb","what":"Three FortiGuard signatures (090502648, 090502651, 09052654) in database 0.00438, plus four custom-rule templates","when":"2026-10-22T07:55 (article time)","caveat":"Signatures ship in alert-only mode by default; must be switched to block"}],"inventory":{"source":"https://github.com/NCSC-NL/php2shell","commit":"cca173c64ec5","licence":"EUPL-1.2","columns":["supplier","product","version","status_109618","status_109619","note","link"],"rows":[["aaPanel","aaPanel PHP Project hosting and CLI selection","aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://www.aapanel.com/docs/Function/php.html"],["Acquia","Acquia Cloud Platform PHP hosting","","Investigation","Investigation","Acquia publishes selectable PHP runtime settings for Cloud Platform environments.","https://docs.acquia.com/acquia-cloud-platform/configuring-php-settings"],["Adiscon / LogAnalyzer project","Adiscon LogAnalyzer PHP web application","","Vulnerable","Vulnerable","The project identifies LogAnalyzer as a PHP syslog web application; its Composer platform value is only a resolution target.","https://github.com/rsyslog/loganalyzer"],["Adobe","Adobe Commerce","","Vulnerable","Vulnerable","Adobe separately lists PHP modules for its commercial and open-source editions, requires pcntl for parallel indexers, and publishes per-release PHP matrices.","https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings"],["Adyen","Adyen API PHP library","","Investigation","Investigation","Adyen's library metadata requires PHP >=7.3 and ctype, curl, json, mbstring and openssl in the calling application.","https://packagist.org/packages/adyen/php-api-library"],["AfterLogic","AfterLogic WebMail Lite PHP","","Vulnerable","Vulnerable","The vendor requirements were re-read: PHP >=7.4 and mysqlnd-backed database access apply to the Lite PHP webmail application, separately from its mail services and other editions.","https://afterlogic.com/docs/webmail-lite/system-requirements"],["Aimeos project","Aimeos Laravel package","","Investigation","Investigation","The official package README requires PHP and adds shop/admin routes and PHP Artisan setup/jobs to Laravel.","https://github.com/aimeos/aimeos-laravel/blob/master/README.md"],["Aimeos project","Aimeos TYPO3 extension","","Investigation","Investigation","The official 2025.x installation guide requires PHP for its TYPO3 commerce extension.","https://aimeos.org/docs/2025.x/typo3/setup/"],["Akaunting","Akaunting self-hosted application","","Vulnerable","Vulnerable","The application's root runtime requirements explicitly declare PHP and thirteen extensions; README separates PHP from the Node asset pipeline.","https://github.com/akaunting/akaunting/blob/master/composer.json"],["Akeneo","Akeneo PIM Community Edition","","Investigation","Investigation","The official Akeneo PIM Community Edition Composer manifest declares PHP 8.1.* and required extensions.","https://github.com/akeneo/pim-community-dev/blob/master/composer.json"],["Alpine Linux package maintainers","Alpine Linux v3.22 php84 package family","","Investigation","Investigation","Alpine lists the php84 runtime and php84-common dependency, alongside musl and other upstream native libraries. The page separately lists subpackages.","https://pkgs.alpinelinux.org/package/v3.22/community/x86_64/php84"],["Amazon Web Services","AWS Elastic Beanstalk PHP platform","","Investigation","Investigation","AWS publishes four PHP AL2023 platform4.13.10 rows with branch-specific PHP patches and Composer2.10.3/PIE1.5.1.","https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html"],["Amazon Web Services","AWS SDK for PHP v3","","Investigation","Investigation","AWS SDK 3.401.2 declares PHP >=8.1 and json/pcre/simplexml. aws/aws-crt-php is required as a userland package; it does not prove ext-awscrt is loaded.","https://packagist.org/packages/aws/aws-sdk-php"],["Amazon Web Services; third-party/customer PHP runtime publisher","AWS Lambda customer PHP custom-runtime option","","Investigation","Investigation","Bref explains that its PHP runtime names resolve to provided.al2023 plus a PHP layer, rather than native AWS PHP support.","https://bref.sh/docs/runtimes"],["AMPHP project","AMP asynchronous PHP framework","","Investigation","Investigation","AMP is a PHP asynchronous programming library with a PHP runtime constraint and a separate event-loop dependency.","https://packagist.org/packages/amphp/amp"],["Antagonist","Antagonist DirectAdmin PHP hosting selector","","Investigation","Investigation","Antagonist documents a PHP selector covering all sites in one hosting package, per-version modules and extended support.","https://help.antagonist.nl/hc/nl/articles/8523972848401-Wat-kan-ik-met-de-PHP-selector-in-DirectAdmin"],["Apache Friends","XAMPP","","Investigation","Investigation","Apache Friends explicitly lists PHP in its Apache/MariaDB/Perl native bundles. The browser/Endor environment is separated into its own delivery record.","https://www.apachefriends.org/download.html"],["APCu / PHP extension maintainers","APCu native PHP user-cache extension","","Investigation","Investigation","The official catalogue identifies APCu as APC User Cache and declares its selected release PHP requirement.","https://pecl.php.net/package/apcu"],["API Platform project","API Platform Core","","Vulnerable","Vulnerable","The API framework core declares PHP and runtime Symfony components; Laravel/Doctrine and tooling entries in require-dev are not automatically mandatory production dependencies.","https://packagist.org/packages/api-platform/core"],["Arch Linux package maintainers","Arch Linux Extra PHP package","8.5.12-1","Fix","Fix","Arch Linux states that php versions before 8.5.12 are affected by both CVEs; the current Extra package page lists php 8.5.12-1.","https://archlinux.org/packages/extra/x86_64/php/"],["Arch Linux package maintainers","Arch Linux Extra php-legacy package","8.3.36-1","Fix","Fix","Arch Linux states that php-legacy versions before 8.3.36 are affected by both CVEs; the current Extra package page lists php-legacy 8.3.36-1.","https://archlinux.org/packages/extra/x86_64/php-legacy/"],["Artefactual Systems / AtoM project","AtoM","","Vulnerable","Vulnerable","The 2.9 manual requires PHP for archival description software and distinguishes PHP modules from Elasticsearch, ImageMagick and other external services/tools.","https://accesstomemory.org/en/docs/2.9/admin-manual/installation/requirements/"],["Ascensio System SIA / ONLYOFFICE","ONLYOFFICE integration for Nextcloud","","Investigation","Investigation","The vendor connector manifest requires PHP; the repository separately describes a required ONLYOFFICE Document Server.","https://github.com/ONLYOFFICE/onlyoffice-nextcloud/blob/master/composer.json"],["Auth0","Auth0 PHP SDK","","Investigation","Investigation","The SDK requires PHP ^8.2, json, mbstring, openssl and PSR HTTP implementations. Cache/event-dispatcher implementations are suggested.","https://packagist.org/packages/auth0/auth0-php"],["Automattic / WordPress.com","WordPress.com plugin-enabled PHP hosting environment","","Investigation","Investigation","WordPress.com publishes PHP8.3/8.4 and a module environment for plugin-enabled hosting plans.","https://wordpress.com/support/php-environment/"],["AWS SDK Common Runtime team","AWS Common Runtime native PHP extension","","Investigation","Investigation","Publisher requirements distinguish UNIX and Windows PHP minima and document OpenSSL-linked builds versus an AWS-LC build option.","https://pecl.php.net/package/awscrt/1.2.7"],["AWS SDK Common Runtime team","AWS Common Runtime PHP userland binding package","","Investigation","Investigation","The Composer package declares PHP >=5.5 and suggests ext-awscrt while explicitly stating that the native extension is needed to use its functionality.","https://packagist.org/packages/aws/aws-crt-php"],["Backdrop CMS project","Backdrop CMS","","Vulnerable","Vulnerable","Backdrop requires PHP and documents a Drupal 7 upgrade path; OpenSSL is recommended and required by Update Manager.","https://docs.backdropcms.org/documentation/system-requirements"],["bbPress community / WordPress project","bbPress","","Investigation","Investigation","The official plugin listing gives PHP and WordPress requirements for the optional server-side forum plugin.","https://wordpress.org/plugins/bbpress/"],["Behat project","Behat behavior-driven test framework","","Investigation","Investigation","Publisher metadata for behat/behat v4.0.0 declares PHP >=8.2 <8.6 for this tool/library.","https://packagist.org/packages/behat/behat"],["Belnet","Belnet FileSender research/education service","","Investigation","Investigation","Belnet documents a FileSender service for federation members.","https://belnet.be/nl/communities-diensten/alle-diensten/identity-mobility-federation/filesender"],["Ben Ramsey / Ramsey project","Ramsey UUID","","Investigation","Investigation","The PHP UUID package uses PHP math/collection dependencies and suggests native modules only for selected acceleration or generator paths.","https://packagist.org/packages/ramsey/uuid"],["Beyond Code in partnership with Laravel","Laravel Herd managed native PHP environment","","Investigation","Investigation","Herd describes a native PHP stack without containers; Windows documentation distinguishes shipped tools from downloaded PHP binaries.","https://herd.laravel.com/"],["Blackfire / Platform.sh SAS doing business as Upsun","Blackfire deterministic PHP Probe native extension","","Investigation","Investigation","Official docs identify the deterministic PHP probe as a C extension, separate from the agent and browser client.","https://docs.blackfire.io/changelogs/php-probe"],["Blackfire / Platform.sh SAS doing business as Upsun","Blackfire PHP SDK client library","","Investigation","Investigation","The publisher registry identifies a PHP SDK with separate suggested ext-blackfire and ext-zlib capabilities.","https://packagist.org/packages/blackfire/php-sdk"],["Bolt CMS project","Bolt CMS","","Vulnerable","Vulnerable","Bolt 5.2 documentation explicitly requires PHP and lists core and optional PHP modules.","https://docs.boltcms.io/5.2/getting-started/requirements"],["BookStack project","BookStack","Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://www.bookstackapp.com/docs/admin/installation/"],["Box / Humbug project","Box PHAR build and packaging tool","","Investigation","Investigation","Publisher metadata for humbug/box 4.7.0 declares PHP ^8.2 for this tool/library.","https://packagist.org/packages/humbug/box"],["BoxBilling project","BoxBilling","","Vulnerable","Vulnerable","The archived project explicitly identifies PHP/MySQL runtime requirements and directs readers to the separately maintained FOSSBilling fork.","https://github.com/boxbilling/boxbilling"],["Bref project","Bref PHP Lambda runtime layers","Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115","Fix","Fix","Bref confirms patched Bref 3 and Bref 2 PHP Lambda layers are published in all regions; update selected layer versions and redeploy.","https://bref.sh/docs/runtimes"],["Bref project","Bref PHP serverless application adapter","bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://packagist.org/packages/bref/bref"],["Bref project","Bref v2 PHP Docker images","Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27","Fix","Fix","Bref confirms published patched v2 Docker images for PHP 8.2 through 8.4; rebuild derived images with fresh base layers and redeploy.","https://bref.sh/docs/runtimes"],["BuddyPress community / WordPress project","BuddyPress","","Investigation","Investigation","Trac r14231 bumps the 14.0 branch to 14.5.2 while retaining the PHP 5.6 declaration. The current plugin listing frames 7.4 as a hosting recommendation, clarifying the earlier apparent floor conflict.","https://buddypress.trac.wordpress.org/changeset/14231"],["bunq","bunq PHP API SDK","","Investigation","Investigation","The vendor SDK declares PHP compatibility, curl/json/mbstring, Guzzle and a Composer plugin API constraint.","https://packagist.org/packages/bunq/sdk_php"],["Cachet project","Cachet","","Investigation","Investigation","The official Cachet repository requires PHP 8.3 or later for the self-hosted status page system, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/cachethq/cachet"],["CakePHP project","CakePHP framework","","Vulnerable","Vulnerable","CakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages.","https://packagist.org/packages/cakephp/cakephp"],["Canonical / Ubuntu package maintainers","Ubuntu Bionic php7.2-fpm binary package","7.2.24-0ubuntu0.18.04.17+esm14","Fix","Fix","Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 with Ubuntu Pro.","https://ubuntu.com/security/notices/USN-8948-2"],["Canonical / Ubuntu package maintainers","Ubuntu Focal php7.4-fpm binary package","7.4.3-4ubuntu2.29+esm5","Fix","Fix","Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 with Ubuntu Pro.","https://ubuntu.com/security/notices/USN-8948-2"],["Canonical / Ubuntu package maintainers","Ubuntu Jammy php8.1-fpm binary package","8.1.2-1ubuntu2.28","Fix","Fix","Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Jammy php8.1-fpm 8.1.2-1ubuntu2.28.","https://ubuntu.com/security/notices/USN-8948-1"],["Canonical / Ubuntu package maintainers","Ubuntu Noble php8.3-fpm binary package","8.3.6-0ubuntu0.24.04.13","Fix","Fix","Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13.","https://packages.ubuntu.com/noble-updates/php8.3-fpm"],["Canonical / Ubuntu package maintainers","Ubuntu optional PHP package and SAPI family","Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1","Fix","Fix","USN-8948-1 supplies fixes for the listed Ubuntu Apache-module, CGI, CLI and FPM packages; separately inventoried FPM rows also retain USN-8948-2 release and entitlement scope.","https://ubuntu.com/server/docs/how-to/web-services/install-php/"],["Canonical / Ubuntu package maintainers","Ubuntu Resolute php8.5-fpm binary package","8.5.4-0ubuntu1.5","Fix","Fix","Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Resolute php8.5-fpm 8.5.4-0ubuntu1.5.","https://ubuntu.com/security/notices/USN-8948-1"],["Canonical / Ubuntu package maintainers","Ubuntu Stonking php8.5-fpm binary package","8.5.9-0ubuntu2.1","Fix","Fix","Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Stonking php8.5-fpm 8.5.9-0ubuntu2.1.","https://ubuntu.com/security/notices/USN-8948-1"],["Canonical / Ubuntu package maintainers","Ubuntu Trusty php5-fpm binary package","5.5.9+dfsg-1ubuntu4.29+esm18","Fix","Fix","Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 with Ubuntu Pro Legacy Support.","https://ubuntu.com/security/notices/USN-8948-2"],["Canonical / Ubuntu package maintainers","Ubuntu Xenial php7.0-fpm binary package","7.0.33-0ubuntu0.16.04.16+esm22","Fix","Fix","Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 with Ubuntu Pro Legacy Support.","https://ubuntu.com/security/notices/USN-8948-2"],["CaptainHook / Sebastian Feldmann and contributors","CaptainHook PHP Git-hook manager","","Investigation","Investigation","Publisher metadata for captainhook/captainhook 5.29.2 declares PHP >=8.0 for this tool/library.","https://packagist.org/packages/captainhook/captainhook"],["CarbonPHP project","Carbon date/time library","","Investigation","Investigation","Carbon is a PHP DateTime API library with translation, clock and polyfill dependencies.","https://packagist.org/packages/nesbot/carbon"],["Catalyst IT / Mahara project","Mahara","","Vulnerable","Vulnerable","The 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement.","https://manual.mahara.org/en/26.04/administration/config_php.html"],["Centreon","Centreon Web and central-server PHP interface","","Vulnerable","Vulnerable","The vendor installation procedure explicitly enables PHP 8.2 for the central web environment.","https://docs.centreon.com/docs/installation/installation-of-a-central-server/using-packages/"],["Chamilo Association / Chamilo project","Chamilo","","Vulnerable","Vulnerable","The 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced.","https://docs.chamilo.org/administration-guide/admin-guide/installation/server-requirements"],["Checkmk GmbH","Checkmk Appliance","1.7.25","Fix","Fix","Checkmk's appliance 1.7.25 release manifest upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release for both php2shell CVEs.","https://checkmk.com/werks?product=cma"],["CIRCL, Luxembourg","CIRCL-operated MISP threat-sharing service","","Investigation","Investigation","CIRCL publicly states it operates multiple MISP instances; MISP's server PHP relationship is independently documented.","https://www.circl.lu/services/misp-malware-information-sharing-platform/"],["CircleCI","CircleCI cimg/php CI runtime image family","","Investigation","Investigation","CircleCI states each cimg/php tag contains PHP and Composer for CI jobs.","https://circleci.com/developer/images/image/cimg/php"],["Citrix / NetScaler","NetScaler ADC","","Investigation","Investigation","14.1 pooled notice includes PHP; separate guide identifies administration PHP controller. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.","https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf"],["CiviCRM project","CiviCRM","","Vulnerable","Vulnerable","Publisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release's direct manifest.","https://packagist.org/packages/civicrm/civicrm-core"],["ClassicPress project","ClassicPress","","Vulnerable","Vulnerable","The official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files.","https://www.classicpress.net/requirements/"],["Clever Cloud fork of Caucho Technology Quercus","Quercus CleverCloud development branch","","Investigation","Investigation","The branch maintainer identifies a Java PHP implementation copied from Caucho Quercus/Resin.","https://github.com/CleverCloud/Quercus"],["Clientexec","Clientexec","","Investigation","Investigation","Official Clientexec system requirements list PHP runtime support for Clientexec 6.x and 7.x plus required extensions and ionCube Loader versions.","https://docs.clientexec.com/en/article/system-requirements-yl750s/"],["Cloudflare","Cloudflare Pages v1 legacy PHP build image","","Investigation","Investigation","The build-image page retains a legacy PHP row and separately dates v1 migration to v3 before this retrieval.","https://developers.cloudflare.com/pages/configuration/build-image/"],["CloudLinux","CloudLinux legacy ea-PHP extended-support packages","","Vulnerable","Vulnerable","CloudLinux identifies ea-php as affected by both CVEs and says patched ea-php74 through ea-php85 packages are scheduled for EasyApache4 v25.91; release is not yet confirmed.","https://docs.cloudlinux.com/cloudlinuxos/alt-ea_packages/"],["CloudLinux / TuxCare","CloudLinux Alt-PHP / PHP Selector runtime family","","Vulnerable","Vulnerable","CloudLinux identifies Alt-PHP as affected by both CVEs and reports fixed alt-php74 builds for several Linux platforms plus alt-php80 for Alpine Linux 3.23; broader family coverage is still in progress.","https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/"],["CloudLinux / TuxCare","CloudLinux Alt-PHP 7.4 fixed package set","","Fix","Fix","CloudLinux reports fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, 18.04, 22.04, 24.04 and 26.04.","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],["CloudLinux / TuxCare","CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23","","Fix","Fix","CloudLinux reports a fixed alt-php80 release for Alpine Linux 3.23.","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],["Code LTS / William Desportes and contributors","Doctum PHP API documentation generator","","Investigation","Investigation","Publisher metadata for code-lts/doctum v5.6.0 declares PHP ^8.1 for this tool/library.","https://packagist.org/packages/code-lts/doctum"],["Codeception / Michael Bodnarchuk and contributors","Codeception PHP test framework","","Investigation","Investigation","Publisher metadata for codeception/codeception 5.3.7 declares PHP ^8.2 for this tool/library.","https://packagist.org/packages/codeception/codeception"],["CodeIgniter Foundation","CodeIgniter 4 framework","","Vulnerable","Vulnerable","The released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific.","https://packagist.org/packages/codeigniter4/framework"],["Combodo","iTop","","Vulnerable","Vulnerable","The official application manifest declares a bounded PHP runtime requirement separately from development packages.","https://github.com/Combodo/iTop/blob/develop/composer.json"],["Composer / Packagist project","Packagist.org open-source web application","","Vulnerable","Vulnerable","The official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation.","https://github.com/composer/packagist/blob/main/composer.json"],["Composer / Satis maintainers","Satis Composer repository generator","","Investigation","Investigation","Publisher metadata for composer/satis 1.0.0 legacy tag declares PHP ^5.6 \\",""],["Composer / Satis maintainers","Satis official PHP container build recipe","","Investigation","Investigation","The official Dockerfile uses a Composer build stage and PHP8.4 CLI final runtime.","https://github.com/composer/satis/blob/main/Dockerfile"],["Composer project","Composer","","Investigation","Investigation","Composer itself runs on PHP, while its platform model describes PHP, ext-* and lib-* requirements separately from the project packages it manages.","https://getcomposer.org/doc/articles/composer-platform-dependencies.md"],["Composer project / Docker Official Images","Composer default Docker runtime image","","Investigation","Investigation","The pinned recipe installs Composer 2.10.3 into a PHP8 Alpine runtime stage, makes default inherit it, and separately defines a scratch standalone-binary stage.","https://github.com/composer/docker/blob/a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1/latest/Dockerfile"],["Concrete CMS / PortlandLabs","Concrete CMS","","Vulnerable","Vulnerable","Concrete states that it is primarily written in PHP and gives a per-release PHP compatibility table.","https://documentation.concretecms.org/9-x/developers/introduction/system-requirements"],["Contao project","Contao CMS","","Vulnerable","Vulnerable","The 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions.","https://docs.contao.org/5.x/manual/en/installation/system-requirements/"],["Contao project","Contao Manager","","Vulnerable","Vulnerable","Contao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation.","https://docs.contao.org/5.x/manual/en/installation/contao-manager/"],["Coolify","Coolify","","Investigation","Investigation","The official Coolify Composer manifest declares PHP ^8.4 for the self-hostable PaaS, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/coollabsio/coolify/blob/main/composer.json"],["Corporation for Digital Scholarship / Omeka project","Omeka Classic","","Vulnerable","Vulnerable","The project provides version-specific PHP requirements and separately requires ImageMagick for image resizing.","https://omeka.org/classic/docs/Installation/System_Requirements/"],["Corporation for Digital Scholarship / Omeka project","Omeka S","","Vulnerable","Vulnerable","The 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends.","https://omeka.org/s/docs/user-manual/install/"],["Couchbase, Inc.","Couchbase native PHP SDK extension","","Investigation","Investigation","Version 4.5.0 is a PHP client extension. Vendor notes update its native C++ core to 1.3.1 and drop PHP 8.1 support despite the registry minimum.","https://pecl.php.net/package/couchbase/4.5.0"],["Couchbase, Inc.","Couchbase PHP Composer SDK package","","Investigation","Investigation","The 4.5.0 userland package requires JSON; sockets is require-dev, while gRPC/Protobuf are suggestions.","https://packagist.org/packages/couchbase/couchbase"],["Couchbase, Inc.","Couchbase PHP OpenTelemetry integration","","Investigation","Investigation","The integration requires PHP>=8.2, couchbase/couchbase^4.5, open-telemetry/api^1.0 and exporter-otlp^1.4.","https://packagist.org/packages/couchbase/couchbase-opentelemetry"],["Craft CMS / Pixel & Tonic","Craft CMS","","Vulnerable","Vulnerable","Craft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line.","https://craftcms.com/docs/5.x/requirements.html"],["Crater Invoice","Crater","","Investigation","Investigation","The official Crater repository identifies an invoicing application and its installer config sets a minimum PHP version of 7.4.0; GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/crater-invoice-inc/crater/blob/master/config/installer.php"],["CS-Cart","CS-Cart and Multi-Vendor","","Vulnerable","Vulnerable","The common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor.","https://docs.cs-cart.com/latest/install/system_requirements.html"],["CyberPanel project","CyberPanel hosted PHP / LSPHP options","","Investigation","Investigation","CyberPanel's official README advertises selectable PHP families for hosted applications.","https://github.com/usmannasir/cyberpanel"],["daloRADIUS project","daloRADIUS official Docker distribution recipe","","Investigation","Investigation","The official Dockerfile declares an Apache PHP package stack separately from the application.","https://github.com/lirantal/daloradius/blob/master/Dockerfile"],["daloRADIUS project","daloRADIUS PHP web management application","","Vulnerable","Vulnerable","daloRADIUS describes its PHP web application and current PDO database integration.","https://github.com/lirantal/daloradius/blob/master/README.md"],["Dan Phillimore / Uniter project","Uniter PHP-to-JavaScript runtime stack","","Investigation","Investigation","Uniter combines JavaScript parser, transpiler and runtime components to run PHP code.","https://phptojs.com/"],["Datadog / Blackfire integration","Blackfire PHP continuous-profiler integration using Datadog profiling extension","","Investigation","Investigation","The guide loads datadog-profiling.so from a PHP_API_VERSION-specific path, separate from the deterministic Blackfire probe.","https://docs.blackfire.io/continuous-profiling-cookbooks/php"],["DDEV project","DDEV PHP webserver development container","","Investigation","Investigation","DDEV config defines php_version, ddev/ddev-webserver image selection and separate nginx-fpm/apache-fpm/generic modes.","https://docs.ddev.com/en/stable/users/configuration/config/"],["Debian PHP Maintainers","Debian trixie PHP 8.4 FPM package","8.4.27-1~deb13u1","Fix","Fix","Debian DSA-6574-1 fixes CVE-2026-109618 and CVE-2026-109619 in trixie php8.4 8.4.27-1~deb13u1.","https://packages.debian.org/trixie/php8.4-fpm"],["Deployer / Anton Medvedev and contributors","Deployer PHP deployment automation","","Investigation","Investigation","Publisher metadata for deployer/deployer v8.0.5 declares PHP ^8.3 for this tool/library.","https://packagist.org/packages/deployer/deployer"],["DEVSENSE / Phalanger project","Phalanger PHP 5.4 compiler for .NET/Mono","","Investigation","Investigation","The archived repository identifies a PHP 5.4 implementation and its PeachPie succession.","https://github.com/DEVSENSE/Phalanger"],["Docker Community / Docker Official Images, not WordPress upstream image ownership","WordPress Docker Official Image distribution","","Investigation","Investigation","The packaging template derives from official PHP images and installs WordPress-serving native extensions; the repository identifies Docker Community ownership.","https://github.com/docker-library/wordpress/blob/master/Dockerfile.template"],["Docker Official Images / docker-library PHP maintainers","Docker Official PHP Apache/mod_php image variant","","Fix","Fix","The official guide identifies the Apache variant as PHP loaded into Apache; the tag manifest lists Debian trixie and bookworm builds.","https://github.com/docker-library/docs/blob/master/php/README.md"],["Docker Official Images / docker-library PHP maintainers","Docker Official PHP CLI image variant","","Fix","Fix","The tag manifest lists patched stable CLI build directories; the selected Alpine recipe sets PHP_VERSION 8.5.12.","https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/alpine3.24/cli/Dockerfile"],["Docker Official Images / docker-library PHP maintainers","Docker Official PHP FPM image variant","","Fix","Fix","The immutable trixie recipe starts from debian:trixie-slim, disables CGI and enables FPM.","https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/fpm/Dockerfile"],["Docker Official Images / docker-library PHP maintainers","Docker Official PHP ZTS image variant","","Fix","Fix","The immutable trixie recipe enables ZTS, embed and phpdbg. The manifest groups four OS build directories under ZTS tags.","https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/zts/Dockerfile"],["Docker Official Images maintainers","Docker Official Image: php","","Fix","Fix","Official Docker PHP source definitions and official-images metadata reference patched stable PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed image digests still need verification.","https://github.com/docker-library/official-images/blob/master/library/php"],["Doctrine project","Doctrine DBAL","","Investigation","Investigation","DBAL is a PHP database abstraction layer; official configuration documents alternative native-extension drivers and custom driver classes.","https://packagist.org/packages/doctrine/dbal"],["Doctrine project","Doctrine ORM","","Investigation","Investigation","The PHP ORM release requires DBAL and other PHP packages; database extension choice is inherited from the chosen driver graph, not universal PDO presence.","https://packagist.org/packages/doctrine/orm"],["DokuWiki project","DokuWiki official Docker distribution","","Investigation","Investigation","The Dockerfile starts from php:8.4-apache, allows optional PHP_EXTENSIONS build arguments and creates the DokuWiki image.","https://github.com/dokuwiki/docker/blob/main/Dockerfile"],["DokuWiki project / splitbrain","DokuWiki","","Vulnerable","Vulnerable","The official manifest requires PHP and suggests mbstring for performance and intl for locale-aware sorting.","https://github.com/dokuwiki/dokuwiki/blob/master/composer.json"],["Dolibarr project","Dolibarr ERP CRM","","Vulnerable","Vulnerable","The official release compatibility table supplies version-specific PHP boundaries; the repository identifies a PHP web application with JavaScript enhancements.","https://wiki.dolibarr.org/index.php/Releases"],["Drupal Commerce / Centarro","Drupal Commerce","","Investigation","Investigation","The official module project explicitly depends on Drupal, separates 3.x/2.x/1.x core lineages and lists its current release.","https://www.drupal.org/project/commerce"],["Drupal project","Drupal","","Vulnerable","Vulnerable","The refreshed official compatibility matrix preserves major/minor-specific PHP bands. It directs exact extension requirements to core/composer.json; that linked source rendered only a loading placeholder.","https://www.drupal.org/docs/getting-started/system-requirements/php-requirements"],["Drush project","Drush Drupal administration CLI","","Investigation","Investigation","Publisher metadata for drush/drush 13.8.0 declares PHP >=8.3 for this tool/library.","https://packagist.org/packages/drush/drush"],["EasyPHP project","EasyPHP PHP Devserver Windows bundle","","Investigation","Investigation","The project describes a portable PHP development environment with PHP, Apache and modular PHP/version tools.","https://www.easyphp.org/"],["EC-CUBE project","EC-CUBE","","Vulnerable","Vulnerable","The publisher registry provides PHP and direct runtime extension requirements for the explicitly alpha 4.4 sample.","https://packagist.org/packages/ec-cube/ec-cube"],["EGroupware GmbH / EGroupware project","EGroupware","","Vulnerable","Vulnerable","The publisher manifest declares PHP, runtime extensions, optional modules and separately versioned suite packages.","https://packagist.org/packages/egroupware/egroupware"],["Elastic","Elasticsearch official PHP client","","Investigation","Investigation","Fresh v9.5.0 registry review corroborates PHP ^8.1 and transport ^9.0, and separates yaml/zip development dependencies from the runtime list. The broad guide still says PHP 7.4.","https://packagist.org/packages/elasticsearch/elasticsearch"],["Endor; linked by Apache Friends","Endor browser LAMP sandbox / XAMPP for Browsers","","Investigation","Investigation","Apache Friends links its browser bundle to Endor. Endor explicitly describes a browser-run Linux/Apache/MariaDB/PHP emulator and bundled phpMyAdmin.","https://endor.dev/s/lamp"],["Enhancesoft / osTicket project","osTicket","","Vulnerable","Vulnerable","The project installation documentation requires a PHP-capable web server and explicitly lists compatible PHP versions.","https://docs.osticket.com/en/latest/Getting%20Started/Installation.html"],["EspoCRM project","EspoCRM","","Vulnerable","Vulnerable","The project explicitly requires PHP and distinguishes mandatory extensions, database alternatives and optional feature modules.","https://docs.espocrm.com/administration/server-configuration/"],["European Commission","EU Academy Moodle service (2023 evidence)","","Investigation","Investigation","An archived 2023 EU article identifies EU Academy as Moodle-based.","https://interoperable-europe.ec.europa.eu/collection/digital-skills-public-sector/news/eu-academy-platform-nutshell"],["European Commission / OpenEuropa contributors","OpenEuropa Authentication Drupal module","","Investigation","Investigation","Publisher metadata declares PHP and Drupal; the module integrates with EU Login.","https://packagist.org/packages/openeuropa/oe_authentication"],["European Commission / OpenEuropa contributors","OpenEuropa Content Drupal module","","Investigation","Investigation","Publisher metadata declares PHP and Drupal dependencies.","https://packagist.org/packages/openeuropa/oe_content"],["European Commission / OpenEuropa contributors","OpenEuropa Task Runner","","Investigation","Investigation","Publisher describes a PHP task runner and declares its PHP floor.","https://packagist.org/packages/openeuropa/task-runner"],["ExpressionEngine project","ExpressionEngine","","Vulnerable","Vulnerable","The official 7.x requirements identify a PHP/MySQL CMS, required PHP modules and optional PHP-FPM integration.","https://docs.expressionengine.com/latest/installation/requirements.html"],["F5","BIG-IP APM PHP page templates","","Investigation","Investigation","F5 explicitly documents PHP inside APM UI templates. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.","https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html"],["F5","BIG-IP TMOS platform PHP","","Investigation","Investigation","Official issue record confirms PHP in BIG-IP; administration-upload role is described in indexed vendor text. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.","https://cdn.f5.com/product/bugtracker/ID1270257.html"],["Facebook / HHVM project","HHVM 3.30 PHP-compatible legacy line","","Investigation","Investigation","The 3.30 announcement identifies the final PHP-compatible release family.","https://hhvm.com/blog/2018/12/17/hhvm-3.30.html"],["Facebook / HipHop project","HipHop for PHP compiler (HPHPc)","","Investigation","Investigation","Facebook describes replacing its PHP-to-C++ HipHop compiler with HHVM in early 2013.","https://engineering.fb.com/2016/09/22/networking-traffic/redesigning-the-hhvm-jit-compiler-for-better-performance/"],["Fedora Project PHP maintainers","Fedora PHP distribution package family","","Investigation","Investigation","The official package catalogue identifies PHP and gives distinct stable, testing and Rawhide release entries.","https://packages.fedoraproject.org/pkgs/php/php/"],["Feng Office","Feng Office Community Edition","","Vulnerable","Vulnerable","The official Community repository explicitly requires a PHP/MySQL web-server environment and documents application installation/cron setup.","https://github.com/fengoffice/fengoffice"],["FileCloud","FileCloud Server PHP installation and maintenance","","Vulnerable","Vulnerable","Official upgrade instructions invoke the XAMPP php.exe post-upgrade script and identify PHP web-install and multi-tenant administration files.","https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only"],["FileGator project","FileGator","","Vulnerable","Vulnerable","The project requires a PHP web server and ZIP; its sample distro installation also installs mbstring, DOM and XML packages.","https://docs.filegator.io/install.html"],["FileRun","FileRun","","Vulnerable","Vulnerable","The vendor identifies FileRun as PHP software and separates installation-blocking modules from feature-dependent additions.","https://docs.filerun.com/requirements"],["FileSender project","FileSender","","Vulnerable","Vulnerable","The 3.x installation guide requires PHP, identifies web/CLI paths and a separately installed SimpleSAMLphp authentication dependency.","https://docs.filesender.org/filesender/v3.0/install/"],["Firefly III project","Firefly III","","Investigation","Investigation","The official Firefly III repository identifies a self-hosted personal finance manager with a PHP application tree, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/firefly-iii/firefly-iii"],["Flarum project / Flarum Foundation","Flarum","","Vulnerable","Vulnerable","Official 2.x documentation distinguishes PHP, database drivers and CLI/Composer maintenance; 1.x has a separate compatibility scope.","https://docs.flarum.org/install/"],["Fly.io; customer runtime-image publisher","Fly.io customer Laravel/PHP Machines deployment","","Investigation","Investigation","Fly.io documents Laravel detection, generated nginx/php-fpm container configuration and PHP CLI job/release processes.","https://fly.io/laravel/"],["Forma LMS project","Forma LMS","","Vulnerable","Vulnerable","The project mirror README explicitly lists a PHP server, required extensions and web-based installation.","https://github.com/formalms/formalms"],["Fortinet","FortiADC","","Investigation","Investigation","7.4.8 vendor CLI example shows PHP-FPM; web-interface role is corroborated by indexed troubleshooting text. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.","https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/db39ff41-6283-11f0-a9d0-d2b0d2e22f7d/fortiadc-v7.4.8-cli-reference-guide.pdf"],["FOSSBilling project","FOSSBilling","","Vulnerable","Vulnerable","The current requirements identify PHP and distinguish mandatory modules, recommended media/cache support and the Plesk-only SimpleXML requirement.","https://docs.fossbilling.org/getting-started/requirements/"],["FrankenPHP","FrankenPHP static builds","","Vulnerable","Vulnerable","PHP names FrankenPHP among web-serving installations at risk from both CVEs; maintainers state builds are prepared but fixed artifact release is not yet confirmed.","https://frankenphp.dev/docs/static/"],["FreeBSD Project / ports maintainers","FreeBSD PHP port and mod_php package integration","","Investigation","Investigation","The maintained port relationship now has a dated 2026Q3 commit and advertised source checksum, beyond the handbook PHP 7.4 example.","https://lists.freebsd.org/archives/dev-commits-ports-branches/2026-August/014722.html"],["FreeScout project","FreeScout","","Vulnerable","Vulnerable","The project describes a PHP/Laravel helpdesk and documents both web and CLI requirements.","https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide/393b7d2751835e7ef272f4b09ba5e38a14804ff0"],["FreshRSS project","FreshRSS","","Investigation","Investigation","Official FreshRSS server requirements state that current releases are PHP web applications requiring PHP 8.1+.","https://freshrss.github.io/FreshRSS/en/admins/02_Prerequisites.html"],["FrontAccounting project","FrontAccounting","","Vulnerable","Vulnerable","The official project mirror explicitly requires PHP for the accounting application and explains PHP session/web-server configuration.","https://github.com/FrontAccountingERP/FA"],["Froxlor Team","Froxlor control panel PHP branches","","Vulnerable","Vulnerable","The main manifest declares PHP^8.5 and Laravel13, while the separately scoped 2.0 migration guide documents older PHP requirements and PHP CLI helpers.","https://github.com/froxlor/froxlor/blob/main/composer.json"],["FusionDirectory","FusionDirectory","","Vulnerable","Vulnerable","The versioned manual identifies a PHP identity-management web application with an independently operated LDAP server.","https://fusiondirectory-user-manual.readthedocs.io/en/1.4/fusiondirectory/prerequisite/prerequisite.html"],["FusionDirectory","FusionDirectory Orchestrator","","Vulnerable","Vulnerable","The vendor manual identifies Orchestrator as a PHP web application with its own version requirements and a separate FusionDirectory/LDAP dependency.","https://fusiondirectory-user-manual.readthedocs.io/en/latest/fusiondirectory-orchestrator/prerequisite/prerequisite.html"],["FusionPBX project","FusionPBX PHP management application","","Vulnerable","Vulnerable","FusionPBX publishes a PHP CLI/FPM installation recipe with version-specific package choices.","https://github.com/fusionpbx/fusionpbx-install.sh/blob/master/debian/resources/php.sh"],["Gentoo PHP maintainers","Gentoo dev-lang/php runtime package family","dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://packages.gentoo.org/packages/dev-lang/php"],["GLPI / Teclib","GLPI","","Vulnerable","Vulnerable","The official release catalogue and pinned version-bump diff establish GLPI 12.0.0 final. The installation guide still covers only 10/11 PHP minima; the 12 release Composer manifest read was denied.","https://glpi-install.readthedocs.io/en/latest/prerequisites.html"],["Google","Google APIs Client Library for PHP","","Investigation","Investigation","The PHP API client requires PHP ^8.1, generated API service classes and Google Auth, with PHP HTTP/JWT dependencies.","https://packagist.org/packages/google/apiclient"],["Google","Google Auth Library for PHP","","Investigation","Investigation","Publisher metadata declares PHP ^8.1 for OAuth/JWT credential and HTTP client support. phpseclib is suggested for some signing/token paths.","https://packagist.org/packages/google/auth"],["Google","Google Cloud Firestore PHP client","","Investigation","Investigation","Firestore client metadata requires ext-grpc and PHP ^8.2, while ext-protobuf is suggested to improve throughput over pure-PHP serialization.","https://packagist.org/packages/google/cloud-firestore"],["Google","Google Cloud Storage PHP client","","Investigation","Investigation","The client requires PHP ^8.2 and google/cloud-core. Pub/Sub notifications and phpseclib signing are suggestions, not universal requirements.","https://packagist.org/packages/google/cloud-storage"],["Google / googleapis contributors","Google Cloud PHP client monolith","","Investigation","Investigation","Publisher metadata declares PHP ^8.2 and PHP RPC/serialization dependencies. The project recommends individual client packages and distinguishes optional versus required gRPC transports.","https://packagist.org/packages/google/cloud"],["Google / Protocol Buffers project","Protocol Buffers native PHP extension","","Investigation","Investigation","The PECL release declares PHP >=8.2.0 for the native extension. Firestore's independent metadata suggests it for throughput rather than requiring it.","https://pecl.php.net/package/protobuf/5.36.2"],["Google / Protocol Buffers project","Protocol Buffers PHP userland runtime","","Investigation","Investigation","The PHP runtime declares PHP >=8.2.0 and suggests bcmath for JSON deserialization. It is separate from the native protobuf extension and protoc generator.","https://packagist.org/packages/google/protobuf"],["Google Cloud","Google App Engine Flexible PHP runtime","App Engine Flexible PHP runtimes not redeployed onto patched supported images","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.cloud.google.com/appengine/docs/flexible/php/runtime"],["Google Cloud","Google App Engine Standard PHP runtime","PHP 8.2+ supported runtimes","Fix","Fix","Google documents its managed Standard PHP runtime, PHP-FPM serving and automatic patch updates within the selected runtime family.","https://docs.cloud.google.com/appengine/docs/standard/php-gen2/runtime"],["Google Cloud; customer image publisher","Google Cloud Run customer PHP container option","Cloud Run customer containers with unpatched PHP on their respective branches","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.cloud.google.com/run/docs/quickstarts/build-and-deploy/deploy-php-service"],["Grav project","Grav CMS","","Vulnerable","Vulnerable","The current 2.x guide requires PHP 8.3.11+ and describes flat-file storage without a database.","https://learn.getgrav.org/2/basics/requirements"],["Grokability / Snipe-IT project","Snipe-IT","","Vulnerable","Vulnerable","The vendor distinguishes required PHP extensions from LDAP and alternative image-processing requirements.","https://snipe-it.readme.io/docs/requirements"],["grommunio GmbH","grommunio Web","","Vulnerable","Vulnerable","The project separates its PHP server from JavaScript/CSS, requires the Gromox MAPI extension and says released packages contain a built tree.","https://github.com/grommunio/grommunio-web"],["gRPC project","gRPC native PHP extension","","Investigation","Investigation","PECL identifies a stable PHP extension release. The Windows catalogue distinguishes PHP versions, TS/NTS and x86/x64 builds; quickstart requires it for PHP client calls.","https://pecl.php.net/package/gRPC/1.83.1"],["gRPC project","gRPC PHP Composer support library","","Investigation","Investigation","The Composer mirror contains PHP support files and declares PHP >=7.1.0. Official quickstart separately requires the native grpc extension for PHP clients.","https://packagist.org/packages/grpc/grpc"],["Guzzle project","Guzzle HTTP client","","Investigation","Investigation","Guzzle declares a PHP HTTP client with promises and PSR-7 packages; cURL is a chosen-handler requirement rather than an unconditional root runtime requirement.","https://packagist.org/packages/guzzlehttp/guzzle"],["Heroku / Salesforce","Heroku PHP buildpack and application runtime","Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://devcenter.heroku.com/articles/php-support"],["Hestia Control Panel project","HestiaCP hestia-php internal runtime","Unpatched HestiaCP bundled hestia-php runtime; fix still being built","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://github.com/hestiacp/hestiacp/releases/tag/1.10.5"],["Hestia Control Panel project","HestiaCP hosted-site PHP-FPM / MultiPHP option","HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://hestiacp.com/install"],["HikaShop project","HikaShop Joomla component","","Investigation","Investigation","The official guide describes PHP installation scripts inside the Joomla administrator component and PHP configuration handling.","https://www.hikashop.com/support/documentation/hikashop/installation-configuration"],["HippyVM contributors","HippyVM RPython PHP implementation","","Investigation","Investigation","The project implements PHP using RPython and lists php5-cli among its build prerequisites.","https://github.com/hippyvm/hippyvm"],["Homebrew maintainers","Homebrew PHP formula and bottles","","Investigation","Investigation","The official formula page lists stable 8.5.11, php-fpm service commands and Apache module configuration.","https://formulae.brew.sh/formula/php"],["Horde Project","Horde Groupware Webmail Edition 5","","Vulnerable","Vulnerable","The official legacy Webmail manifest identifies the PHP groupware/webmail bundle and its Horde dependency.","https://github.com/horde/webmail/blob/master/composer.json"],["HostBill / HostBillApp","HostBill","","Vulnerable","Vulnerable","The vendor-hosted requirements distinguish mandatory PHP modules and ionCube from recommended/feature-specific additions.","https://hostbill.atlassian.net/wiki/spaces/DOCS/pages/53745197/System%2Brequirements"],["HumHub","HumHub","","Investigation","Investigation","Official HumHub requirements document Apache/mod_php or PHP-FPM deployment options and a current PHP compatibility matrix.","https://docs.humhub.org/docs/admin/requirements/"],["Ibexa","Ibexa DXP","","Vulnerable","Vulnerable","The versioned requirements page lists PHP 8.3/8.4 for DXP 5.0, PHP CLI/FPM packages and runtime extensions.","https://doc.ibexa.co/en/5.0/getting_started/requirements/"],["Icinga GmbH","Icinga Certificate Monitoring","","Investigation","Investigation","The official module guide requires Icinga Web; the release announcement explicitly identifies this PHP module and version support.","https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/02-Installation/"],["Icinga GmbH","Icinga DB Web","","Investigation","Investigation","The named web module has its own PHP/module requirements and is installed into Icinga Web.","https://icinga.com/docs/icinga-db-web/latest/doc/02-Installation/From-Source/"],["Icinga GmbH","Icinga Director","","Investigation","Investigation","The official module installation guide supplies PHP and extension requirements for configuration deployment and background work.","https://icinga.com/docs/icinga-director/latest/doc/02-Installation/From-Source/"],["Icinga GmbH","Icinga PDF Export","","Investigation","Investigation","The vendor explicitly identifies the PHP PDF-export module and separates PHP libraries from its locally installed Chromium process.","https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates"],["Icinga GmbH","Icinga Reporting","","Investigation","Investigation","The module's own requirements explicitly identify PHP, mbstring and a database PDO connector.","https://icinga.com/docs/icinga-reporting/latest/doc/02-Installation/"],["Icinga GmbH","Icinga Web","","Vulnerable","Vulnerable","The official guide explicitly separates PHP web/CLI requirements from Icinga 2 and Icinga DB monitoring services.","https://icinga.com/docs/icinga-web/latest/doc/02-Installation/From-Source/"],["igbinary project","igbinary native PHP serializer extension","","Investigation","Investigation","The selected release is a PHP binary serializer and states its PHP requirement.","https://pecl.php.net/package/igbinary/3.2.16"],["ILIAS Society / ILIAS project","ILIAS","","Vulnerable","Vulnerable","The official release-branch guide documents mod_php, FCGI/PHP-FPM and PHP CLI setup and cron, with separate required and feature-dependent modules.","https://github.com/ILIAS-eLearning/ILIAS/blob/release_11/docs/configuration/install.md"],["Imagick project","Imagick native PHP image extension","","Investigation","Investigation","The release describes a native PHP wrapper for ImageMagick and declares a PHP minimum; its notes mention PHP 8.5 compilation compatibility.","https://pecl.php.net/package/imagick/3.8.1"],["iNextrix / ASTPP","ASTPP v7 PHP billing and management application","","Vulnerable","Vulnerable","ASTPP's vendor explicitly identifies PHP8.2 in version7.","https://astppbilling.org/your-top-questions-from-the-astpp-v7-webinar-answered"],["Infection project","Infection PHP mutation-testing tool","","Investigation","Investigation","Publisher metadata for infection/infection 0.35.8 declares PHP ^8.3 for this tool/library.","https://packagist.org/packages/infection/infection"],["Invision Community / Invision Power Services","Invision Community Classic","","Vulnerable","Vulnerable","The vendor explicitly describes PHP requirements for the self-hosted Classic product and customer responsibility for server security patches and version upgrades.","https://invisioncommunity.com/buy/self-hosted/"],["Invoice Ninja","Invoice Ninja self-hosted server","","Vulnerable","Vulnerable","The source manifest confirms the PHP server and direct extensions; the repository identifies a Laravel API/client-portal implementation.","https://github.com/invoiceninja/invoiceninja/blob/v5-stable/composer.json"],["InvoicePlane project","InvoicePlane","","Vulnerable","Vulnerable","The installation guide confirms PHP web/CLI use; the manifest identifies PHP libraries and a CodeIgniter 3.4 fork separately from development tools.","https://github.com/InvoicePlane/InvoicePlane/blob/develop/.github/docs/INSTALLATION.md"],["IONOS","IONOS webhosting PHP and CLI options","","Investigation","Investigation","IONOS documents per-domain PHP versions and a separate CLI version/path table.","https://www.ionos.com/help/hosting/managing-php-versions-in-the-control-panel/displaying-or-changing-php-versions/"],["ISPConfig project","ISPConfig 3 control panel UI and scripts","ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://www.ispconfig.org/blog/ispconfig-3-2-12-released/"],["Issabel","Issabel 5 PHP communications management","","Investigation","Investigation","Issabel identifies PHP7.4 as a component of its version5 release.","https://www.issabel.com/en/release-of-issabel-5-innovation-and-advancement-in-unified-communications/"],["Jakub Vrana / Adminer project","Adminer","","Vulnerable","Vulnerable","The official site describes a database administration application shipped as a single PHP file and requiring PHP session support.","https://www.adminer.org/"],["JBMC Software / DirectAdmin","DirectAdmin CustomBuild hosted PHP","CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.directadmin.com/webservices/php/multiple-php.html"],["JetBrains","PhpStorm external PHP interpreter integration","","Investigation","Investigation","The guide requires a separately installed PHP engine and configures its executable/php.ini, interpreter selection and optional Xdebug integration.","https://www.jetbrains.com/help/phpstorm/configuring-local-interpreter.html"],["Joomla project","Joomla 6.x","","Vulnerable","Vulnerable","The stable/current Joomla documentation identifies version 6.1 and gives a PHP 8.3.0 minimum, PHP 8.4 recommendation and required modules.","https://manual.joomla.org/docs/get-started/technical-requirements/"],["Jordi Boggiano / Monolog contributors","Monolog","","Investigation","Investigation","Monolog is a PHP logging library; handler-dependent modules and service clients are optional, and several integrations appear only in require-dev.","https://packagist.org/packages/monolog/monolog"],["JPHP Group","JPHP JVM compiler and runtime","","Investigation","Investigation","JPHP compiles PHP source to JVM bytecode and distinguishes its own runtime library from Zend PHP.","https://github.com/jphp-group/jphp"],["Juniper Networks","Junos OS J-Web (EX/SRX scope)","","Investigation","Investigation","Juniper-authored CVE record expressly identifies PHP in J-Web; later vendor bulletin corroborates inclusion. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.","https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json"],["Kanboard project","Kanboard","","Vulnerable","Vulnerable","The server-side requirements distinguish PHP versions and extensions from ordinary browser/device requirements.","https://docs.kanboard.org/v1/admin/requirements/"],["Kevin Papst / Kimai project","Kimai","Kimai 2.70.1 rebuilt supported Docker image tags","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://packagist.org/packages/kimai/kimai"],["Kinsta","Kinsta managed WordPress PHP hosting","","Investigation","Investigation","Kinsta's WordPress hosting guide documents selectable PHP engine families.","https://kinsta.com/docs/wordpress-hosting/php/"],["Kirby CMS project","Kirby CMS","","Vulnerable","Vulnerable","Kirby provides version-specific PHP support and required, recommended and optional extension lists.","https://getkirby.com/docs/reference/system/requirements"],["Klemen Stirn / Hesk","Hesk Free self-hosted helpdesk","","Vulnerable","Vulnerable","The vendor identifies Hesk Free as self-hosted PHP/MySQL software and publishes its version and PHP range.","https://www.hesk.com/download.php"],["Kopano / Kopano-dev","Kopano WebApp","","Vulnerable","Vulnerable","The official WebApp mirror explicitly lists PHP server dependencies and a separate native MAPI interface.","https://github.com/Kopano-dev/kopano-webapp"],["Krayin","Krayin CRM","","Investigation","Investigation","The official Krayin CRM repository requires PHP 8.3 or higher for the Laravel CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/krayin/laravel-crm"],["Ladybird Web Solution / Faveo","Faveo Helpdesk Community Edition","","Vulnerable","Vulnerable","Edition-labelled vendor installation instructions explicitly provision PHP for the Community helpdesk.","https://docs.faveohelpdesk.com/docs/installation/providers/community/ubuntu-apache/"],["Laminas Project / Linux Foundation","Laminas MVC","","Vulnerable","Vulnerable","The released package declares PHP and MVC application dependencies; official Laminas documentation labels MVC security-only maintenance.","https://packagist.org/packages/laminas/laminas-mvc"],["Laminas Project / Mezzio","Mezzio","","Vulnerable","Vulnerable","Publisher metadata identifies a PHP PSR-15 middleware framework with router, template and request-handler packages.","https://packagist.org/packages/mezzio/mezzio"],["Lando project","Lando PHP service plugin images","","Investigation","Investigation","Lando documents an optional PHP service and custom images; its legacy warning says EOL families can run but should be considered deprecated.","https://docs.lando.dev/plugins/php/index.html"],["Laragon project","Laragon Full Windows development bundle","","Investigation","Investigation","Laragon explicitly calls PHP bundled, documents terminal PATH use and switching/updating PHP versions in the Full environment.","https://laragon.org/download"],["Laravel","Laravel 13 framework","","Vulnerable","Vulnerable","Laravel 13 deployment documentation identifies server PHP requirements and web/CLI deployment operations. The separately versioned 12 guide has a lower PHP floor.","https://laravel.com/framework/docs/deployment"],["Laravel","Laravel Cloud PHP runtime option","","Investigation","Investigation","Laravel Cloud documents PHP runtime families and an8.5-specific pdo_sqlsrv availability limitation.","https://laravel.com/cloud/docs/runtimes"],["Laravel","Laravel Vapor core PHP invocation package","","Investigation","Investigation","The published package manifest identifies Vapor's PHP invocation handlers and runtime dependencies.","https://packagist.org/packages/laravel/vapor-core"],["Laravel","Laravel Vapor PHP Docker base image family","","Investigation","Investigation","Vapor's Docker instructions name its PHP base-image family and architecture/version tag choices.","https://docs.vapor.build/projects/environments"],["Laravel; AWS infrastructure","Laravel Vapor PHP serverless hosting configuration","","Investigation","Investigation","Vapor documents separate native and Docker PHP runtime modes and their customization boundaries.","https://docs.vapor.build/projects/environments"],["LDAP Account Manager project","LDAP Account Manager","","Vulnerable","Vulnerable","The manual requires a PHP web environment and separates optional Perl lamdaemon from the PHP application.","https://www.ldap-account-manager.org/static/doc/manual/ch02.html"],["Leantime project","Leantime","","Vulnerable","Vulnerable","The root runtime manifest explicitly requires PHP and modules, including LDAP and process-control modules, separately from development tooling.","https://github.com/Leantime/leantime/blob/master/composer.json"],["LibreNMS project","LibreNMS","","Vulnerable","Vulnerable","The root manifest requires PHP and runtime modules; the guide separately configures PHP-FPM/CLI and Python/native helper packages.","https://docs.librenms.org/Installation/Install-LibreNMS/"],["libsmbclient-php project","SMBClient native PHP Samba binding","","Investigation","Investigation","The selected release provides PHP functions and smb streams using Samba's libsmbclient.","https://pecl.php.net/package/smbclient/1.1.2"],["libvirt-php contributors / Unraid distribution","Unraid libvirt-php management binding","","Investigation","Investigation","Unraid independently lists libvirt-php alongside its matching PHP package.","https://docs.unraid.net/unraid-os/release-notes/7.3.2/"],["Lime Technology / Unraid","Unraid PHP management runtime distribution","","Investigation","Investigation","Unraid release notes identify its PHP package and PHP web GUI files.","https://docs.unraid.net/unraid-os/release-notes/7.3.2/"],["LimeSurvey GmbH / LimeSurvey project","LimeSurvey Community Edition","","Vulnerable","Vulnerable","The CE installation manual binds PHP bands to major LS versions and separates conditional survey, mail, directory and archive features.","https://www.limesurvey.org/manual/Installation_-_LimeSurvey_CE"],["LiveCodes project","LiveCodes PHP (Uniter) browser mode","","Investigation","Investigation","The php language mode uses Uniter in the browser and lists version 2.18.0.","https://livecodes.io/docs/languages/php/"],["LiveCodes project","LiveCodes PHP (Wasm) browser mode","","Investigation","Investigation","The Wasm mode names its php-wasm and PHP versions separately.","https://livecodes.io/docs/languages/php-wasm/"],["Lunar project","Lunar administration panel","","Investigation","Investigation","Publisher package metadata identifies an admin panel and requires its exact commerce-core and Filament component versions.","https://packagist.org/packages/lunarphp/lunar"],["Lunar project","Lunar commerce core","","Investigation","Investigation","Publisher metadata declares PHP, three direct extensions and Laravel for the headless commerce core.","https://packagist.org/packages/lunarphp/core"],["m0n0wall project","m0n0wall legacy PHP-CGI management appliance","","Investigation","Investigation","The project's facts page lists PHP-CGI; its closure announcement ends further development/releases.","https://m0n0.ch/wall/facts.php"],["Mage-OS project","Mage-OS","","Vulnerable","Vulnerable","The official page lists PHP runtime requirements and identifies the Magento base for Mage-OS release families.","https://mage-os.org/get-started/system-requirements/"],["Magento / Adobe","Magento Open Source","","Vulnerable","Vulnerable","Adobe's shared PHP settings page supplies a separate Magento Open Source extension list and makes pcntl conditional on parallel indexing.","https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings"],["MailWatch project","MailWatch for MailScanner","","Vulnerable","Vulnerable","The official repository explicitly describes a PHP web front end to the separate MailScanner system.","https://github.com/mailwatch/MailWatch"],["MAMP GmbH","MAMP local server environment","","Investigation","Investigation","MAMP describes an installable local stack containing PHP; its downloads distinguish OS-specific installer versions.","https://www.mamp.info/en/mamp/mac/"],["MantisBT project","MantisBT","","Vulnerable","Vulnerable","The project's own installation requirements explicitly identify PHP for the bug tracker server.","https://github.com/mantisbt/mantisbt"],["Matomo","Matomo On-Premise","","Vulnerable","Vulnerable","The vendor FAQ confirms PHP web/CLI processing and upcoming beta requirements; the 5.x source root preserves a lower declared PHP floor.","https://matomo.org/faq/on-premise/matomo-requirements/"],["Matomo / InnoCraft","Matomo Analytics for WordPress","","Investigation","Investigation","The publisher listing identifies server-side analytics processing in WordPress and version-gated PHP requirements for the coming Matomo-6 update.","https://wordpress.org/plugins/matomo/"],["Matomo team","Matomo PHP tracking client","","Investigation","Investigation","The tracking package requires PHP ^8.1 and json, and suggests curl for HTTPS tracking requests.","https://packagist.org/packages/matomo/matomo-php-tracker"],["Mautic project","Mautic","","Vulnerable","Vulnerable","The official installation guide documents PHP web settings and console execution for marketing automation.","https://docs.mautic.org/en/7.0/getting_started/how_to_install_mautic.html"],["MediaWiki project","MediaWiki","","Vulnerable","Vulnerable","MediaWiki explicitly requires PHP, lists native modules and distinguishes recommended modules from a 32-bit arithmetic alternative.","https://www.mediawiki.org/wiki/Manual:Installation_requirements"],["MessageBird","MessageBird PHP REST API client","","Investigation","Investigation","The publisher client requires PHP >=8.0, curl/json and Firebase JWT support.","https://packagist.org/packages/messagebird/php-rest-api"],["Metaways / tine project","tine groupware","","Vulnerable","Vulnerable","The project requires PHP for the groupware server and lists mandatory and optional modules separately from browser/native clients.","https://docs.tine-groupware.de/main/operators/System_Requirements/"],["Microsoft","Azure App Service PHP on Linux","","Investigation","Investigation","Microsoft documents Linux PHP workloads and explicitly says Windows PHP support ended in November2022.","https://learn.microsoft.com/en-us/azure/app-service/configure-language-php"],["Microsoft Azure Storage","Microsoft Azure Storage PHP blob client package (retired)","","Investigation","Investigation","The published blob package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","https://packagist.org/packages/microsoft/azure-storage-blob"],["Microsoft Azure Storage","Microsoft Azure Storage PHP common client package (retired)","","Investigation","Investigation","The published common package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","https://packagist.org/packages/microsoft/azure-storage-common"],["Microsoft Azure Storage","Microsoft Azure Storage PHP file client package (retired)","","Investigation","Investigation","The published file package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","https://packagist.org/packages/microsoft/azure-storage-file"],["Microsoft Azure Storage","Microsoft Azure Storage PHP queue client package (retired)","","Investigation","Investigation","The published queue package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","https://packagist.org/packages/microsoft/azure-storage-queue"],["Microsoft Azure Storage","Microsoft Azure Storage PHP table client package (retired)","","Investigation","Investigation","The published table package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","https://packagist.org/packages/microsoft/azure-storage-table"],["Microsoft Graph Client Tooling","Microsoft Graph PHP SDK","","Investigation","Investigation","The SDK declares PHP ^8.2 and microsoft/microsoft-graph-core ^3.0.0 for caller-side Graph access.","https://packagist.org/packages/microsoft/microsoft-graph"],["MISP project / CIRCL","MISP 2.5 core PHP server","","Vulnerable","Vulnerable","Official requirements distinguish mandatory PHP extensions from recommended modules for MISP2.5.","https://www.circl.lu/doc/misp/requirements/"],["Mockery project","Mockery PHP test-double framework","","Investigation","Investigation","Publisher metadata for mockery/mockery 1.6.15 declares PHP >=7.3 for this tool/library.","https://packagist.org/packages/mockery/mockery"],["MODX project","MODX Revolution","","Vulnerable","Vulnerable","The guide says MODX is written in PHP and lists the 3.2+ PHP 8.1 floor and required modules.","https://docs.modx.com/3.x/en/getting-started/server-requirements"],["Mollie","Mollie Payments for WooCommerce","","Investigation","Investigation","The publisher's listing requires PHP, cURL and JSON and documents merchant API keys and payment-status webhooks.","https://wordpress.org/plugins/mollie-payments-for-woocommerce/"],["Mollie B.V.","Mollie API PHP client","","Investigation","Investigation","Mollie's PHP client declares PHP ^8.2, curl/json/openssl and PSR transport interfaces. A separate Mollie OAuth package is suggested for some endpoints.","https://packagist.org/packages/mollie/mollie-api-php"],["MongoDB PHP driver team","MongoDB native PHP driver extension","","Investigation","Investigation","PECL identifies the native glue layer and native-library updates; the PHP manual supplies a version-qualified family minimum and default bundled/native options. Userland mongodb/mongodb requirements remain separate.","https://pecl.php.net/package/mongodb/2.5.0"],["MongoDB PHP driver team","MongoDB PHP userland library","","Investigation","Investigation","The userland library requires PHP ^8.1 and ext-mongodb ^2.5; its metadata replaces mongodb/builder.","https://packagist.org/packages/mongodb/mongodb"],["Monica project","Monica","","Investigation","Investigation","The official Monica Composer manifest declares PHP ^8.3 for the personal CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/monicahq/monica/blob/main/composer.json"],["Montala / ResourceSpace","ResourceSpace","","Vulnerable","Vulnerable","The vendor identifies PHP as the server language, gives per-release bands and required distro packages, and separates external media tools.","https://www.resourcespace.com/knowledge-base/systemadmin/general_requirements?from_rs=true"],["Moodle project","Moodle","","Vulnerable","Vulnerable","Official 5.3 notes specify PHP 8.3.0+, additional 8.4.x support, sodium and 64-bit PHP. The download catalogue separates the 5.3 release from weekly 5.3+ packages and publishes a release checksum.","https://moodledev.io/general/releases/5.3"],["Moodle project / complete-installer packagers","Moodle Windows complete installer family","","Investigation","Investigation","Moodle publishes Windows installers containing Apache, MySQL and PHP, built using XAMPP. Its catalogue warns of component requirements mismatches and against production use.","https://download.moodle.org/windows/"],["Moodle project / Ralf Krause","Moodle4Mac complete installer family","","Investigation","Investigation","Moodle publishes MAMP-based installers containing Apache, MySQL and PHP. The linked guide restricts them to local testing/development and documents modified environment checks.","https://download.moodle.org/macosx/"],["msgpack-php project","MessagePack native PHP serialization extension","","Investigation","Investigation","The official catalogue describes a PHP MessagePack API and declares the selected 3.0.1 release minimum.","https://pecl.php.net/package/msgpack"],["MyBB Group","MyBB","","Vulnerable","Vulnerable","The official MyBB 1.8 installation requirements identify PHP and three named extensions plus a selected database driver.","https://docs.mybb.com/1.8/install/requirements/"],["MyBB Group","MyBB Merge System","","Investigation","Investigation","The official requirements name Merge System separately from the running MyBB forum and require PHP for the migration tool.","https://docs.mybb.com/1.8/install/requirements/"],["N-able","Mail Assure / Spam Experts","","Investigation","Investigation","N-able lists Mail Assure / Spam Experts among products receiving emergency maintenance and updates for php2shell.","https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],["N-able","N-sight","","Investigation","Investigation","N-able lists N-sight among products receiving emergency maintenance and updates for php2shell.","https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],["N-able","Passportal","","Investigation","Investigation","N-able lists Passportal among products receiving emergency maintenance and updates for php2shell.","https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],["N-able","Take Control Session routing","","Investigation","Investigation","N-able scoped emergency php2shell maintenance to Take Control session routing rather than the whole Take Control product family.","https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],["Nagios Enterprises","Nagios Fusion web component subsystem","","Vulnerable","Vulnerable","The vendor explains how PHP component files are included during Fusion application instantiation and register web-page callbacks.","https://assets.nagios.com/downloads/nagiosfusion/guides/developer/components.php"],["Nagios Enterprises","Nagios XI web configuration-wizard subsystem","","Vulnerable","Vulnerable","The official development guide identifies PHP scripts and callback functions loaded by the XI configuration-wizard interface.","https://assets.nagios.com/downloads/nagiosxi/docs/Writing-Custom-Wizards-2024.pdf"],["Neos project","Neos CMS","","Vulnerable","Vulnerable","Neos publishes a Neos/Flow/PHP matrix and requires matching web and CLI PHP versions for class precompilation.","https://docs.neos.io/guide/installation-development-setup/system-requirements"],["Netgate / pfSense","pfSense management components","","Investigation","Investigation","Netgate explicitly identifies the legacy GUI as PHP, the new Plus GUI as Go, and continued availability of both during transition. Nexus controller options are separately enabled.","https://www.netgate.com/blog/the-new-gui-for-pfsense-plus"],["Netlify","Netlify PHP build environment and Composer integration","","Investigation","Investigation","Netlify documents PHP_VERSION for building a site and Composer handling when composer.json is present.","https://docs.netlify.com/build/configure-builds/manage-dependencies/"],["Nette community","Nette Application","","Investigation","Investigation","MVC kernel and application request dispatch are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/application"],["Nette community","Nette Assets","","Investigation","Investigation","PHP-side asset mapping, versioning and storage integration are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/assets"],["Nette community","Nette Bootstrap","","Investigation","Investigation","PHP application bootstrap and configuration loading are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/bootstrap"],["Nette community","Nette Caching","","Investigation","Investigation","PHP caching abstractions and selected storage are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/caching"],["Nette community","Nette Command Line","","Investigation","Investigation","PHP command-line interface utilities are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/command-line"],["Nette community","Nette Database","","Investigation","Investigation","PHP database access and abstraction are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/database"],["Nette community","Nette DI","","Investigation","Investigation","PHP dependency injection and container compilation are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/di"],["Nette community","Nette Forms","","Investigation","Investigation","Server PHP form handling and validation are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/forms"],["Nette community","Nette HTTP","","Investigation","Investigation","PHP requests, uploaded-file handling, URLs and sessions are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/http"],["Nette community","Nette Mail","","Investigation","Investigation","PHP mail construction and sending are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/mail"],["Nette community","Nette PHP Generator","","Investigation","Investigation","PHP source generation and optional source-body parsing are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/php-generator"],["Nette community","Nette RobotLoader","","Investigation","Investigation","PHP class discovery, source analysis, autoloading and cache are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/robot-loader"],["Nette community","Nette SafeStream","","Investigation","Investigation","PHP safe/atomic file stream handling are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/safe-stream"],["Nette community","Nette Security","","Investigation","Investigation","PHP authentication, authorization and ACL handling are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/security"],["Nette community","Nette Utils","","Investigation","Investigation","PHP utility functions and selected image/string/JSON helpers are implemented in this independently identifiable PHP package.","https://packagist.org/packages/nette/utils"],["Nette community / Latte","Latte template engine","","Investigation","Investigation","PHP template compilation and rendering are implemented in this independently identifiable PHP package.","https://packagist.org/packages/latte/latte"],["Nette community / Tracy","Tracy debugger","","Investigation","Investigation","PHP debugging, diagnostics and error handling are implemented in this independently identifiable PHP package.","https://packagist.org/packages/tracy/tracy"],["Nette Foundation / Nette community","Nette framework metapackage","","Vulnerable","Vulnerable","Nette 3.3.0 is a metapackage with a finite seventeen-name direct runtime package list; each name was independently checked for PHP use.","https://packagist.org/packages/nette/nette"],["Nextcloud","Nextcloud Office integration app","","Investigation","Investigation","The official integration app has PHP runtime dependencies distinct from its development tools and the external document-editing server.","https://github.com/nextcloud/richdocuments/blob/main/composer.json"],["Nextcloud","Nextcloud Server","","Vulnerable","Vulnerable","Nextcloud confirms that deployments using affected PHP are at risk and points operators to fixed PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.","https://github.com/nextcloud/server/wiki/Releases-and-PHP-versions/d90292c6b2f2d0707fc61571364185fa311525bb"],["Nextcloud","Nextcloud Talk server app","","Investigation","Investigation","The official application manifest contains a production PHP namespace/autoload tree and runtime dependencies, distinct from development tools.","https://github.com/nextcloud/spreed/blob/main/composer.json"],["Nextcloud Calendar project","Nextcloud Calendar server app","","Investigation","Investigation","The prior release-publisher version pin is retained. A dated official FreeBSD ports commit independently records Calendar 6.6.2 and its advertised source-archive checksum; it does not supply the missing app/core PHP compatibility pair.","https://lists.freebsd.org/archives/dev-commits-ports-main/2026-October/215291.html"],["Nextcloud Collectives project","Nextcloud Collectives server app","","Investigation","Investigation","The official manifest separates PHP runtime requirements and collaboration libraries from development-only DOM and test tools.","https://github.com/nextcloud/collectives/blob/main/composer.json"],["Nextcloud Contacts project","Nextcloud Contacts server app","","Investigation","Investigation","The official app manifest declares its PHP runtime constraint separately from development dependencies and the Composer platform target.","https://github.com/nextcloud/contacts/blob/main/composer.json"],["Nextcloud Deck project","Nextcloud Deck","","Investigation","Investigation","The official repository explicitly documents PHP dependency installation and PHP tooling for the Deck app.","https://github.com/nextcloud/deck"],["Nextcloud Docker community volunteers / Docker Official Images","Nextcloud community Docker image distribution","","Investigation","Investigation","The repository distinguishes community maintenance from Nextcloud GmbH AIO, and explicitly bases its FPM variant on php-fpm.","https://github.com/nextcloud/docker"],["Nextcloud GmbH / Nextcloud AIO maintainers","Nextcloud AIO Nextcloud application container","","Vulnerable","Vulnerable","Nextcloud AIO maintainers confirm affected PHP base images and report that rebuilt images depend on upstream PHP image publication; a fixed AIO release is not yet confirmed.","https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile"],["Nextcloud Mail project","Nextcloud Mail server app","","Investigation","Investigation","The app manifest declares PHP and OpenSSL plus separate mail-processing libraries; its README requires a Nextcloud server and PHP dependency management.","https://github.com/nextcloud/mail/blob/main/composer.json"],["Nextcloud Notes project","Nextcloud Notes","","Investigation","Investigation","The official Notes manifest confirms PHP development tooling and distinguishes require-dev from a Composer resolution target.","https://github.com/nextcloud/notes/blob/main/composer.json"],["Nextcloud Snap maintainers","Nextcloud Snap bundled PHP runtime","","Investigation","Investigation","The Snap recipe has an explicit PHP autotools part with FPM enabled and separate Redis6.3.0/APCu5.1.28 extension builds.","https://github.com/nextcloud-snap/nextcloud-snap/blob/master/snap/snapcraft.yaml"],["NextcloudPi project / Nextcloud community","NextcloudPi turnkey PHP stack","","Investigation","Investigation","The NextcloudPi feature list explicitly includes PHP 8.1, Apache, APCu and Zend OPcache file cache.","https://github.com/nextcloud/nextcloudpi"],["Nikita Popov / PHP-Parser contributors","PHP-Parser userland parser","","Investigation","Investigation","PHP-Parser is implemented in PHP and declares native tokenizer/json requirements for parsing source into an abstract syntax tree.","https://packagist.org/packages/nikic/php-parser"],["NixOS / Nixpkgs maintainers","Nixpkgs PHP runtime environments","","Investigation","Investigation","Nixpkgs documents a minimal PHP base wrapped with selected extensions and generated php.ini; PHP-built tools inherit their owning runtime.","https://nixos.org/manual/nixpkgs/stable/"],["Observium Limited / Observium project","Observium","","Vulnerable","Vulnerable","The official installation guide explicitly provisions both the PHP web SAPI and command-line runtime.","https://docs.observium.org/install_debian/"],["October CMS project","October CMS","","Vulnerable","Vulnerable","The 4.x guide explicitly calls October a PHP web application and requires PHP 8.2 with named modules.","https://docs.octobercms.com/4.x/setup/installation.html"],["Open eClass project / GUnet","Open eClass","","Vulnerable","Vulnerable","The 4.1 installation page requires PHP and names modules; it explicitly says the current package does not include phpMyAdmin.","https://docs.openeclass.org/en/4.1/install"],["Open Social project","Open Social Drupal installation profile","","Investigation","Investigation","The official repository manifest identifies a drupal-profile and explicitly declares PHP ^8.3 and Drupal core dependencies.","https://github.com/goalgorilla/open_social/blob/main/composer.json"],["Open Web Analytics project","Open Web Analytics","","Vulnerable","Vulnerable","The official analytics application manifest explicitly requires PHP and a Composer merge plugin for module requirements.","https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/master/composer.json"],["OpenBSD ports maintainers / PHP documentation team","OpenBSD optional PHP package and ports family","","Investigation","Investigation","PHP documentation confirms split optional OpenBSD packages; dated7.9 release notes list four PHP source-version families.","https://www.php.net/manual/en/install.unix.openbsd.php"],["OpenCart project","OpenCart","","Vulnerable","Vulnerable","Publisher package metadata for 4.1.0.4 explicitly requires PHP >=8.1.0. The official repository describes the PHP server and runtime modules.","https://packagist.org/packages/opencart/opencart"],["OpenConext / SURF","OpenConext EngineBlock SAML proxy","","Vulnerable","Vulnerable","The SAML proxy manifest declares PHP ^8.5 and runtime extensions.","https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json"],["OpenDocMan project","OpenDocMan","","Vulnerable","Vulnerable","The source manifest requires PHP, while official README and website requirements show different generations of guidance.","https://github.com/opendocman/opendocman/blob/master/composer.json"],["OpenEMR project","OpenEMR","","Investigation","Investigation","The official OpenEMR Composer manifest pins its platform runtime to PHP 8.3 and lists required PHP extensions.","https://github.com/openemr/openemr/blob/master/composer.json"],["OpenMage project","OpenMage","","Vulnerable","Vulnerable","Official requirements establish PHP and intl. Publisher registry metadata separately identifies OpenMage as a Magento-1 fork.","https://docs.openmage.org/users/requirements/"],["openmediavault project","openmediavault PHP management backend","","Investigation","Investigation","The official web GUI deployment state configures a dedicated PHP-FPM pool running as openmediavault-webgui.","https://github.com/openmediavault/openmediavault/blob/master/deb/openmediavault/srv/salt/omv/deploy/phpfpm/10webgui.sls"],["OpenSearch Contributors; inherited Elastic client lineage","OpenSearch PHP client","","Investigation","Investigation","The PHP client declares PHP ^8.2, curl/json and PSR HTTP implementations. AWS SDK is suggested for the signing decorator and appears in require-dev.","https://packagist.org/packages/opensearch-project/opensearch-php"],["OpenSwoole project","OpenSwoole native PHP extension","","Investigation","Investigation","The release declares PHP >=8.3 and documents its native Zend Fiber integration.","https://pecl.php.net/package/openswoole/26.2.0"],["OpenWrt packages feed maintainers","OpenWrt selectable PHP8 package family","","Investigation","Investigation","OpenWrt recipe separates configuration, runtime binaries, startup integration and extension modules, rather than bundling an interpreter in every php8 package.","https://github.com/openwrt/packages/blob/master/lang/php8/Makefile"],["OPNsense / Deciso","OPNsense WebGUI and API","","Investigation","Investigation","Versioned release entries distinguish the PHP8.5.11/Phalcon5.22.1 declaration in26.7.6 from the newer26.7.7 release identity; no patch payload is inferred from absence of a changed-package line.","https://docs.opnsense.org/releases/CE_26.7.html"],["OrangeHRM Inc.","OrangeHRM Starter","","Vulnerable","Vulnerable","The edition-labelled Starter repository links to vendor prerequisites that explicitly install the PHP web environment.","https://starterhelp.orangehrm.com/hc/en-us/articles/6187572000540-Prerequisites-for-installing-OrangeHRM-Starter-in-Linux"],["Oro Inc.","OroCommerce","","Vulnerable","Vulnerable","The vendor separates server PHP/CLI and extension requirements from client-side browsers, cookies and JavaScript.","https://doc.oroinc.com/backend/setup/system-requirements/"],["Oro, Inc.","OroCRM Community Edition application","","Vulnerable","Vulnerable","The product-specific package metadata confirms PHP for the CRM Community application and distinguishes it from Enterprise, Commerce and Platform distributions.","https://packagist.org/packages/oro/crm-application"],["osCommerce","osCommerce 4","","Vulnerable","Vulnerable","The vendor explicitly states that its V4 commerce platform uses PHP 8.3 and also supports older PHP from 7.4.","https://www.oscommerce.com/"],["osCommerce legacy project","osCommerce Online Merchant 2.3","","Vulnerable","Vulnerable","The archived v2.3 manual requires a PHP-enabled web server and describes compatibility with PHP 4/5.","https://library.oscommerce.com/Online&en&oscom_2_3&getting_started&requirements"],["OVHcloud","OVHcloud webhosting PHP / .ovhconfig runtime","","Investigation","Investigation","OVHcloud documents PHP hosting families, environment/architecture boundaries and provider versus website-owner responsibilities.","https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/configure-your-web-hosting"],["ownCloud / Kiteworks","ownCloud Classic 11","","Vulnerable","Vulnerable","The vendor's 11.0 guide confirms that supported Docker installations include PHP 8 and Apache and replace native Linux installation.","https://doc.owncloud.com/server/11.0/admin_manual/installation/installing_with_docker.html"],["ownCloud / Kiteworks","ownCloud Server 10","","Vulnerable","Vulnerable","The versioned vendor requirements identify PHP 7.4 for the classic server branch.","https://doc.owncloud.com/server/10.16/admin_manual/installation/system_requirements.html"],["OXID eSales","OXID eShop","","Vulnerable","Vulnerable","The 7.3 vendor requirements name PHP 8.2-8.4 and required modules for the documented eShop editions.","https://docs.oxid-esales.com/eshop/de/7.3/installation/neu-installation/server-und-systemvoraussetzungen.html"],["Palo Alto Networks","PAN-OS","All PAN-OS versions listed affected; fixed releases not yet announced","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing"],["Palo Alto Networks","Panorama","All Panorama versions listed affected; fixed releases not yet announced","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing"],["Pantheon","Pantheon managed PHP application runtime","","Investigation","Investigation","Pantheon documents current PHP families and separately describes legacy7.4 availability.","https://docs.pantheon.io/guides/php"],["ParaTest / Brian Scaturro, Filippo Tessarotto and contributors","ParaTest parallel PHPUnit runner","","Investigation","Investigation","Publisher metadata for brianium/paratest v7.27.2 declares PHP ~8.4.0 \\",""],["Part-DB project","Part-DB server","","Vulnerable","Vulnerable","The official server manifest declares PHP and direct native modules; README separates server execution from Node/yarn browser-asset building.","https://github.com/Part-DB/Part-DB-server/blob/master/composer.json"],["Passbolt SA","Passbolt API server","Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://www.passbolt.com/docs/hosting/install/ce/from-source/"],["PayPal","PayPal Server SDK for PHP","","Investigation","Investigation","The PHP Server SDK requires curl/json and APIMatic support packages. Its README names five supported controller groups.","https://packagist.org/packages/paypal/paypal-server-sdk"],["PCOV / Joe Watkins and contributors","PCOV PHP native code-coverage driver","","Investigation","Investigation","The official release catalogue requires PHP for PCOV; upstream documents enabled versus disabled executor hooks.","https://pecl.php.net/package/pcov"],["PeachPie / iolevel","PeachPie PHP compiler and .NET runtime","","Investigation","Investigation","PeachPie compiles PHP programs to assemblies using its reimplemented .NET runtime.","https://docs.peachpie.io/about/"],["PeachPie / WpDotNet project","WpDotNet compiled WordPress on PeachPie","","Investigation","Investigation","The release announcement describes WpDotNet executing compiled WordPress without a php executable.","https://www.peachpie.io/blog/2024/08/22/peachpie-1110/"],["PEAR project / PHP Group","PEAR Base System","","Investigation","Investigation","The official PEAR package page identifies the installer/base PHP error-handling classes and published version/runtime dependencies.","https://pear.php.net/package/PEAR"],["PECL XHProf / longxinH and contributors","XHProf native PHP collection extension","","Investigation","Investigation","The release page separates a C data-collection extension from an all-PHP reporting layer.","https://pecl.php.net/package/xhprof/2.3.10"],["PECL XHProf / longxinH and contributors","XHProf PHP reporting and navigation UI","","Investigation","Investigation","The publisher explicitly states that XHProf reporting/UI is PHP, distinct from the native collector.","https://pecl.php.net/package/xhprof/2.3.10"],["PestPHP / Nuno Maduro and contributors","Pest PHP testing framework","","Investigation","Investigation","Publisher metadata for pestphp/pest v5.3.2 declares PHP ^8.4 for this tool/library.","https://packagist.org/packages/pestphp/pest"],["Phalcon project","Phalcon framework PHP extension","","Vulnerable","Vulnerable","Official installation guides describe Phalcon as a compiled PHP extension, with distinct web/CLI loading and feature-specific companion modules.","https://docs.phalcon.io/5.23/installation/"],["PHAR.io / Arne Blankerts, Sebastian Heuer and contributors","Phive PHAR installation and verification tool","","Investigation","Investigation","Publisher metadata for phar-io/phive 0.16.0 declares PHP ^8.0 for this tool/library.","https://packagist.org/packages/phar-io/phive"],["Phillips Data / Blesta","Blesta billing platform","","Vulnerable","Vulnerable","Versioned vendor requirements explicitly identify PHP, encoded-code loader and native extensions for the billing platform.","https://docs.blesta.com/installation/"],["Phing project / Michiel Rook and contributors","Phing PHP build system","","Investigation","Investigation","Publisher metadata for phing/phing 3.1.2 declares PHP >=8.1 for this tool/library.","https://packagist.org/packages/phing/phing"],["PHP CS Fixer project","PHP CS Fixer","","Investigation","Investigation","The selected fixer release declares PHP and direct modules; official docs distinguish Composer/shim, PHAR and image use.","https://packagist.org/packages/friendsofphp/php-cs-fixer"],["PHP CS Fixer project","PHP CS Fixer official PHP container image family","","Investigation","Investigation","The installation guide documents PHP-version-qualified fixer images for local, GitHub and GitLab CI use.","https://cs.symfony.com/doc/installation.html"],["PHP Depend project","PHP Depend source-metrics analyzer","","Investigation","Investigation","Publisher metadata for pdepend/pdepend 3.0.0 declares PHP >=8.1 with php-64bit capability for this tool/library.","https://packagist.org/packages/pdepend/pdepend"],["PHP Ev extension project","Ev native PHP libev binding","","Investigation","Investigation","The selected release exposes libev event-loop functionality to PHP and declares a PHP minimum.","https://pecl.php.net/package/ev/1.2.3"],["PHP Event extension project","Event native PHP libevent binding","","Investigation","Investigation","The selected release exposes native libevent scheduling APIs. The PHP manual makes OpenSSL conditional on OpenSSL features.","https://pecl.php.net/package/event/3.1.6"],["PHP Gearman extension project","Gearman native PHP client and worker extension","","Investigation","Investigation","Selected 2.2.1 exposes libgearman clients/workers and declares PHP 7.2.0 through 8.6.99.","https://pecl.php.net/package/gearman/2.2.1"],["PHP gnupg extension project","GnuPG native PHP GPGME binding","","Investigation","Investigation","Selected release identifies a GPGME binding and fixes PHP 8.5 and GPGME 2.0 build compatibility.","https://pecl.php.net/package/gnupg/1.5.4"],["PHP Mailparse extension project","Mailparse native PHP MIME parser extension","","Investigation","Investigation","The selected release parses RFC822/MIME messages and still lists mbstring. The official installation manual requires mbstring to load first.","https://pecl.php.net/package/mailparse/3.2.0"],["PHP OAuth extension project","OAuth native PHP consumer extension","","Investigation","Investigation","The selected release identifies an OAuth consumer extension and requires hash, now part of PHP core.","https://pecl.php.net/package/oauth/2.0.10"],["PHP SSH2 extension project","SSH2 native PHP client binding","","Investigation","Investigation","The release provides PHP bindings to libssh2 for SSH2 and declares a PHP minimum.","https://pecl.php.net/package/ssh2/1.5.0"],["PHP YAML extension project","YAML native PHP parser and emitter extension","","Investigation","Investigation","The selected release provides YAML 1.1 parsing/emission using LibYAML. The catalogue names date but does not render required/optional classification.","https://pecl.php.net/package/yaml/2.3.0"],["php-amqp project","AMQP native PHP messaging client extension","","Investigation","Investigation","The release provides AMQP 0-9-1 client APIs. The official project documents native librabbitmq requirements separately from the test broker.","https://pecl.php.net/package/amqp/2.2.0"],["PHP-FIG","PSR logging interfaces package","","Investigation","Investigation","The package distributes PHP interfaces/classes/traits for PSR-3 and explicitly does not provide a logger implementation.","https://packagist.org/packages/psr/log"],["php-memcached project","Memcached native PHP client extension","","Investigation","Investigation","PECL identifies the libmemcached-based PHP client. The official 3.x README explicitly makes igbinary/msgpack serializer support optional, despite the flat PECL dependency list.","https://pecl.php.net/package/memcached/3.4.0"],["PHP-PM project","PHP-PM process manager","","Investigation","Investigation","The release declares PHP and pcntl and describes retaining application bootstraps in worker processes.","https://packagist.org/packages/php-pm/php-pm"],["php-rdkafka project","rdkafka native PHP Kafka client extension","","Investigation","Investigation","The selected stable release is a librdkafka-based PHP client. The catalogue separately lists 7.0.0alpha1 with a higher PHP minimum.","https://pecl.php.net/package/rdkafka/6.0.5"],["Phpactor project","Phpactor PHP language server and refactoring tool","","Investigation","Investigation","Phpactor's manifest requires PHP ^8.2, mbstring, posix and tokenizer. Its README describes language-server/refactoring functionality and Linux/macOS or WSL.","https://packagist.org/packages/phpactor/phpactor"],["phpBB Limited / phpBB project","phpBB","","Vulnerable","Vulnerable","The publisher package declares PHP and direct extensions for its displayed 4.0 alpha release, with separate runtime and development dependencies.","https://packagist.org/packages/phpbb/phpbb"],["PHPBench / Daniel Leech and contributors","PHPBench benchmarking framework","","Investigation","Investigation","Publisher metadata for phpbench/phpbench 1.7.0 declares PHP ^8.2 for this tool/library.","https://packagist.org/packages/phpbench/phpbench"],["PHPCSStandards / PHP_CodeSniffer project","PHP_CodeSniffer and PHP Code Beautifier/Fixer","","Investigation","Investigation","Publisher metadata for squizlabs/php_codesniffer 4.0.4 declares PHP >=7.2.0 for this tool/library.","https://packagist.org/packages/squizlabs/php_codesniffer"],["phpDocumentor project","phpDocumentor documentation generator","","Investigation","Investigation","Publisher metadata for phpdocumentor/phpdocumentor v3.10.0 declares PHP ^8.1 for this tool/library.","https://packagist.org/packages/phpdocumentor/phpdocumentor"],["phpIPAM project","phpIPAM","","Vulnerable","Vulnerable","The project supplies branch-specific PHP ranges and separately documents PHP modules and optional CLI functions.","https://github.com/phpipam/phpipam"],["phpLDAPadmin / leenooks project","phpLDAPadmin","","Vulnerable","Vulnerable","The current source manifest explicitly requires PHP and LDAP-related extensions for the directory administration web application.","https://github.com/leenooks/phpLDAPadmin/blob/master/composer.json"],["phpList project","phpList","","Vulnerable","Vulnerable","The official requirements explicitly identify PHP and warn that some functionality/modules and plugin requirements are conditional.","https://resources.phplist.com/system/start"],["PHPMailer project","PHPMailer","","Investigation","Investigation","The PHP mail creation/transport class declares three direct extension requirements and feature-specific mail/encoding integrations.","https://packagist.org/packages/phpmailer/phpmailer"],["PHPMD project","PHPMD PHP Mess Detector","","Investigation","Investigation","Publisher metadata for phpmd/phpmd 3.0.0 declares PHP ^8.1 for this tool/library.","https://packagist.org/packages/phpmd/phpmd"],["phpMyAdmin project","phpMyAdmin","","Vulnerable","Vulnerable","Registry metadata provides a release-specific PHP/module subset while the development manual separates optional archive/media/authentication features.","https://docs.phpmyadmin.net/en/latest/require.html"],["phpMyFAQ project","phpMyFAQ","","Investigation","Investigation","The official phpMyFAQ Composer manifest declares PHP >=8.4.0, and the release process documents signed CycloneDX SBOM publication.","https://github.com/thorsten/phpMyFAQ/blob/main/composer.json"],["phpPgAdmin project","phpPgAdmin","","Vulnerable","Vulnerable","The official application manifest explicitly declares PHP and the PostgreSQL PHP extension.","https://github.com/phppgadmin/phppgadmin/blob/master/composer.json"],["PhpRedis project / Michael Grunder and contributors","PhpRedis native PHP client extension","","Investigation","Investigation","The develop build declarations make native compression conditional. The installation guide distinguishes optional serializer builds from the feature-limited initial Windows PIE binaries.","https://pecl.php.net/package/redis/6.3.0"],["PHPro / GrumPHP contributors","GrumPHP Git quality-check orchestration","","Investigation","Investigation","Publisher metadata for phpro/grumphp v2.26.0 declares PHP ~8.2.0 \\",""],["phpseclib project","phpseclib","","Investigation","Investigation","The library implements cryptography and secure communications in PHP; native crypto acceleration and XML-key features are optional.","https://packagist.org/packages/phpseclib/phpseclib"],["PhpSpec project","PhpSpec specification test runner","","Investigation","Investigation","Publisher metadata for phpspec/phpspec 9.0.0-rc.4.4 declares PHP 8.3.* \\",""],["PHPStan / Ondrej Mirtes and contributors","PHPStan static analyzer","","Investigation","Investigation","Publisher metadata for phpstan/phpstan 2.3.1 declares PHP ^7.4\\",""],["PHPStan project","PHPStan PHPDoc parser library","","Investigation","Investigation","Publisher metadata for phpstan/phpdoc-parser 2.3.6 declares PHP ^7.4 \\",""],["PHPUnit project","PHPUnit test framework","","Investigation","Investigation","PHPUnit is a PHP CLI test runner; release-specific metadata refines broad manual requirements.","https://packagist.org/packages/phpunit/phpunit"],["PHPUnit project / Sebastian Bergmann","PHPUnit PHP code-coverage library","","Investigation","Investigation","Publisher metadata for phpunit/php-code-coverage 14.4.1 declares PHP >=8.4 for this tool/library.","https://packagist.org/packages/phpunit/php-code-coverage"],["phpVirtualBox project","phpVirtualBox server-side administration application","","Vulnerable","Vulnerable","The project describes a PHP web administration interface for VirtualBox.","https://github.com/phpvirtualbox/phpvirtualbox"],["Pi-hole project","Pi-hole v5 legacy PHP web interface","","Vulnerable","Vulnerable","Pi-hole's version6 announcement explicitly removes the former lighttpd/PHP dependency.","https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/"],["Pimcore project","Pimcore Platform","","Vulnerable","Vulnerable","Versioned platform requirements list PHP 8.5+ for 2026.2; the 2025.1 page specifies PHP 8.3/8.4.","https://docs.pimcore.com/platform/2026.2/Getting_Started/Installation/System_Requirements/"],["Plesk","Plesk for Linux","All shipped PHP versions","Vulnerable","Vulnerable","Plesk confirms that all PHP versions shipped with Plesk for Linux are affected; patched versions are pending a PHP vendor fix.","https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],["Plesk","Plesk for Windows","All shipped PHP versions","Vulnerable","Vulnerable","Plesk confirms that all PHP versions shipped with Plesk for Windows are affected; patched versions are pending a PHP vendor fix.","https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],["Plesk","Plesk Obsidian hosted-site PHP","","Vulnerable","Vulnerable","Plesk confirms hosted PHP remains affected in aggregate: Linux fixes are available for PHP 8.2-8.5, while Linux EOL branches and Windows builds remain affected.","https://docs.plesk.com/release-notes/obsidian/change-log/"],["Plesk","Plesk plesk-engine internal PHP management runtime for Windows","","Vulnerable","Vulnerable","Plesk confirms that all versions of the Windows internal UI engine component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.","https://docs.plesk.com/release-notes/obsidian/change-log/"],["Plesk","Plesk sw-engine internal PHP management runtime","","Vulnerable","Vulnerable","Plesk confirms that all versions of the Linux sw-engine internal UI component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.","https://docs.plesk.com/release-notes/obsidian/change-log/"],["PluXml project","PluXml 5.8 documented branch","","Vulnerable","Vulnerable","The PluXml 5.8 installation guide requires a PHP interpreter and GD for images.","https://wiki.pluxml.org/docs/install/install.html"],["PmWiki project","PmWiki","","Vulnerable","Vulnerable","The project requires PHP on the web server and describes its PHP compatibility range.","https://www.pmwiki.org/wiki/PmWiki/Requirements"],["PostfixAdmin project","PostfixAdmin","","Vulnerable","Vulnerable","The project identifies a PHP-capable web application used to administer virtual users for a separate Postfix mail server.","https://github.com/postfixadmin/postfixadmin"],["Predis project / Till Kruss and contributors","Predis PHP Redis and Valkey client","","Investigation","Investigation","Predis declares PHP compatibility and a PSR message interface; Relay is suggested as an optional faster connection implementation.","https://packagist.org/packages/predis/predis"],["PrestaShop project","PrestaShop","","Vulnerable","Vulnerable","The version-9 requirements identify PHP, required modules and separate compatibility bands for 9.0 and 9.1.","https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/"],["PrivateBin project","PrivateBin","","Vulnerable","Vulnerable","The official manifest requires PHP; the project separately states that paste encryption/decryption occurs in the browser.","https://github.com/PrivateBin/PrivateBin/blob/master/composer.json"],["ProcessWire project","ProcessWire CMS","","Vulnerable","Vulnerable","Official requirements list PHP 8.x as recommended, PHP 7.x compatibility, and image-processing support.","https://processwire.com/about/requirements/"],["ProjectSend project","ProjectSend","","Vulnerable","Vulnerable","The current source installation guide lists PHP web/CLI requirements; LDAP is required even without configured LDAP use.","https://github.com/projectsend/projectsend/blob/main/INSTALL.md"],["Prophecy / PhpSpec project","Prophecy PHP mocking library","","Investigation","Investigation","Publisher metadata for phpspec/prophecy v1.26.1 declares PHP 8.2.* \\",""],["Psalm project / Daniil Gentili","Psalm official custom-PHP container image","","Investigation","Investigation","Psalm's official installation guide describes an image containing a custom PHP build and its analyzer.","https://psalm.dev/docs/running_psalm/installation/"],["Psalm project / Matthew Brown, Daniil Gentili and contributors","Psalm PHP static analyzer","","Investigation","Investigation","Publisher metadata for vimeo/psalm 7.0.0-rc2 declares PHP ~8.1.31 \\",""],["PsySH / Justin Hileman and contributors","PsySH interactive PHP shell","","Investigation","Investigation","Publisher metadata for psy/psysh v0.12.24 declares PHP ^8.0 \\",""],["Pterodactyl project","Pterodactyl Panel PHP application","","Vulnerable","Vulnerable","The Panel manifest declares PHP, Laravel and required PHP extensions for the management application.","https://github.com/pterodactyl/panel/blob/1.0-develop/composer.json"],["Public Knowledge Project (PKP)","Open Journal Systems","","Vulnerable","Vulnerable","The official OJS README requires PHP and supplies a platform-check example while warning that its sample version numbers are not minimum versions.","https://github.com/pkp/ojs/blob/main/README.md"],["Public Knowledge Project (PKP)","Open Monograph Press","","Vulnerable","Vulnerable","The official OMP README requires PHP and distinguishes PHP platform requirements from illustrative module version numbers.","https://github.com/pkp/omp"],["Public Knowledge Project (PKP)","Open Preprint Systems","","Vulnerable","Vulnerable","The official OPS README requires PHP for the preprint server and identifies web-versus-CLI configuration differences.","https://github.com/pkp/ops"],["Pydio","Pydio 8 Enterprise Distribution","","Vulnerable","Vulnerable","The vendor's legacy Enterprise guide explicitly requires PHP, modules and ionCube, and recommends a PHP CLI path.","https://docs.pydio.com/pydio-v8/admin-guide/installation-guide/pydio-requirements/"],["QloApps","QloApps","","Investigation","Investigation","The official QloApps repository identifies a hotel management and reservation platform with PHP application code, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/Qloapps/QloApps"],["QNAP","QNAP PHP7.4 optional application before5.2 migration","","Investigation","Investigation","QNAP documents a separate PHP7.4 application and its firmware-transition disablement.","https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520"],["QNAP","QNAP QTS built-in PHP runtime","","Investigation","Investigation","Prior built-in firmware mappings are retained. A separate QNAP FAQ documents retirement/disablement of the optional PHP7.4 application after5.1.x->5.2.0; this is not a replacement built-in PHP version table.","https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520"],["QNAP","QNAP QuTS hero built-in PHP runtime","","Investigation","Investigation","Prior built-in firmware mappings are retained. A separate QNAP FAQ documents retirement/disablement of the optional PHP7.4 application after5.1.x->5.2.0; this is not a replacement built-in PHP version table.","https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520"],["Quest Software","KACE Systems Management Appliance","","Investigation","Investigation","Quest published KB 4385046 in the KACE Systems Management Appliance support feed as a response to CVE-2026-109618 and CVE-2026-109619.","https://support.quest.com/kace-systems-management-appliance/kb/4385046/4385046"],["RainLoop Team","RainLoop Webmail","","Vulnerable","Vulnerable","The vendor requirements explicitly specify PHP and distinguish optional contact-database support from the mail UI.","https://www.rainloop.net/docs/system-requirements/"],["RaspAP project","RaspAP PHP network-management web GUI","","Vulnerable","Vulnerable","RaspAP's manual installation configures a PHP-CGI web management interface.","https://docs.raspap.com/get-started/manual/"],["ReactPHP project","ReactPHP EventLoop","","Investigation","Investigation","ReactPHP provides a PHP event loop with a stream_select default that works without installing a separate event-loop extension.","https://packagist.org/packages/react/event-loop"],["Rector project","Rector automated PHP refactoring tool","","Investigation","Investigation","Publisher metadata for rector/rector 2.7.0 declares PHP ^7.4\\",""],["Red Hat","Red Hat Enterprise Linux 9 PHP RPM/AppStreams","","Vulnerable","Vulnerable","Red Hat's CVE pages mark the RHEL 9 PHP component family affected; RHSA-2026:87072 separately fixes the scoped php:8.2 module row.","https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages"],["Red Hat","Red Hat Enterprise Linux 9 php:8.2 module","8.2.35-1.module+el9.8.0+25111+a1450321","Fix","Fix","Red Hat RHSA-2026:87072 provides fixed RHEL 9 php:8.2 module packages for CVE-2026-109618 and CVE-2026-109619.","https://access.redhat.com/errata/RHSA-2026:87072"],["Render; customer/base-image publisher","Render customer PHP Docker hosting","","Investigation","Investigation","Render's PHP deployment guide uses Docker and nginx/php-fpm for a Laravel application.","https://render.com/docs/deploy-php-laravel-docker"],["RoadRunner PHP community","RoadRunner common PHP worker package","","Investigation","Investigation","The common worker declares PHP and extension requirements; the old Composer name is replaced.","https://packagist.org/packages/roadrunner/worker"],["RoadRunner project","RoadRunner configured PHP worker-pool integration","","Investigation","Investigation","The documented pool starts PHP CLI processes and applies only to six named plugin paths.","https://docs.roadrunner.dev/docs/php-worker/pool"],["Roave","Roave backward-compatibility checker","","Investigation","Investigation","Publisher metadata for roave/backward-compatibility-check 8.23.0 declares PHP ~8.4.0 \\",""],["Roundcube project","Roundcube Webmail","","Vulnerable","Vulnerable","The official project identifies a PHP/JavaScript webmail server with an internal IMAP library; registry supplies a named release and bounded PHP range.","https://github.com/roundcube/roundcubemail"],["Roundcube project","Roundcube Webmail Docker image family","Unrebuilt Roundcube Docker variants using pre-fix PHP 8.4 base images","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://github.com/roundcube/roundcubemail-docker"],["SalesAgility / SuiteCRM project","SuiteCRM","","Vulnerable","Vulnerable","Version-specific SuiteCRM 7 and 8 compatibility tables explicitly identify the PHP server runtime.","https://docs.suitecrm.com/8.x/admin/compatibility-matrix/"],["Sangoma","PBXact 17 PHP management edition","","Investigation","Investigation","Sangoma describes PBXact17 as its commercial FreePBX-based system with PHP8.2.","https://www.freepbx.org/pbxact-17-general-availability-announcement/"],["Sangoma / FreePBX project","FreePBX 17 management framework","","Investigation","Investigation","FreePBX17 documents PHP8.2 as its supported tested platform, distinct from its installer minimum guard.","https://sangomakb.atlassian.net/wiki/spaces/FP/pages/279052296"],["Scalingo","Scalingo PaaS","","Investigation","Investigation","Scalingo's php2shell bulletin says PHP applications hosted on Scalingo may be affected and lists patched PHP releases.","https://doc.scalingo.com/security/bulletins/ssb-2026-005"],["Scalingo","Scalingo PHP buildpack","","Investigation","Investigation","Scalingo says applications using its PHP buildpack must rebuild and redeploy to receive the updated PHP runtime and workaround.","https://doc.scalingo.com/security/bulletins/ssb-2026-005"],["Sean Morris / php-wasm project","php-cgi-wasm package (Sean Morris)","","Investigation","Investigation","The publisher lists php-cgi-wasm as a separate package.","https://github.com/seanmorris/php-wasm"],["Sean Morris / php-wasm project","php-cli-wasm package (Sean Morris)","","Investigation","Investigation","The publisher lists php-cli-wasm as a separate package.","https://github.com/seanmorris/php-wasm"],["Sean Morris / php-wasm project","php-cloud-wasm package (Sean Morris)","","Investigation","Investigation","The publisher lists php-cloud-wasm as a separate package.","https://github.com/seanmorris/php-wasm"],["Sean Morris / php-wasm project","php-dbg-wasm package (Sean Morris)","","Investigation","Investigation","The publisher lists php-dbg-wasm as a separate package.","https://github.com/seanmorris/php-wasm"],["Sean Morris / php-wasm project","php-sdl-wasm package (Sean Morris)","","Investigation","Investigation","The publisher lists php-sdl-wasm as a separate package.","https://github.com/seanmorris/php-wasm"],["Sean Morris / php-wasm project","php-wasm-builder package (Sean Morris)","","Investigation","Investigation","The publisher lists php-wasm-builder as a separate package.","https://github.com/seanmorris/php-wasm"],["Sean Morris / php-wasm project","Sean Morris php-wasm runtime package","","Investigation","Investigation","The project documents embedded PHP WebAssembly packages.","https://github.com/seanmorris/php-wasm"],["Securepoint GmbH","Securepoint Resellerportal","","Investigation","Investigation","Securepoint's live Resellerportal login HTML exposes Laravel application markers and a Securepoint resellerportal session cookie.","https://my.securepoint.de/"],["Semantic MediaWiki project","Semantic MediaWiki","","Investigation","Investigation","The publisher manifest declares PHP and mbstring and explicitly requires MediaWiki and its dependencies.","https://packagist.org/packages/mediawiki/semantic-media-wiki"],["Sendy","Sendy self-hosted application","","Vulnerable","Vulnerable","The vendor describes Sendy as a PHP-hosted application and separately identifies Amazon SES for sending mail.","https://sendy.co/"],["Serendipity project","Serendipity Blog System","","Vulnerable","Vulnerable","The project calls Serendipity a PHP web application and specifies PHP 7.3+, cookie/session support and extensions.","https://docs.s9y.org/docs/users/getting-started/fresh-installation.html"],["Shaarli community","Shaarli","Shaarli Docker distribution awaiting a patched Alpine base at review time","Vulnerable","Vulnerable","Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://github.com/shaarli/Shaarli/blob/master/composer.json"],["Shivam Mathur / setup-php project","setup-php GitHub Action external PHP provisioning","Patched setup-php v2-provisioned PHP builds announced 2026-10-21","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://github.com/shivammathur/setup-php/blob/main/action.yml"],["Shlink project","Shlink","","Vulnerable","Vulnerable","Official package metadata identifies a PHP URL-shortening application with CLI/REST interfaces and direct runtime modules.","https://packagist.org/packages/shlinkio/shlink"],["Shopify","Shopify API Library for PHP deprecated line","","Investigation","Investigation","Published metadata identifies the PHP client and its extension subset. The README marks it deprecated and directs users to shopify/shopify-app-php.","https://packagist.org/packages/shopify/shopify-api"],["Shopify","Shopify App PHP package","","Investigation","Investigation","The app package declares PHP >=8.2 with Firebase JWT and Guzzle dependencies for PHP Shopify app integration.","https://packagist.org/packages/shopify/shopify-app-php"],["Shopware 5 project / shopware AG lineage","Shopware 5","","Vulnerable","Vulnerable","The v5.7.20 package declares PHP and its extension requirements. The project README says active maintenance is no longer guaranteed.","https://packagist.org/packages/shopware/shopware"],["shopware AG","Shopware 6","","Vulnerable","Vulnerable","The official 6.7 update guide requires PHP 8.2/8.3/8.4 and separately describes the Vue/Vite administration frontend.","https://docs.shopware.com/en/shopware-6-en/update-guides/update-guide-shopware-67"],["Silverstripe CMS project","Silverstripe CMS","","Vulnerable","Vulnerable","The 6.x manual requires a PHP web server, PHP 8.3-8.5 and specific extensions.","https://docs.silverstripe.org/en/6/getting_started/server_requirements/"],["Simple Machines / SMF project","Simple Machines Forum","","Vulnerable","Vulnerable","The official application manifest declares a PHP runtime constraint separately from PHP-CS-Fixer and PHPUnit development dependencies.","https://github.com/SimpleMachines/SMF/blob/release-3.0/composer.json"],["SimpleRisk","SimpleRisk PHP GRC application","","Vulnerable","Vulnerable","SimpleRisk publishes PHP version and extension requirements plus supported Apache/nginx execution modes.","https://support.simplerisk.com/kb/01-01-system-requirements"],["SimpleSAMLphp project","SimpleSAMLphp","","Vulnerable","Vulnerable","SimpleSAMLphp is a PHP SAML service-provider/identity-provider application with explicit PHP and extension requirements.","https://packagist.org/packages/simplesamlphp/simplesamlphp"],["Slim project","Slim framework","","Vulnerable","Vulnerable","Slim is a PHP HTTP microframework; its package requires a separately chosen PSR-7 implementation and identifies XML parser modules as optional.","https://packagist.org/packages/slim/slim"],["SnappyMail project","SnappyMail","","Vulnerable","Vulnerable","The project documents PHP for its server-side webmail implementation and identifies its RainLoop lineage.","https://github.com/the-djmaze/snappymail"],["SolidWorx / SolidInvoice project","SolidInvoice application","","Vulnerable","Vulnerable","The official runtime manifest requires PHP and native extensions; source and binary installation methods have different packaging boundaries.","https://github.com/SolidInvoice/SolidInvoice/blob/3.2.x/composer.json"],["SolidWorx / SolidInvoice project","SolidInvoice self-contained binary","","Investigation","Investigation","The vendor explicitly documents a bundled PHP runtime and FrankenPHP worker controls; no separately installed host PHP is required.","https://solidinvoice.co/docs/installation-guide/quick-install/"],["Sophos","MyUTM portal","","Investigation","Investigation","Sophos says its legacy MyUTM portal ran an affected PHP version and was taken offline for update, while stating that Sophos products themselves are not affected.","https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell"],["SPIP project","SPIP","","Vulnerable","Vulnerable","The official configuration table gives PHP compatibility and extension requirements separately for SPIP 4.4, 4.3 and 4.2.","https://www.spip.net/en_article6659.html"],["Spryker Systems GmbH","Spryker Commerce OS","","Vulnerable","Vulnerable","The vendor documents PHP-backed commerce and marketplace applications; its upgrade guide distinguishes the 8.3 floor from the 8.5 recommendation.","https://docs.spryker.com/docs/dg/dev/system-requirements/latest/system-requirements.html"],["SquirrelMail project","SquirrelMail legacy documented webmail","","Vulnerable","Vulnerable","The old official installation manual explicitly requires a PHP-capable web server for the webmail application.","https://www.squirrelmail.org/docs/admin/admin-3.html"],["Statamic project","Statamic CMS","","Vulnerable","Vulnerable","Statamic describes itself as a PHP application installed as a Laravel package and lists PHP 8.3+ requirements.","https://statamic.dev/getting-started/requirements"],["Statamic project","Statamic static-site generator","","Investigation","Investigation","The official guide installs statamic/ssg, invokes PHP/Artisan during the build and publishes storage/app/static.","https://statamic.dev/getting-started/deploying/netlify"],["Stripe and contributors","Stripe PHP client library","","Investigation","Investigation","The displayed beta release requires PHP >=7.4.0 and curl, json and mbstring extensions in the PHP caller.","https://packagist.org/packages/stripe/stripe-php"],["SugarAI / SugarCRM","Sugar application server","","Vulnerable","Vulnerable","The vendor's supported-platforms page explicitly lists PHP among application server requirements, separately from end-user browser requirements.","https://support.sugarai.com/resources/supported_platforms/"],["Sulu project","Sulu CMS","","Vulnerable","Vulnerable","The Sulu 3.x requirements explicitly require PHP 8.2+ and DOM/XML extensions.","https://docs.sulu.io/3.x/reference/requirements.html"],["SURF","SURF Research Access Management EngineBlock proxy","","Investigation","Investigation","SURF's architecture names EngineBlock as the SRAM proxy.","https://servicedesk.surf.nl/wiki/spaces/IAM/pages/74226103/Conceptual%2Boverview%2Bof%2BSURF%2BResearch%2BAccess%2BManagement"],["SURF","SURF Research Drive Nextcloud server component","","Investigation","Investigation","SURF's domain-vision PDF identifies Research Drive among Nextcloud-based services.","https://www.surf.nl/files/2026-04/surf-dienstdomeinvisies-slidedeck.pdf"],["SURF","SURFconext OpenConext EngineBlock proxy role","","Investigation","Investigation","Project showcase and architecture connect SURFconext with OpenConext's EngineBlock proxy.","https://openconext.org/openconext-showcases/"],["SURF","SURFdrive Nextcloud server component","","Investigation","Investigation","SURF states that SURFdrive is based on Nextcloud.","https://www.surf.nl/diensten/opslag-datamanagement/surfdrive"],["SURF","SURFfilesender FileSender server component","","Investigation","Investigation","SURF identifies FileSender as the origin of SURFfilesender.","https://www.surf.nl/diensten/opslag-datamanagement/surffilesender"],["SURF / SURFnet","SURFconext Service Provider Dashboard","","Vulnerable","Vulnerable","The registration/management application declares PHP ^8.2 in its root manifest.","https://github.com/SURFnet/sp-dashboard/blob/main/composer.json"],["SUSE","SUSE Linux Enterprise PHP8 package families","","Investigation","Investigation","SUSE release notes establish PHP 8.2 availability; its published update lists versioned php8 runtime, FPM and extension packages.","https://documentation.suse.com/releasenotes/sles/15-SP6/index.html"],["SUSE","SUSE SLE BCI PHP CLI container","","Not vuln","Not vuln","Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://registry.suse.com/repositories/bci-php"],["SUSE","SUSE SLE BCI PHP-Apache container","","Not vuln","Not vuln","Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://registry.suse.com/repositories/bci-php-apache"],["SUSE","SUSE SLE BCI PHP-FPM 8 container","","Not vuln","Not vuln","Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://registry.suse.com/repositories/bci-php-fpm"],["Swoole project","Swoole native PHP extension","","Investigation","Investigation","The release identifies an asynchronous PHP networking engine and explicit PHP-version bounds.","https://pecl.php.net/package/swoole/6.2.3"],["Sylius project","Sylius","","Vulnerable","Vulnerable","The official prerequisites require PHP 8.2+ and five named extensions for the Symfony-based commerce application.","https://docs.sylius.com/public/getting-started/before-you-begin"],["Sylvain Lassaut / NoiseByNorthwest","SPX native PHP profiling extension and built-in report UI","","Investigation","Investigation","The maintainer README describes a loaded PHP extension with HTTP profiling/UI and CLI modes; build configuration links native zlib.","https://github.com/NoiseByNorthwest/php-spx/blob/master/README.md"],["Symfony","Symfony Console component","","Investigation","Investigation","PHP command-line application framework is distributed as an independently installable PHP package.","https://packagist.org/packages/symfony/console"],["Symfony","Symfony framework","","Vulnerable","Vulnerable","The current Symfony setup guide identifies PHP and six extensions; the official component catalogue and separate manifests distinguish reusable packages from the full framework.","https://symfony.com/doc/current/setup.html"],["Symfony","Symfony HttpFoundation component","","Investigation","Investigation","PHP request, response, session and upload abstractions is distributed as an independently installable PHP package.","https://packagist.org/packages/symfony/http-foundation"],["Symfony","Symfony HttpKernel component","","Investigation","Investigation","PHP HTTP kernel and request/response conversion pipeline is distributed as an independently installable PHP package.","https://packagist.org/packages/symfony/http-kernel"],["Symfony","Symfony mbstring polyfill","","Investigation","Investigation","The PHP package provides the ext-mbstring Composer platform capability while implementing a fallback and directly requiring iconv.","https://packagist.org/packages/symfony/polyfill-mbstring"],["Symfony","Symfony Process component","","Investigation","Investigation","PHP API for invoking and managing system subprocesses is distributed as an independently installable PHP package.","https://packagist.org/packages/symfony/process"],["Symplify","Easy Coding Standard PHP style tool","","Investigation","Investigation","Publisher metadata for symplify/easy-coding-standard 13.3.7 declares PHP >=7.2 for this tool/library.","https://packagist.org/packages/symplify/easy-coding-standard"],["Synology","Synology PHP 5.6 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP5.6/5.6.40-0131"],["Synology","Synology PHP 7.0 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP7.0/7.0.33-0131"],["Synology","Synology PHP 7.2 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP7.2/7.2.34-0131"],["Synology","Synology PHP 7.3 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP7.3/7.3.33-0173"],["Synology","Synology PHP 7.4 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP7.4/7.4.33-0140"],["Synology","Synology PHP 8.0 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP8.0/8.0.30-0121"],["Synology","Synology PHP 8.1 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP8.1/8.1.34-0110"],["Synology","Synology PHP 8.2 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP8.2/8.2.30-0170"],["Synology","Synology PHP 8.3 archived package family","","Investigation","Investigation","The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","https://archive.synology.com/download/Package/PHP8.3/8.3.30-0050"],["Synology","Synology PHP 8.4 package distribution","","Investigation","Investigation","Fresh archive metadata confirms the existing8.4 package identity. It is one of ten PHP branch families, not PHP installed by default throughout DSM.","https://archive.synology.com/download/Package/PHP8.4/8.4.19-0050"],["Synology","Synology Web Station optional PHP hosting","","Investigation","Investigation","Web Station supports separately installed PHP backends and PHP profiles for hosted sites.","https://www.synology.com/en-global/dsm/7.4/software_spec/web_station"],["TeamPass project","TeamPass","","Vulnerable","Vulnerable","The project identifies a PHP/MySQL credential vault, lists native modules and separates the server from a browser extension.","https://github.com/nilsteampassnet/TeamPass"],["TerraMaster","TerraMaster TOS6 Web Server optional PHP hosting","","Investigation","Investigation","The Web Server guide documents optional PHP instances, virtual-host version selection and configurable extensions.","https://help.terra-master.com/docs/TOS6/application/web-server"],["Textpattern project","Textpattern CMS","","Vulnerable","Vulnerable","Textpattern lists PHP, MySQL and required/optional PHP modules for its 4.9 line.","https://textpattern.com/about/system-requirements"],["The Cacti Group","Cacti","","Vulnerable","Vulnerable","The source manifest and README confirm PHP for the web application and built-in poller, with differing table/develop minima.","https://github.com/Cacti/cacti/blob/develop/composer.json"],["The PHP Foundation / PHP PIE project","PHP Installer for Extensions (PIE)","","Investigation","Investigation","The official README identifies a PHP-based extension installer, distinguishes its PHP execution version from the target, and points to the paginated Packagist extension catalogue.","https://github.com/php/pie"],["The PHP Group","PHP BCMath","","Investigation","Investigation","BCMath: Arbitrary precision arithmetic. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.m4"],["The PHP Group","PHP built-in development web server","","Investigation","Investigation","The official manual documents the CLI SAPI built-in HTTP server and says it is for controlled development/testing use. The server implementation is present in the pinned CLI source.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/php_cli_server.c"],["The PHP Group","PHP Bzip2","","Investigation","Investigation","Bzip2: Bzip2 streams, filters and compression. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.m4"],["The PHP Group","PHP Calendar","","Investigation","Investigation","Calendar: Calendar and date conversions. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.m4"],["The PHP Group","PHP Clang fuzzer SAPI","","Investigation","Investigation","The released fuzzer manifest declares developer harnesses for PHP parser, execution, JIT, serialization and selected extensions.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fuzzer/config.m4"],["The PHP Group","PHP CLI","","Investigation","Investigation","The pinned PHP source declares the cli SAPI. Built by upstream default unless --disable-cli; jobs may also run in production.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/config.m4"],["The PHP Group","PHP COM and .NET","","Investigation","Investigation","COM and .NET: Windows COM automation and native interoperation. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/com_dotnet/config.w32"],["The PHP Group","PHP core and Zend Engine","","","","Unversioned PHP runtime family anchor for downstream dependency links; version-scoped affected and fixed runtime variants are recorded separately.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/Zend/zend.c"],["The PHP Group","PHP core and Zend Engine affected web-serving release scope",">=5.4.0 before fixed release or vendor backport; supported branches <8.2.35, <8.3.36, <8.4.27, <8.5.12","Vulnerable","Vulnerable","Version-scoped PHP runtime variant for affected web-serving releases. PHP says all PHP installations serving web requests are at risk; Calif found affected paths back to PHP 5.4.0.","https://www.php.net/archive/2026.php#2026-10-21-5"],["The PHP Group","PHP core and Zend Engine fixed upstream releases","8.5.12, 8.4.27, 8.3.36, 8.2.35","Fix","Fix","Version-scoped PHP runtime variant for the upstream fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.","https://www.php.net/archive/2026.php#2026-10-21-5"],["The PHP Group","PHP Ctype","","Investigation","Investigation","Ctype: Character classification. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.m4"],["The PHP Group","PHP cURL","","Investigation","Investigation","cURL: Outbound URL transfers via libcurl. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.m4"],["The PHP Group","PHP Date/Time","","Investigation","Investigation","Date/Time: Date parsing, time zones and timelib. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config0.m4"],["The PHP Group","PHP DBA","","Investigation","Investigation","DBA: Database-file handlers and local key-value storage. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.m4"],["The PHP Group","PHP dl_test","","Investigation","Investigation","dl_test: Dynamic-extension loading test fixture. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.m4"],["The PHP Group","PHP DOM","","Investigation","Investigation","DOM: XML and HTML document manipulation. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.m4"],["The PHP Group","PHP Embed SAPI","","Investigation","Investigation","The released embed build manifest creates a shared or static PHP library for use inside a host application.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/embed/config.m4"],["The PHP Group","PHP Enchant","","Investigation","Investigation","Enchant: Spell-checking provider bridge. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.m4"],["The PHP Group","PHP Exif","","Investigation","Investigation","Exif: Image metadata parsing. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.m4"],["The PHP Group","PHP FFI","","Investigation","Investigation","FFI: Native C library and memory interface. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.m4"],["The PHP Group","PHP Fileinfo","","Investigation","Investigation","Fileinfo: File-type and MIME identification. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.m4"],["The PHP Group","PHP Filter","","Investigation","Investigation","Filter: Validation and sanitization of input values. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.m4"],["The PHP Group","PHP FTP","","Investigation","Investigation","FTP: FTP client and optional TLS transfer. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.m4"],["The PHP Group","PHP GD","","Investigation","Investigation","GD: Image decode, transform and encode. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.m4"],["The PHP Group","PHP Gettext","","Investigation","Investigation","Gettext: Translation catalogues and locale messages. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.m4"],["The PHP Group","PHP GMP","","Investigation","Investigation","GMP: Multiple-precision arithmetic bridge. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.m4"],["The PHP Group","PHP Hash","","Investigation","Investigation","Hash: Hashing and compatibility mhash APIs. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.m4"],["The PHP Group","PHP Iconv","","Investigation","Investigation","Iconv: Character-set conversions. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.m4"],["The PHP Group","PHP IMAP extension","","Investigation","Investigation","Selected release notes build fixes for PHP 8.4; package minimum is 8.3.0.","https://pecl.php.net/package/imap/1.0.3"],["The PHP Group","PHP Intl","","Investigation","Investigation","Intl: ICU-backed internationalization. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.m4"],["The PHP Group","PHP JSON","","Investigation","Investigation","JSON: JSON parsing and serialization. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.m4"],["The PHP Group","PHP LDAP","","Investigation","Investigation","LDAP: LDAP directory client. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.m4"],["The PHP Group","PHP Lexbor support bridge","","Investigation","Investigation","Lexbor support bridge: Internal PHP glue for HTML and URL parsing. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.m4"],["The PHP Group","PHP Libxml bridge","","Investigation","Investigation","Libxml bridge: PHP integration with libxml-based parsers. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config0.m4"],["The PHP Group","PHP LiteSpeed SAPI","8.5.12, 8.4.27, 8.3.36, 8.2.35","Fix","Fix","The released source contains an LSAPI SAPI, and the PHP manual identifies LiteSpeed integration as bundled PHP.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/litespeed/config.m4"],["The PHP Group","PHP Mbstring","","Investigation","Investigation","Mbstring: Multibyte conversion and optional regex. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.m4"],["The PHP Group","PHP MySQLi","","Investigation","Investigation","MySQLi: MySQL client API through mysqlnd. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.m4"],["The PHP Group","PHP Mysqlnd","","Investigation","Investigation","Mysqlnd: PHP-native MySQL protocol client. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config9.m4"],["The PHP Group","PHP OCI8 extension","","Investigation","Investigation","Release states testing with PHP 8.2-8.5 and requires Oracle Client 11.2+.","https://pecl.php.net/package/oci8/3.4.1"],["The PHP Group","PHP ODBC","","Investigation","Investigation","ODBC: ODBC database client. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.m4"],["The PHP Group","PHP OPcache","","Investigation","Investigation","OPcache: Bytecode caching and optimization. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4"],["The PHP Group","PHP OPcache JIT","","Investigation","Investigation","The pinned OPcache manifest has a separate JIT build switch and compiles JIT sources conditionally. The runtime manual exposes opcache.jit controls.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4"],["The PHP Group","PHP OpenSSL extension","","Investigation","Investigation","OpenSSL extension: Cryptography and TLS stream integration. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config0.m4"],["The PHP Group","PHP PCNTL","","Investigation","Investigation","PCNTL: Process control for CLI and CGI jobs. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcntl/config.m4"],["The PHP Group","PHP PCRE","","Investigation","Investigation","PCRE: Regular expressions and PCRE2 integration. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config0.m4"],["The PHP Group","PHP PDO","","Investigation","Investigation","PDO: Database API and driver abstraction. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.m4"],["The PHP Group","PHP PDO_DBLIB","","Investigation","Investigation","PDO_DBLIB: FreeTDS/DB-Library database client for PDO. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.m4"],["The PHP Group","PHP PDO_FIREBIRD","","Investigation","Investigation","PDO_FIREBIRD: Firebird client for PDO. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.m4"],["The PHP Group","PHP PDO_MYSQL","","Investigation","Investigation","PDO_MYSQL: MySQL client for PDO. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.m4"],["The PHP Group","PHP PDO_OCI extension","","Investigation","Investigation","The selected release uses PDO APIs and Oracle Client 11.2+ libraries.","https://pecl.php.net/package/PDO_OCI/1.2.0"],["The PHP Group","PHP PDO_ODBC","","Investigation","Investigation","PDO_ODBC: ODBC client for PDO. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.m4"],["The PHP Group","PHP PDO_PGSQL","","Investigation","Investigation","PDO_PGSQL: PostgreSQL client for PDO. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.m4"],["The PHP Group","PHP PDO_SQLITE","","Investigation","Investigation","PDO_SQLITE: SQLite-backed database operations for PDO. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.m4"],["The PHP Group","PHP Phar","","Investigation","Investigation","Phar: Executable and data archive handling. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.m4"],["The PHP Group","PHP phpdbg","","Investigation","Investigation","The released phpdbg manifest declares a debugger SAPI; the manual documents PHP debugging and optional remote-console controls.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/phpdbg/config.m4"],["The PHP Group","PHP POSIX","","Investigation","Investigation","POSIX: POSIX identity, process and resource APIs. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/posix/config.m4"],["The PHP Group","PHP PostgreSQL extension","","Investigation","Investigation","PostgreSQL extension: PostgreSQL client API. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.m4"],["The PHP Group","PHP Pspell extension","","Investigation","Investigation","Selected PECL release minimum is separate from the PHP 8.4 packaging transition.","https://pecl.php.net/package/pspell/1.0.1"],["The PHP Group","PHP Random","","Investigation","Investigation","Random: Random-number generation APIs. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.m4"],["The PHP Group","PHP Readline","","Investigation","Investigation","Readline: Interactive command-line input. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.m4"],["The PHP Group","PHP Reflection","","Investigation","Investigation","Reflection: Runtime type and symbol inspection. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.m4"],["The PHP Group","PHP Session","","Investigation","Investigation","Session: Session identifiers, serialization and storage handlers. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.m4"],["The PHP Group","PHP Shmop","","Investigation","Investigation","Shmop: Shared-memory segment access. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.m4"],["The PHP Group","PHP SimpleXML","","Investigation","Investigation","SimpleXML: XML document access. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.m4"],["The PHP Group","PHP SNMP","","Investigation","Investigation","SNMP: Network-management protocol client. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.m4"],["The PHP Group","PHP SOAP","","Investigation","Investigation","SOAP: SOAP client/server and XML message processing. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.m4"],["The PHP Group","PHP Sockets","","Investigation","Investigation","Sockets: Low-level socket API. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.m4"],["The PHP Group","PHP Sodium","","Investigation","Investigation","Sodium: Libsodium cryptography APIs. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.m4"],["The PHP Group","PHP SPL","","Investigation","Investigation","SPL: Standard PHP Library objects and iterators. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.m4"],["The PHP Group","PHP SQLite3","","Investigation","Investigation","SQLite3: SQLite database access. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config0.m4"],["The PHP Group","PHP Standard functions","","Investigation","Investigation","Standard functions: Core strings, files, streams, URLs and serialization functions. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.m4"],["The PHP Group","PHP Sysvmsg","","Investigation","Investigation","Sysvmsg: System V message queues. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvmsg/config.m4"],["The PHP Group","PHP Sysvsem","","Investigation","Investigation","Sysvsem: System V semaphores. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvsem/config.m4"],["The PHP Group","PHP Sysvshm","","Investigation","Investigation","Sysvshm: System V shared memory. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.m4"],["The PHP Group","PHP Tidy","","Investigation","Investigation","Tidy: HTML repair and parsing bridge. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.m4"],["The PHP Group","PHP Tokenizer","","Investigation","Investigation","Tokenizer: PHP source tokenization. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.m4"],["The PHP Group","PHP URI","","Investigation","Investigation","URI: RFC 3986 and WHATWG URL parsing. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.m4"],["The PHP Group","PHP XML parser","","Investigation","Investigation","XML parser: Event-based XML parsing. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.m4"],["The PHP Group","PHP XMLReader","","Investigation","Investigation","XMLReader: Streaming XML reader. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.m4"],["The PHP Group","PHP XMLWriter","","Investigation","Investigation","XMLWriter: XML output generation. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.m4"],["The PHP Group","PHP XSL","","Investigation","Investigation","XSL: XML stylesheet transformation. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.m4"],["The PHP Group","PHP zend_test","","Investigation","Investigation","zend_test: Zend Engine test hooks and fixtures. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.m4"],["The PHP Group","PHP Zip","","Investigation","Investigation","Zip: Zip archive parsing and creation. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.m4"],["The PHP Group","PHP Zlib extension","","Investigation","Investigation","Zlib extension: Compressed streams and filters. The released build manifest declares this PHP component.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config0.m4"],["The PHP Group","PHP-CGI","8.5.12, 8.4.27, 8.3.36, 8.2.35","Fix","Fix","The pinned PHP source declares the cgi SAPI. Built by upstream default unless --disable-cgi; downstream packaging may differ.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cgi/config9.m4"],["The PHP Group","PHP-FPM","8.5.12, 8.4.27, 8.3.36, 8.2.35","Fix","Fix","The pinned PHP source declares the fpm SAPI. Optional --enable-fpm; not evidence of FPM in every PHP build.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fpm/config.m4"],["The PHP Group / Apache operators","Apache PHP module (mod_php)","8.5.12, 8.4.27, 8.3.36, 8.2.35","Fix","Fix","The pinned PHP source declares the apache2handler SAPI. Optional --with-apxs2; Apache presence alone does not establish PHP.","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/apache2handler/config.m4"],["The PHP Group / PHP Windows maintainers","Official PHP Windows binary ZIP distribution","8.5.12, 8.4.27, 8.3.36, 8.2.35","Fix","Fix","Official downloads distinguish NTS/TS roles and list four architecture/thread-safety ZIP choices; the security advisory points users to fixed Windows binaries.","https://www.php.net/downloads.php?os=windows"],["The PHP League","Flysystem","","Investigation","Investigation","Flysystem supplies a PHP storage abstraction with a separately documented adapter set and distinct require-dev integrations.","https://packagist.org/packages/league/flysystem"],["Thelia project","Thelia","","Vulnerable","Vulnerable","The official 3.0 guide requires PHP and modules; migration notes distinguish the root application from the lower-level core package floor.","https://doc.thelia.net/docs/3.0/getting-started/installation"],["thirty development llc / thirty bees project","thirty bees","","Vulnerable","Vulnerable","The release/download page gives a PHP-specific build selection and runtime requirements; the repository identifies its PrestaShop 1.6.1.11 fork point.","https://thirtybees.com/download/"],["Thunder project","Thunder Drupal distribution","","Investigation","Investigation","The official FAQ defines Thunder as a Drupal distribution for professional publishers, inheriting the PHP application runtime.","https://www.thunder.org/frequently-asked-questions"],["Tideways / open-source fork contributors","Tideways XHProf archived native extension fork","","Investigation","Investigation","Maintainer archive notice directs users to PECL XHProf and says this fork is not compatible with the commercial Tideways service.","https://github.com/tideways/php-xhprof-extension"],["Tideways GmbH","Tideways commercial PHP profiling extension","","Investigation","Investigation","Vendor requirements distinguish the PHP extension from its daemon and describe separate platform and libc scopes.","https://support.tideways.com/documentation/compatibility-and-requirements.html"],["Tiki Software Community Association / Tiki project","Tiki Wiki CMS Groupware","","Vulnerable","Vulnerable","The project documents a PHP 7.4-to-8.1 migration boundary and PHP-dependent Composer libraries.","https://doc.tiki.org/PHP-8"],["Totara","Totara","","Vulnerable","Vulnerable","The vendor requires a PHP server and separates supported PHP branches, mandatory modules and recommended modules.","https://totara.help/docs/server-system-requirements"],["TransIP","TransIP API PHP client","","Investigation","Investigation","The client declares PHP, json/openssl and HTTP dependencies. A Guzzle adapter and Symfony cache are suggested separately.","https://packagist.org/packages/transip/transip-api-php"],["TransIP","TransIP shared webhosting PHP option","","Investigation","Investigation","TransIP states its webhosting packages include PHP and documents changing the package's selected version.","https://www.transip.nl/knowledgebase/5987-wil-php-versie-mijn-website-wijzigen"],["Trend Micro","Apex Central","","Investigation","Investigation","Trend Micro's hotfix readme lists PHP 8.2.33 among Apex Central third-party modules updated to prevent potential vulnerabilities.","https://files.trendmicro.com/documentation/readme/CP/apexcentral_win_en_criticalpatch_b7328_Readme.html"],["Trend Micro","Apex One","","Investigation","Investigation","Trend Micro's critical-patch readme states that a PHP module is used in Apex One and records an update to PHP 8.2.30.","https://files.trendmicro.com/documentation/readme/Apex%20One/2020/apex_one_2019_win_cp_b20105_EN_hotfix_Readme.html"],["TurnKey Linux","TurnKey Linux LAMP appliance PHP stack","","Investigation","Investigation","The LAMP appliance page includes PHP, CLI tooling and an upstream Composer installation.","https://www.turnkeylinux.org/lamp/"],["TurnKey Linux","TurnKey Linux LAPP appliance PHP stack","","Investigation","Investigation","The LAPP appliance page documents PHP and PostgreSQL client support with Debian-packaged Composer.","https://www.turnkeylinux.org/lapp/"],["TuxCare / CloudLinux","TuxCare ELS PHP distribution family","","Vulnerable","Vulnerable","CloudLinux scopes TuxCare PHP ELS as affected by both CVEs and reports several fixed ELS packages, while the broader family remains only partially remediated.","https://docs.tuxcare.com/els-for-runtimes/php/"],["TuxCare / CloudLinux","TuxCare ELS PHP package for CentOS 8.4","7.4.6","Fix","Fix","CloudLinux reports a fixed TuxCare ELS php-7.4.6 release for CentOS 8.4 ELS.","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],["TuxCare / CloudLinux","TuxCare ELS PHP package for CentOS 8.5","7.4.19","Fix","Fix","CloudLinux reports a fixed TuxCare ELS php-7.4.19 release for CentOS 8.5 ELS.","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],["TuxCare / CloudLinux","TuxCare ELS PHP package for Ubuntu 16.04","7.0.33","Fix","Fix","CloudLinux reports a fixed TuxCare ELS php-7.0.33 release for Ubuntu 16.04 ELS.","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],["TuxCare / CloudLinux","TuxCare ELS PHP package for Ubuntu 18.04","7.2.24-0","Fix","Fix","CloudLinux reports a fixed TuxCare ELS php-7.2.24-0 release for Ubuntu 18.04 ELS.","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],["Twig / Symfony community","Twig template engine","","Investigation","Investigation","Twig compiles templates to PHP; its stable 3.x documentation and the registry default alpha describe distinct compatibility scopes.","https://packagist.org/packages/twig/twig"],["Twilio API Team","Twilio PHP helper SDK","","Investigation","Investigation","The helper SDK declares PHP >=7.1.0; Guzzle is suggested as an HTTP client and appears separately in require-dev.","https://packagist.org/packages/twilio/sdk"],["Twilio SendGrid","Twilio SendGrid PHP client","","Investigation","Investigation","The client declares PHP >=7.3, five extensions, HTTP-client and ECDSA packages; it replaces the sendgrid/sendgrid-php package name.","https://packagist.org/packages/sendgrid/sendgrid"],["TYPO3 project","TYPO3 13.4","","Vulnerable","Vulnerable","The official 13.4.36 download page publishes a PHP 8.2-8.5 requirement and source-archive checksums. Versioned 13.4 documentation describes required and optional modules.","https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/Installation/SystemRequirements/Index.html"],["UnoPim","UnoPim","","Investigation","Investigation","The official UnoPim repository documents a Laravel PIM/DAM platform requiring PHP 8.4.1+, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","https://github.com/unopim/unopim"],["Upsun","Upsun PHP application containers","","Investigation","Investigation","Upsun documents managed PHP application runtimes and periodic patch delivery through deployment/maintenance.","https://developer.upsun.com/docs/languages/php"],["Utrecht University / Yoda","Yoda v1.5 legacy PHP web portal","","Vulnerable","Vulnerable","Version 1.5 notes explicitly document the PHP portal upgrade.","https://utrechtuniversity.github.io/yoda/release-notes/release-1.5.html"],["Uwe Steinmann / SeedDMS project","SeedDMS","","Vulnerable","Vulnerable","The project identifies a PHP-based document-management application with MySQL, SQLite or PostgreSQL and separately publishes two branch families.","https://www.seeddms.org/about/"],["Vance Lucas / Graham Campbell / phpdotenv contributors","phpdotenv","","Investigation","Investigation","The PHP library loads .env configuration and depends on PHP polyfill packages; boolean validation adds an optional filter requirement.","https://packagist.org/packages/vlucas/phpdotenv"],["Vanderbilt University / REDCap Consortium","REDCap","","Vulnerable","Vulnerable","Official requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients.","https://projectredcap.org/software/requirements/"],["Vardot / Varbase project","Varbase Drupal distribution","","Investigation","Investigation","The guide uses PHP/Composer in DDEV and describes automatic Drupal installation and recipe application.","https://docs.varbase.vardot.com/developers/installing-varbase"],["Virtualmin","Virtualmin hosted PHP execution modes","","Investigation","Investigation","Virtualmin documents PHP-FPM and FCGId/CGI wrapper execution for customer PHP applications.","https://www.virtualmin.com/docs/server-components/php-execution-modes/"],["VirtueMart project","VirtueMart","","Investigation","Investigation","The official description states that Joomla and VirtueMart are PHP applications and distinguishes the component from a preinstalled Joomla bundle.","https://virtuemart.net/component/content/article/what-is-virtuemart?Itemid=144&catid=159"],["VitalPBX","VitalPBX 4.0 PHP management runtime","","Investigation","Investigation","The vendor's4.0.0R4 announcement explicitly records a PHP8.1 upgrade.","https://forums.vitalpbx.org/t/vitalpbx-4-0-0-r4-is-now-available/1863/1"],["VitalPBX","VitXi server-side PHP component","","Investigation","Investigation","The VitXi changelog separately documents PHP8.2 support and later Swoole integration.","https://vitalpbx.com/cbxchangelog/vitxi-v4-5-vitalpbx-4-5/"],["VK / VKCOM KPHP project","KPHP compiler and native runtime","","Investigation","Investigation","The architecture separates a compiler, native runtime, HTTP server and development extension.","https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/"],["VK / VKCOM KPHP project","KPHP vkext development PHP extension","","Investigation","Investigation","vkext exposes network and TL/RPC functions to PHP for development and is separate from the compiler.","https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/internals-vkext.html"],["Vtiger","Vtiger CRM Open Source","","Vulnerable","Vulnerable","The vendor's Open Source installation FAQ explicitly requires PHP and several modules.","https://help.vtiger.com/article/158054339-Vtiger-Open-Source-FAQs"],["VuFind project / Villanova University","VuFind","","Vulnerable","Vulnerable","The official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components.","https://github.com/vufind-org/vufind/blob/dev/composer.json"],["wallabag project","wallabag","","Investigation","Investigation","Official wallabag requirements state compatibility with PHP >=7.4 and require PHP-FPM plus extensions.","https://doc.wallabag.org/admin/installation/requirements/"],["WampServer maintainers / Aviatechno","WampServer Windows development bundle","","Investigation","Investigation","The publisher distinguishes the full installer, manager updates and separately downloadable PHP add-ons; Apache/PHP and database administration tools are bundled.","https://wampserver.aviatechno.net/"],["webERP project","webERP","","Vulnerable","Vulnerable","The official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions.","https://www.weberp.org/downloads/webERP.Manual.4.15.2.2025-09-03.pdf"],["Webkul","Bagisto","","Vulnerable","Vulnerable","The guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5.","https://devdocs.bagisto.com/getting-started/before-you-start.html"],["Webkul / UVdesk","UVdesk Community Helpdesk","","Vulnerable","Vulnerable","The Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance.","https://github.com/uvdesk/community-skeleton"],["webonyx / GraphQL-PHP project","webonyx GraphQL-PHP","","Investigation","Investigation","This package implements GraphQL in PHP and declares optional AMPHP/ReactPHP integrations separately.","https://packagist.org/packages/webonyx/graphql-php"],["WebPros / cPanel","cPanel EasyApache 4 / MultiPHP","EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.cpanel.net/ea4/php/about-php/"],["WebPros / cPanel","cPanel internal PHP for hooks and AppConfig applications","cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27","Fix","Fix","Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","https://docs.cpanel.net/knowledge-base/general-systems-administration/cpanel-php/"],["Whirl-i-Gig / CollectiveAccess project","CollectiveAccess Providence","","Vulnerable","Vulnerable","The vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools.","https://docs.collectiveaccess.org/providence/user/setup/systemReq"],["WHMCS Ltd.","WHMCS self-hosted application","","Vulnerable","Vulnerable","The vendor's 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches.","https://docs.whmcs.com/9-0/installation-guide/system-requirements/"],["Wikimedia / MediaWiki Platform maintainers","Excimer native PHP interrupting timer and sampling profiler","","Investigation","Investigation","Publisher PIE metadata identifies a C php-ext package; a fixed project-document revision explains the registry transition.","https://packagist.org/packages/wikimedia/excimer"],["Wikimedia / MediaWiki project","Parsoid PHP","","Investigation","Investigation","Parsoid is a PHP library converting wikitext and HTML; the older JavaScript implementation is explicitly historical.","https://www.mediawiki.org/wiki/Parsoid"],["Wikimedia Foundation","Wikimedia MediaWiki application-server PHP tier","","Investigation","Investigation","Wikimedia documents MediaWiki request execution through PHP-FPM.","https://wikitech.wikimedia.org/wiki/Application_servers"],["Winter CMS project","Winter CMS","","Vulnerable","Vulnerable","The 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork.","https://wintercms.com/docs/v1.2/docs/setup/installation"],["WoltLab GmbH","WoltLab Suite","","Vulnerable","Vulnerable","Official requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases.","https://manual.woltlab.com/en/requirements/"],["WooCommerce","WooCommerce","","Investigation","Investigation","The vendor distinguishes its recommended PHP stack from a still-compatible legacy floor and names optional integration requirements.","https://woocommerce.com/document/server-requirements/"],["WooCommerce","WooCommerce PayPal Payments","","Investigation","Investigation","The official plugin listing requires installed WooCommerce and PHP to connect a merchant store to PayPal.","https://wordpress.org/plugins/woocommerce-paypal-payments/"],["WooCommerce","WooCommerce Stripe Payment Gateway","","Investigation","Investigation","The publisher-controlled plugin listing explicitly requires PHP for the WooCommerce Stripe integration.","https://wordpress.org/plugins/woocommerce-gateway-stripe/"],["WooCommerce","WooPayments merchant plugin","","Investigation","Investigation","The official develop header labels version 11.2.0 and declares PHP 7.4, alongside separate WooCommerce and WordPress prerequisites. This corroborates registry metadata, not a verified release archive.","https://github.com/Automattic/woocommerce-payments/blob/develop/woocommerce-payments.php"],["WordPress Playground contributors","PHP.wasm browser platform adapter","","Investigation","Investigation","The web adapter selects a browser-specific compiled PHP package.","https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/"],["WordPress Playground contributors","PHP.wasm Node.js platform adapter","","Investigation","Investigation","The Node adapter loads version-specific compiled PHP packages.","https://developer.wordpress.org/playground/developers/local-development/php-wasm-node/"],["WordPress Playground contributors","PHP.wasm universal JavaScript API","","Investigation","Investigation","The universal package supplies the shared API without choosing a platform-specific PHP binary.","https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/"],["WordPress Playground contributors","WordPress Playground browser and local runtime","","Investigation","Investigation","Playground uses a WebAssembly build of the PHP interpreter to run WordPress.","https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/"],["WordPress Playground contributors","WordPress Playground PHP.wasm binary family","","Investigation","Investigation","The architecture compiles the PHP interpreter to WebAssembly rather than reimplementing it in JavaScript.","https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/"],["WordPress project","WordPress","","Vulnerable","Vulnerable","Current WordPress requirements recommend PHP 8.3+ and allow legacy PHP 7.4+. The Hosting Handbook distinguishes required JSON/mysqli from recommended modules.","https://wordpress.org/about/requirements/"],["WP Engine","WP Engine managed WordPress PHP hosting","","Investigation","Investigation","WP Engine's guide documents PHP environment selection, staged version availability and forced EOL upgrades with a legacy exception.","https://wpengine.com/support/php-guide/"],["WP-CLI / WordPress project","WP-CLI WordPress administration framework","","Investigation","Investigation","Publisher metadata for wp-cli/wp-cli v2.12.0 declares PHP ^5.6 \\",""],["X-Cart","X-Cart 5","","Vulnerable","Vulnerable","The versioned developer page requires PHP 8.3-8.4, lists runtime extensions and separately recommends Xdebug for development.","https://developer.x-cart.com/getting_started/requirements"],["Xdebug / Derick Rethans and contributors","Xdebug PHP Zend instrumentation extension","","Investigation","Investigation","Xdebug documents loading its Zend extension into the chosen PHP SAPI configuration.","https://xdebug.org/docs/install"],["Xdebug / vscode-php-debug contributors","VS Code PHP Debug adapter external PHP/Xdebug integration","","Investigation","Investigation","The debug-adapter descriptor uses node and out/phpDebug.js. Official README describes Xdebug connections, PHP CLI launch and built-in PHP web-server launch.","https://github.com/xdebug/vscode-php-debug/blob/main/package.json"],["XenForo Ltd","XenForo","","Vulnerable","Vulnerable","Vendor documentation identifies PHP web-server requirements, GD JPEG support and a PHP CLI command interface.","https://docs.xenforo.com/devs"],["XigmaNAS project","XigmaNAS bundled PHP components","","Investigation","Investigation","XigmaNAS lists PHP and PHP-based administration tools among software used.","https://www.xigmanas.com/wiki/doku.php?id=features"],["YetiForce S.A.","YetiForce CRM","","Vulnerable","Vulnerable","The 7.x guide identifies PHP, mandatory modules and optional/integration-specific libraries.","https://doc.yetiforce.com/en/introduction/requirements/"],["Yii Software / Yii project","Yii 2 framework","","Vulnerable","Vulnerable","Yii 2 release metadata declares a server PHP framework and separately lists lib-pcre and browser asset packages.","https://packagist.org/packages/yiisoft/yii2"],["Yii Software / Yii project","Yii Web extension abandoned prototype","","Investigation","Investigation","The package registry explicitly marks this old PHP web extension abandoned and recommends yiisoft/yii-middleware instead.","https://packagist.org/packages/yiisoft/yii-web"],["YOURLS project","YOURLS","","Vulnerable","Vulnerable","The official project explicitly describes PHP scripts providing self-hosted URL shortening, statistics and plugins.","https://github.com/YOURLS/YOURLS"],["Zabbix","Zabbix web frontend","","Vulnerable","Vulnerable","The 7.4 guide identifies the PHP frontend, its PHP version range and conditional authentication/database modules separately from native server/proxy/agent requirements.","https://www.zabbix.com/documentation/7.4/en/manual/installation/frontend"],["Zen Cart project","Zen Cart","","Vulnerable","Vulnerable","Official requirements distinguish core release compatibility, the 1.5.8 installer exception and extension introduction dates.","https://docs.zen-cart.com/user/first_steps/server_requirements/"],["ZoneMinder project","ZoneMinder PHP web and API components","","Investigation","Investigation","The official packaging spec separately declares PHP dependencies for web frontends.","https://github.com/ZoneMinder/zoneminder/blob/master/distros/redhat/zoneminder.spec"]]},"items":[["page-flaws","The two flaws","flaws/index.html","page"],["page-timeline","Timeline","timeline/index.html","page"],["page-discovery","Who found it","discovery/index.html","page"],["page-leak","How disclosure broke","leak/index.html","page"],["page-exploitation","Exploitation signals","exploitation/index.html","page"],["page-playbook","If you run PHP","playbook/index.html","page"],["page-claims","Every claim","claims/index.html","page"],["page-numbers","The numbers","numbers/index.html","page"],["page-agencies","The agencies","agencies/index.html","page"],["page-affected","Affected systems","affected/index.html","page"],["page-method","The method","method/index.html","page"],["briefing-board","Briefing: Board member or executive","briefings/board/index.html","briefing"],["briefing-security","Briefing: Security lead","briefings/security/index.html","briefing"],["briefing-engineer","Briefing: PHP or platform engineer","briefings/engineer/index.html","briefing"],["briefing-journalist","Briefing: Journalist","briefings/journalist/index.html","briefing"],["briefing-researcher","Briefing: Security researcher","briefings/researcher/index.html","briefing"],["briefing-analyst","Briefing: Analyst or advisor","briefings/analyst/index.html","briefing"],["fact-two-cves-9.2","Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each CVSS v4.0 9.2, fix","facts/two-cves-9.2/index.html","fact"],["fact-cvss-10","The flaws are CVSS 10.0","facts/cvss-10/index.html","fact"],["fact-rce-modphp","Unauthenticated RCE over HTTP against Apache mod_php with default settings, before any app","facts/rce-modphp/index.html","fact"],["fact-rce-fpm","Remote code execution is confirmed on PHP-FPM","facts/rce-fpm/index.html","fact"],["fact-fix-bailout","The fix removes longjmp() for out-of-memory errors in favour of a delayed soft OOM at the ","facts/fix-bailout/index.html","fact"],["fact-fix-incomplete","The 8.5.12 fix may be incomplete, or there is a third, different bug","facts/fix-incomplete/index.html","fact"],["fact-versions-old","All PHP versions from 5 onwards are affected by at least one of the flaws","facts/versions-old/index.html","fact"],["fact-only-update","Updating is the only complete mitigation; the configuration measures reduce exposure to sp","facts/only-update/index.html","fact"],["fact-waf","A web application firewall may provide some protection until systems are patched","facts/waf/index.html","fact"],["fact-wordpress-drupal","Pre-authentication RCE was confirmed against WordPress, Drupal, Joomla, MediaWiki, Roundcu","facts/wordpress-drupal/index.html","fact"],["fact-scale-70pc-internet","Roughly 70% of the Internet is affected","facts/scale-70pc-internet/index.html","fact"],["fact-scale-70pc-websites","PHP is used by almost 70% of websites","facts/scale-70pc-websites/index.html","fact"],["fact-scale-30m","Something like 30 million websites could be affected","facts/scale-30m/index.html","fact"],["fact-scale-2.6m-hosts","PHP is exposed on about 2.6 million internet-facing hosts, of which Censys counted 1.57 mi","facts/scale-2.6m-hosts/index.html","fact"],["fact-scale-latvia","About 6,000 potentially affected resources in Latvia, a few hundred in the public sector","facts/scale-latvia/index.html","fact"],["fact-scale-ncsc-nl","674 products in the NCSC-NL inventory: 206 vulnerable, 46 fixed, 418 under investigation, ","facts/scale-ncsc-nl/index.html","fact"],["fact-ai-found","The flaws were found by researchers using frontier AI under OpenAI's Patch the Planet init","facts/ai-found/index.html","fact"],["fact-who-first","Calif found the flaws first: discovery 1 August, hash commitment 5 August, report to PHP 1","facts/who-first/index.html","fact"],["fact-openai-same-day","OpenAI independently reported the same root cause on 11 August, with further vectors on 18","facts/openai-same-day/index.html","fact"],["fact-wiz-independent","Wiz Research independently discovered the first flaw on 19 August and reported on 24 Augus","facts/wiz-independent/index.html","fact"],["fact-four-reporters","The GitHub advisories credit four reporters: lcfr-hax (Calif), sagitzadik-wiz (Wiz), amyb-","facts/four-reporters/index.html","fact"],["fact-quarkslab-2024","The out-of-memory issue was found in a 2024 audit by Quarkslab (funded through OSTIF and t","facts/quarkslab-2024/index.html","fact"],["fact-ahead-of-attackers","Frontier AI found the flaw ahead of attackers, giving defenders time to prepare","facts/ahead-of-attackers/index.html","fact"],["fact-most-severe","The most severe flaws ever detected by AI","facts/most-severe/index.html","fact"],["fact-leak-cve-ids","On 20 October at about 15:00 UTC the two CVE IDs began circulating on forums and social me","facts/leak-cve-ids/index.html","fact"],["fact-leak-hn","The leak started with an anonymous Hacker News post citing a reliable source, which came d","facts/leak-hn/index.html","fact"],["fact-leak-watchtowr","watchTowr confirmed in public that the bugs were real and posted both CVE numbers before t","facts/leak-watchtowr/index.html","fact"],["fact-leak-video","Calif mistakenly published a video around 20:00 UTC on 20 October showing its proof of con","facts/leak-video/index.html","fact"],["fact-leak-mitigations","Mitigation advice given to a few critical-infrastructure providers from about 23:00 UTC on","facts/leak-mitigations/index.html","fact"],["fact-chainguard","Chainguard unilaterally broke the embargo on 21 October at 07:41 UTC by publishing built i","facts/chainguard/index.html","fact"],["fact-release-moved","The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the","facts/release-moved/index.html","fact"],["fact-disclosure-22oct","The flaws were disclosed on 22 October 2026","facts/disclosure-22oct/index.html","fact"],["fact-release-time","The fixes were released at 14:00 UTC on 21 October","facts/release-time/index.html","fact"],["fact-preannounce-time","The pre-announcement was published at 19:30 UTC on 20 October","facts/preannounce-time/index.html","fact"],["fact-no-exploitation","There is no evidence yet that hackers have exploited the flaw","facts/no-exploitation/index.html","fact"],["fact-cisa-none","CISA has not observed exploitation; neither CVE is in the Known Exploited Vulnerabilities ","facts/cisa-none/index.html","fact"],["fact-nz-active","Reports of active exploitation exist","facts/nz-active/index.html","fact"],["fact-amazon-honeypot","An exploit attempt hit an Amazon honeypot on 17 October from an anonymisation network; pro","facts/amazon-honeypot/index.html","fact"],["fact-cloudflare-traffic","Cloudflare observed attack traffic targeting its customers after the leak, with attackers ","facts/cloudflare-traffic/index.html","fact"],["fact-probing","Amazon and Cloudflare saw sites being probed for the flaw","facts/probing/index.html","fact"],["fact-latvia-attempts","Automated exploitation attempts were seen in Latvia; none succeeded","facts/latvia-attempts/index.html","fact"],["fact-vibe-code","Criminals are using AI to 'vibe code' an attack method","facts/vibe-code/index.html","fact"],["fact-offline-nsa","If an immediate update is not feasible, take the system offline until it can be fully miti","facts/offline-nsa/index.html","fact"],["fact-offline-cisa","Organisations that cannot update immediately, or that run PHP 8.1 or older, should take PH","facts/offline-cisa/index.html","fact"],["fact-offline-ncsc","'Where immediate remediation is not feasible, organisations should consider taking the sys","facts/offline-ncsc/index.html","fact"],["fact-offline-allies","The UK's NCSC, the NSA and their counterparts in the EU and Australia advise taking system","facts/offline-allies/index.html","fact"],["fact-affected-sites","Parts of Wikipedia, Edinburgh council, French government sites, the University of Geneva, ","facts/affected-sites/index.html","fact"],["fact-latvia-offline","Latvia restricted access from abroad to several state digital resources, possibly until 26","facts/latvia-offline/index.html","fact"],["fact-gov-patch-required","The risks require immediate patching across United States Government departments and agenc","facts/gov-patch-required/index.html","fact"],["page-code","The code","code/index.html","page"],["page-impact","Impact: offline vs compromised","impact/index.html","page"],["page-defence","Detection and defence","defence/index.html","page"],["page-context","In context: 2008 to 2026","context/index.html","page"],["page-actors","Who says what","actors/index.html","page"],["briefing-ciso","Briefing: CISO","briefings/ciso/index.html","briefing"],["briefing-cto","Briefing: CTO","briefings/cto/index.html","briefing"],["briefing-cfo","Briefing: CFO","briefings/cfo/index.html","briefing"],["briefing-appsec","Briefing: Head of AppSec","briefings/appsec/index.html","briefing"],["briefing-developer","Briefing: Developer","briefings/developer/index.html","briefing"],["briefing-comms","Briefing: Media and communications team","briefings/comms/index.html","briefing"],["fact-cf-millions","Exploit attempts across Cloudflare's network: thousands in the ten hours before announceme","facts/cf-millions/index.html","fact"],["fact-imperva-none","No traffic matching the php2shell exploit patterns was seen during Imperva's pre-disclosur","facts/imperva-none/index.html","fact"],["fact-huntress-none","No exploitation observed on Huntress partner systems as of 20:30 UTC on 21 October; no pub","facts/huntress-none/index.html","fact"],["fact-watchtowr-itw","watchTowr sees active exploitation attempts and lists the flaws as exploited in the wild","facts/watchtowr-itw/index.html","fact"],["fact-no-confirmed-compromise","As of 20:50 UTC on 22 October, no named organisation has said it was compromised through p","facts/no-confirmed-compromise/index.html","fact"],["fact-pocs-wrong","None of the public proof-of-concept exploits reviewed by VulnCheck has the correct mechani","facts/pocs-wrong/index.html","fact"],["fact-ac-high","Triggering the bug is much easier than turning it into code execution; the CVSS vector say","facts/ac-high/index.html","fact"],["fact-fix-authored","The fix was authored on 18 October at 15:26 UTC and entered the public branches at 14:06 U","facts/fix-authored/index.html","fact"],["fact-fix-engine","Both bugs are in the C engine, not in PHP code: the allocator's longjmp-based bailout on o","facts/fix-engine/index.html","fact"],["fact-more-paths","Patching the demonstrated paths does not make the bailout mechanism safe; more paths shoul","facts/more-paths/index.html","fact"],["fact-waf-nine-hours","Edge protections went live hours before disclosure: Cloudflare at 03:02 UTC; Imperva, Akam","facts/waf-nine-hours/index.html","fact"],["fact-nl-offline","The Dutch NCSC took its own site offline as a precaution, as did DigiD, MijnOverheid and O","facts/nl-offline/index.html","fact"],["fact-fi-offline","Finland's state IT provider Valtori restricted public traffic to government web services f","facts/fi-offline/index.html","fact"],["fact-wikimedia-precaution","The Wikimedia Foundation took down a number of systems 'as a precautionary measure until t","facts/wikimedia-precaution/index.html","fact"],["fact-weirdgloop-13h","Weird Gloop turned off its wiki web servers for 13 hours and still served about 94% of pag","facts/weirdgloop-13h/index.html","fact"],["fact-edinburgh","Edinburgh council's site went offline late on 21 October; the council called it 'essential","facts/edinburgh/index.html","fact"],["fact-oxford","Oxford City Council: 'a precaution because of a worldwide issue with the underlying techno","facts/oxford/index.html","fact"],["fact-uk-list","Edinburgh and Oxford councils, the Met Police and the Office for Budget Responsibility wer","facts/uk-list/index.html","fact"],["fact-quarkslab-redacted","Quarkslab's published audit summary lists 27 findings, two redacted because their fixes we","facts/quarkslab-redacted/index.html","fact"],["fact-lorenc-ai-found","Chainguard's team found the same bugs independently with an AI harness and a frontier mode","facts/lorenc-ai-found/index.html","fact"],["fact-kev-precedent","The last PHP core RCE, CVE-2024-4577, was exploited in the wild one day after disclosure a","facts/kev-precedent/index.html","fact"],["page-explained","Explained from the start","explained/index.html","page"],["page-glossary","Glossary: every term, in plain English","glossary/index.html","page"],["briefing-everyone","Briefing: Curious reader","briefings/everyone/index.html","briefing"],["briefing-site-owner","Briefing: Website owner","briefings/site-owner/index.html","briefing"],["briefing-pm","Briefing: Project or programme manager","briefings/pm/index.html","briefing"],["page-summary","The specialist summary","summary/index.html","page"],["front-now","Front page: right now","index.html#now","front"],["front-glance","Front page: at a glance","index.html#glance","front"],["front-facts","Front page: the core facts","index.html#facts","front"],["front-unknown","Front page: what nobody knows yet","index.html#unknown","front"],["front-latest","Front page: latest","index.html#latest","front"],["page-interview","Interview: the editor","interview/index.html","page"],["briefing-dpo","Briefing: Data protection officer","briefings/dpo/index.html","briefing"],["ev-2024-15793a","Quarkslab audits PHP (funded through OSTIF and the Sovereign Tech Agency). While fixing one of its findings a PHP core d","timeline/index.html","event"],["ev-202606-713fe3","OpenAI launches Patch the Planet (a Daybreak initiative with Trail of Bits, HackerOne and Calif).","timeline/index.html","event"],["ev-20260730-e9dba7","Calif begins an audit of PHP under Patch the Planet; Volker Dusch accepts the invitation.","timeline/index.html","event"],["ev-20260801-da6332","Calif discovers 'multiple different paths independently leading to RCE that resurfaced the 2024 issues and new trigger p","timeline/index.html","event"],["ev-20260805T1554-46fe8a","Ryan Austin (@lcfr_hax) posts a SHA-256 hash on X as a commitment to one finding.","timeline/index.html","event"],["ev-20260819-7c09c4","Wiz Research discovers the first vulnerability using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; confirms RCE against Dru","timeline/index.html","event"],["ev-20260811-c6d1af","Calif reports the first bug to PHP and coordinated disclosure begins. OpenAI independently reports the same root cause t","timeline/index.html","event"],["ev-20260814-6989f9","Calif shares an RCE proof of concept with PHP; PHP confirms it works on 15 August.","timeline/index.html","event"],["ev-20260821-639b80","Calif reports the second bug to PHP.","timeline/index.html","event"],["ev-20260824-1367bb","Wiz reports to the PHP security team.","timeline/index.html","event"],["ev-20260827-ee0280","The GitHub security advisory is opened, credited to lcfr-hax, sagitzadik-wiz, amyb-oai and tomash-areion.","timeline/index.html","event"],["ev-20260918-dc31b8","Further attack vectors reported by OpenAI.","timeline/index.html","event"],["ev-20260921-f53fcb","PHP acknowledges Wiz's reports 'and begins developing a coordinated fix'.","timeline/index.html","event"],["ev-20260925-c76192","The fix pull request is opened.","timeline/index.html","event"],["ev-202610-6f1a16","Cloudflare starts developing WAF protections 'since early October 2026'.","timeline/index.html","event"],["ev-20261012T2103-14ef59","CVE-2026-109618 and CVE-2026-109619 are reserved.","timeline/index.html","event"],["ev-20261018-71bce1","The final fix commit is authored; the 7.4 backport branch's commit is dated 18:10:24Z.","timeline/index.html","event"],["ev-20261018T1526-b4e5fd","Arnaud Le Blanc authors the fix, 'Avoid state corruption via bailout', with Ilija Tovilo, Jakub Zelenka, Nora Dossche an","timeline/index.html","event"],["ev-20261019T1400-03aac0","Release commits for 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are made under embargo (14:00 to 17:04 UTC).","timeline/index.html","event"],["ev-20261017-d512e3","An exploit attempt from an anonymisation-network IP hits an Amazon MadPot honeypot.","timeline/index.html","event"],["ev-20261020-8e2375","Qualys publishes on the pre-announcement.","timeline/index.html","event"],["ev-20261020T1500-2466b3","The two CVE IDs begin circulating on forums and social media with a wrong release time and a wrong CVSS of 10.0. Per Dau","timeline/index.html","event"],["ev-20261020T1930-fe4f90","php.net publishes the pre-announcement: release moved to 21 October 14:00 UTC, two critical vulnerabilities, CVSS v4.0 9","timeline/index.html","event"],["ev-20261020T2000-01b246","Calif 'mistakenly published a video' showing its proof of concept against several targets; copies circulate after it is ","timeline/index.html","event"],["ev-20261020T2022-846f42","Alan Coopersmith relays the php.net pre-announcement to oss-security.","timeline/index.html","event"],["ev-20261020T2300-2c624a","The PHP project starts giving mitigation advice to a few critical-infrastructure providers; it 'may have leaked as well'","timeline/index.html","event"],["ev-20261021T0200-abd71e","Amazon sees proof-of-concept attempts, then six hours of attempts from anonymised infrastructure.","timeline/index.html","event"],["ev-20261021T0741-630513","Chainguard publishes built images containing the fix, 'more than six hours before the coordinated release'.","timeline/index.html","event"],["ev-20261021T0743-7c8969","Cloudflare's CTO reports early attacks emerging, before the release.","timeline/index.html","event"],["ev-20261021T0836-82ecf0","ELLIO records its first sensor hit.","timeline/index.html","event"],["ev-20261021T1330-805b97","CERT-EU's stated release time for the PHP fixes.","timeline/index.html","event"],["ev-20261021T1332-c5a5f0","Wiz posts 'BREAKING ... #PHP2SHELL ... impacting 70% of the Internet', 28 minutes before the planned release; the thread","timeline/index.html","event"],["ev-20261021T1334-2583ac","GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) and, twelve seconds later, GHSA-w8hw-w9fx-j79w (CVE-2026-109618) are published by ","timeline/index.html","event"],["ev-20261021T1335-010212","Signed tags php-8.5.12, php-8.4.27, php-8.3.36 and php-8.2.35 are created.","timeline/index.html","event"],["ev-20261021T1348-21dfcf","The CVE record for CVE-2026-109618 is published; CVE-2026-109619 follows at 13:54:43Z.","timeline/index.html","event"],["ev-20261021T1400-566ddf","The planned release time. php.net's advisory 'Critical remote code execution vulnerabilities, update now' and the four r","timeline/index.html","event"],["ev-20261021T1404-4e4428","OpenAI posts: models 'helped researchers ... discover critical security flaws in PHP ... used to run an estimated 70% of","timeline/index.html","event"],["ev-20261021T1406-fda751","The fix commit enters the public php-src branches (commit timestamp); merged into 8.3 at 14:12, 8.4 at 14:27 and 8.5 at ","timeline/index.html","event"],["ev-20261021T1406-7d15e4","GitHub release php-8.5.12 is published by adoy.","timeline/index.html","event"],["ev-20261021T1417-c25442","NVD publishes both CVEs with the CNA's CVSS v4.0 9.2 and no NIST score.","timeline/index.html","event"],["ev-20261021T1441-27c589","Jakub Zelenka announces CVE-2026-109618 on oss-security; CVE-2026-109619 at 14:44:06Z.","timeline/index.html","event"],["ev-20261020-898d71","Swiss BACS posts a warning (home-page teaser dated 20 October; the page itself now says 21 October).","timeline/index.html","event"],["ev-20261021-3a93d8","CISA alert 'Critical Vulnerabilities in PHP Require Immediate Patching': take systems offline if you cannot update. NSA ","timeline/index.html","event"],["ev-20261021-603bc7","The Dutch NCSC takes its own website offline as a precaution; DigiD, MijnOverheid and Overheid.nl follow. Weird Gloop tu","timeline/index.html","event"],["ev-20261021T0302-2ae6a2","Cloudflare's WAF protections go live for all customers, about nine hours ahead of disclosure.","timeline/index.html","event"],["ev-20261021T0945-6b1675","Finland's Valtori begins restricting public traffic to government web services (12:45 local).","timeline/index.html","event"],["ev-20261021T1345-91ad21","NSA Cybersecurity posts on X: 'Effective Immediately ... be prepared for an update addressing two critical vulnerabiliti","timeline/index.html","event"],["ev-20261021T1404-817557","CISA releases KEV catalog version 2026.10.21; neither PHP CVE is in it.","timeline/index.html","event"],["ev-20261021T1434-dfbedc","CISA's ADP assessment on both CVE records: exploitation none, automatable no, technical impact total.","timeline/index.html","event"],["ev-20261021T1520-66e631","CERT-EU Security Advisory 2026-018 (stated 15:20:18, timezone not given).","timeline/index.html","event"],["ev-20261021T1525-a69d02","NCSC-NL's php2shell README last significant change (17:25 CEST). CERT.LV publishes: Latvia restricts access to several s","timeline/index.html","event"],["ev-20261021T2000-89432c","CERT.LV update: the unified state website platform is patched; lsm.lv and 112.lv restored; about 6,000 potentially affec","timeline/index.html","event"],["ev-20261021T2015-36ffa5","NCSC New Zealand: 'aware of reports of active exploitation' (09:15 NZDT 22 October; updated 21:20Z).","timeline/index.html","event"],["ev-20261022T0043-14b64c","NSA Cybersecurity posts 'UPDATE: Specific mitigation guidance ... is now available', linking the press release.","timeline/index.html","event"],["ev-20261022T0520-1f6448","JVN publishes its note (14:20 JST); JPCERT/CC alert JPCERT-AT-2026-0033 is dated 22 October.","timeline/index.html","event"],["ev-20261021T1524-5fdd04","Aaron Rainbolt relays to oss-security a Fediverse report that the 8.5.12 fix may be incomplete; a Debian maintainer adds","timeline/index.html","event"],["ev-20261021T1729-c5d11e","Per a Matrix channel, Canonical asked PHP about the Fediverse report and was told it is 'unrelated and not a real issue'","timeline/index.html","event"],["ev-20261021T2030-d5156f","Huntress: no exploitation observed on partner systems (16:30 ET).","timeline/index.html","event"],["ev-20261022-2e8bc2","The Hacker News publishes Amazon's account of the 17 October honeypot attempt and VulnCheck's count of 2,608,039 hosts.","timeline/index.html","event"],["ev-20261022-43fcfd","The Register carries Dan Lorenc's reply to the PHP Foundation; Fortinet publishes FortiWeb signatures; The Record carrie","timeline/index.html","event"],["ev-20261022T0125-950000","Matthew Prince posts Cloudflare's attempt counts: thousands before, millions after.","timeline/index.html","event"],["ev-20261022T0616-b19846","BBC News opens its live page: 'Global scramble to fix critical cyber-security flaws as many websites taken offline'.","timeline/index.html","event"],["ev-20261022T0645-78aaeb","Greenbone on oss-security: the backports imply versions down to 7.4 are affected, whatever the subject line says.","timeline/index.html","event"],["ev-20261022T0655-8ac6b7","The BBC reports the NSA's X post.","timeline/index.html","event"],["ev-20261022T0700-3e281d","Ryan Austin on BBC Radio 4: no evidence of exploitation yet.","timeline/index.html","event"],["ev-20261022T0730-40cc86","The UK NCSC page is modified (HTTP last-modified).","timeline/index.html","event"],["ev-20261022T0840-1a4cdf","NCSC-NL merges pull request 10; the inventory has 674 entries at commit cca173c64ec5.","timeline/index.html","event"],["ev-20261022T0803-0f3b01","The evidence vault behind this site is opened; the first capture of the BBC live page is at 08:04:53Z.","timeline/index.html","event"],["src-acn-it-php2shell","ACN / CSIRT Italia: PHP2Shell: sanate vulnerabilità critiche in PHP (AL07/261021/CSIRT-ITA)","sources/acn-it-php2shell/index.html","source"],["src-acsc-alert-php","ASD's ACSC (Australia): Critical vulnerabilities in PHP","sources/acsc-alert-php/index.html","source"],["src-acsc-home","ASD's ACSC: cyber.gov.au home","sources/acsc-home/index.html","source"],["src-actuia-anssi-sites-offline","ActuIA: PHP flaws: France's ANSSI orders sites offline","sources/actuia-anssi-sites-offline/index.html","source"],["src-akamai-blog-cve-2024-4577-one-day","Akamai Security Research: CVE-2024-4577 Exploits in the Wild One Day After Disclosure","sources/akamai-blog-cve-2024-4577-one-day/index.html","source"],["src-akamai-blog-php-core-rce","Akamai Security Research: Critical Remote Code Execution Vulnerabilities in PHP Core | Akamai","sources/akamai-blog-php-core-rce/index.html","source"],["src-arcticwolf-php2shell-exposure","Arctic Wolf Labs: Finding, Prioritizing, and Patching PHP2Shell Exposure | Arctic Wolf","sources/arcticwolf-php2shell-exposure/index.html","source"],["src-armis-php2shell-find-patch","Armis: Just a moment...","sources/armis-php2shell-find-patch/index.html","source"],["src-aws-security-blog-madpot","Amazon (CJ Moses, AWS Security Blog): Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | AW","sources/aws-security-blog-madpot/index.html","source"],["src-bbc-live-ckgel5xp2xv9t","BBC News: PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live","sources/bbc-live-ckgel5xp2xv9t/index.html","source"],["src-bloomberg-governments-offline","Bloomberg: Bloomberg - Are you a robot?","sources/bloomberg-governments-offline/index.html","source"],["src-broadcom-security-php2shell","Broadcom (Symantec) Security: PHP2Shell: Two Critical PHP Flaws Allow Unauthenticated Remote Code Execution | SECURITY.COM","sources/broadcom-security-php2shell/index.html","source"],["src-calif-php2shell","Calif (Calif Research): php2shell by Calif Research — A tale of two PHP remote vulnerabilities","sources/calif-php2shell/index.html","source"],["src-cccs-al26-026","Canadian Centre for Cyber Security (CCCS): AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619","sources/cccs-al26-026/index.html","source"],["src-cccs-alerts","CCCS: Alerts and advisories - Canadian Centre for Cyber Security","sources/cccs-alerts/index.html","source"],["src-ccn-cert-al-11-26","CCN-CERT (Spain): CCN-CERT AL 11/26: Actualización inmediata de vulnerabilidad crítica en PHP","sources/ccn-cert-al-11-26/index.html","source"],["src-certeu-sa-2026-018","CERT-EU: Security Advisory 2026-018: Critical Vulnerabilities in PHP","sources/certeu-sa-2026-018/index.html","source"],["src-certfr-2026-ale-014","CERT-FR (ANSSI): [Màj] Multiples vulnérabilités dans PHP (CERTFR-2026-ALE-014)","sources/certfr-2026-ale-014/index.html","source"],["src-certlv-php-preventive","CERT.LV (Latvia): Saistībā ar globāli atklātām PHP ievainojamībām Latvijā ievieš preventīvus pasākumus","sources/certlv-php-preventive/index.html","source"],["src-ch-bacs-warnung-php","Swiss Federal Office for Cyber Security (BACS / NCSC): Critical vulnerabilities in PHP: Install security updates immediately","sources/ch-bacs-warnung-php/index.html","source"],["src-ch-ncsc-home","Swiss BACS: BACS home","sources/ch-ncsc-home/index.html","source"],["src-cisa-alert-log4j-2021","CISA: Apache Releases Log4j Version 2.15.0 to Address Critical RCE Vulnerability Under Exploitation | CISA","sources/cisa-alert-log4j-2021/index.html","source"],["src-cisa-alert-php-20261021","US Cybersecurity and Infrastructure Security Agency (CISA): Critical Vulnerabilities in PHP Require Immediate Patching","sources/cisa-alert-php-20261021/index.html","source"],["src-cisa-ed-22-02-log4j","CISA: Page Not Found | CISA","sources/cisa-ed-22-02-log4j/index.html","source"],["src-cisa-home","CISA: Home Page | CISA","sources/cisa-home/index.html","source"],["src-cisa-kev-catalog","CISA: Known Exploited Vulnerabilities Catalog (JSON feed)","sources/cisa-kev-catalog/index.html","source"],["src-cisa-kev-json","CISA: CISA Known Exploited Vulnerabilities catalog (JSON feed)","sources/cisa-kev-json/index.html","source"],["src-cloudflare-blog-php2shell-waf","Cloudflare: Cloudflare deploys protections against php2shell vulnerability","sources/cloudflare-blog-php2shell-waf/index.html","source"],["src-cncs-pt-alerta-136114","CNCS (Portugal): Alerta de Vulnerabilidade PHP (CNCS)","sources/cncs-pt-alerta-136114/index.html","source"],["src-cnn-php2shell-websites-shut","CNN: Websites shut down globally after AI finds a critical flaw affecting 70% of the internet | CNN Business","sources/cnn-php2shell-websites-shut/index.html","source"],["src-cve-cve-2008-1447","CVE Program (cveawg API): CVE-2008-1447 (DNS cache poisoning, Kaminsky)","sources/cve-cve-2008-1447/index.html","source"],["src-cve-cve-2012-1823","CVE Program (cveawg API): CVE-2012-1823 (php-cgi query string)","sources/cve-cve-2012-1823/index.html","source"],["src-cve-cve-2014-0160","CVE Program (cveawg API): CVE-2014-0160 (Heartbleed)","sources/cve-cve-2014-0160/index.html","source"],["src-cve-cve-2014-6271","CVE Program (cveawg API): CVE-2014-6271 (Shellshock)","sources/cve-cve-2014-6271/index.html","source"],["src-cve-cve-2017-5638","CVE Program (cveawg API): CVE-2017-5638 (Apache Struts)","sources/cve-cve-2017-5638/index.html","source"],["src-cve-cve-2019-11043","CVE Program (cveawg API): CVE-2019-11043 (PHP-FPM underflow)","sources/cve-cve-2019-11043/index.html","source"],["src-cve-cve-2021-44228","CVE Program (cveawg API): CVE-2021-44228 (Log4Shell)","sources/cve-cve-2021-44228/index.html","source"],["src-cve-cve-2022-22965","CVE Program (cveawg API): CVE-2022-22965 (Spring4Shell)","sources/cve-cve-2022-22965/index.html","source"],["src-cve-cve-2023-34362","CVE Program (cveawg API): CVE-2023-34362 (MOVEit Transfer)","sources/cve-cve-2023-34362/index.html","source"],["src-cve-cve-2024-4577","CVE Program (cveawg API): CVE-2024-4577 (PHP-CGI argument injection)","sources/cve-cve-2024-4577/index.html","source"],["src-cve-cve-2026-109618","CVE Program (CNA: PHP Group): CVE-2026-109618: RCE via OOM corruption","sources/cve-cve-2026-109618/index.html","source"],["src-cve-cve-2026-109619","CVE Program (CNA: PHP Group): CVE-2026-109619: RCE via stale global state","sources/cve-cve-2026-109619/index.html","source"],["src-cybelangel-php2shell","CybelAngel: What We Know About php2shell [Critical update]","sources/cybelangel-php2shell/index.html","source"],["src-cyberexpress-php2shell-gov-sites","The Cyber Express: PHP2Shell CVE-2026-109618 PHP Flaw Hits Gov Sites","sources/cyberexpress-php2shell-gov-sites/index.html","source"],["src-cybernews-php2shell-millions","Cybernews: PHP2Shell exploit attempts hit millions, Amazon and Cloudflare warn | Cybernews","sources/cybernews-php2shell-millions/index.html","source"],["src-darkreading-php2shell-red-alert","Dark Reading: 'PHP2Shell' Bugs Signal Red Alert for Security Industry","sources/darkreading-php2shell-red-alert/index.html","source"],["src-daubois-blog-php2shell-rumors","Alexandre Daubois (PHP security team / PHP Foundation): What the PHP2Shell rumors got wrong, from inside the PHP security team","sources/daubois-blog-php2shell-rumors/index.html","source"],["src-dutchitleaders-websites-offline","Dutch IT Leaders: Just a moment...","sources/dutchitleaders-websites-offline/index.html","source"],["src-eadt-minister-budget-no-breach","East Anglian Daily Times (PA): No breach of Budget security after critical flaw found in PHP, minister says | East Anglian Daily Times","sources/eadt-minister-budget-no-breach/index.html","source"],["src-enisa-cnw-2026-04-php","ENISA / EU CSIRTs Network (CNW): CSIRTs Network - php2shell (CNW-2026-04)","sources/enisa-cnw-2026-04-php/index.html","source"],["src-equixly-php2shell-what-we-know","Equixly: CVE-2026-109618 and CVE-2026-109619: What we know about PHP2Shell and how to prepare | Equixly","sources/equixly-php2shell-what-we-know/index.html","source"],["src-fastly-blog-php2shell","Fastly: Fastly’s Proactive Protection for PHP2Shell, Critical PHP RCE CVE-2026-109618 and CVE-2026-109619 | Fastly","sources/fastly-blog-php2shell/index.html","source"],["src-fortinet-fortiweb-php2shell","Fortinet Community (FortiWeb knowledge base): How to block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb | Community","sources/fortinet-fortiweb-php2shell/index.html","source"],["src-gist-blevene-detection-guide","Blevene (GitHub gist): PHP2Shell: Detection Opportunities · GitHub","sources/gist-blevene-detection-guide/index.html","source"],["src-gist-silascutler-censys-query","Silas Cutler (GitHub gist): PHP2Shell Censys Query (CVE-2026-109618 / CVE-2026-109619 ) · GitHub","sources/gist-silascutler-censys-query/index.html","source"],["src-github-darkfibr-php2shell-detect","darkfibr (Mike Haddock), GitHub: GitHub - darkfibr/php2shell-detect: Defensive detection toolkit for php2shell (CVE-2026-109618/109619, PHP ","sources/github-darkfibr-php2shell-detect/index.html","source"],["src-github-ghsa-6wmf-4rv5-p3rp","PHP (php/php-src GitHub security advisory, published by bukka): RCE via stale global state (CVE-2026-109619)","sources/github-ghsa-6wmf-4rv5-p3rp/index.html","source"],["src-github-ghsa-w8hw-w9fx-j79w","PHP (php/php-src GitHub security advisory, published by bukka): RCE via OOM corruption (CVE-2026-109618)","sources/github-ghsa-w8hw-w9fx-j79w/index.html","source"],["src-github-lexsah-php2shell-detection","Lexsah, GitHub: GitHub - Lexsah/php2shell-detection: Detection and mitigation rules for CVE-2026-109618 / CVE-2026-109619 (php2shell). Blue-","sources/github-lexsah-php2shell-detection/index.html","source"],["src-github-php-src-branch-7.4-backport","php/php-src on GitHub: Branch PHP-7.4-CVE-2026-109618-109619","sources/github-php-src-branch-7.4-backport/index.html","source"],["src-github-php-src-fix-commit-3584a98bd","php/php-src (git), read from a clone: Commit 3584a98bd: Avoid state corruption via bailout (the php2shell fix) and the PHP-7.4 backport 712e","sources/github-php-src-fix-commit-3584a98bd/index.html","source"],["src-github-php-src-tag-php-8.5.12","php/php-src on GitHub (release by adoy): Release PHP 8.5.12","sources/github-php-src-tag-php-8.5.12/index.html","source"],["src-github-php-src-tags","php/php-src on GitHub: Tags · php/php-src","sources/github-php-src-tags/index.html","source"],["src-github-rjmendez-phpup-2026","rjmendez, GitHub: GitHub - rjmendez/phpup-2026: IOCs and detection rules for CVE-2026-109618 / CVE-2026-109619 (PHP session.upload_progress ","sources/github-rjmendez-phpup-2026/index.html","source"],["src-helsinkitimes-finland-shutdown","Helsinki Times: Government websites shut down in Finland over critical security flaws - Helsinki Times","sources/helsinkitimes-finland-shutdown/index.html","source"],["src-huntress-php2shell-rapid-response","Huntress: Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619) | Huntress","sources/huntress-php2shell-rapid-response/index.html","source"],["src-imperva-blog-php2shell","Imperva Threat Research (Nadav Avital, Bar Menachem): PHP2Shell: When PHP Runs Out of Memory at the Wrong Moment | Imperva","sources/imperva-blog-php2shell/index.html","source"],["src-insurancebusiness-uk-councils-met","Insurance Business (Matthew Sellers): UK councils and Met Police among sites pulled offline after NCSC alert | Insurance Business","sources/insurancebusiness-uk-councils-met/index.html","source"],["src-itdaily-php-clumsy-announcement","ITdaily (Jens Jonkers): PHP Foundation angered by ‘clumsy’ disclosure of vulnerabilities - ITdaily","sources/itdaily-php-clumsy-announcement/index.html","source"],["src-jpcert-at260033","JPCERT/CC (Japan): PHPにおける複数の脆弱性（CVE-2026-109618、CVE-2026-109619）に関する注意喚起 (JPCERT-AT-2026-0033)","sources/jpcert-at260033/index.html","source"],["src-jpcert-home","JPCERT/CC: JPCERT home","sources/jpcert-home/index.html","source"],["src-lbc-uk-websites-offline","LBC: Websites taken offline as ‘critical’ security flaw hits Met Police, Traitors and government sites | LBC","sources/lbc-uk-websites-offline/index.html","source"],["src-lorikeet-php2shell","Lorikeet Security: php2shell: Inside the Leaked Critical PHP Flaws Triggering Emergency RCE Patching (CVE-2026-109618 & CVE-2026-109619) | L","sources/lorikeet-php2shell/index.html","source"],["src-ncsc-news-php","UK National Cyber Security Centre (NCSC): Critical security issue affecting PHP","sources/ncsc-news-php/index.html","source"],["src-ncsc-nl-advisories","NCSC-NL: NCSC NL | Security Advisories (PHP banner: Ernstige kwetsbaarheden in PHP: bereid je voor op patchen)","sources/ncsc-nl-advisories/index.html","source"],["src-ncsc-nl-php2shell","NCSC-NL (Netherlands National Cyber Security Centre): NCSC-NL/php2shell: Operational information regarding the 2026 php2shell vulnerabilitie","sources/ncsc-nl-php2shell/index.html","source"],["src-ncsc-nl-php2shell-software-list","NCSC-NL (Netherlands National Cyber Security Centre): List of software with PHP dependency potentially affected by php2shell CVEs","sources/ncsc-nl-php2shell-software-list/index.html","source"],["src-ncsc-nz-alert-php","NCSC New Zealand: UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP","sources/ncsc-nz-alert-php/index.html","source"],["src-ncsc-nz-alerts","NCSC New Zealand: Alerts listing","sources/ncsc-nz-alerts/index.html","source"],["src-newsweek-php2shell-websites","Newsweek: PHP Vulnerability: List of Websites Powered by PHP as Hacker Threat Prompts Scramble - Newsweek","sources/newsweek-php2shell-websites/index.html","source"],["src-nsa-press-php-4630238","US National Security Agency (NSA): NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities","sources/nsa-press-php-4630238/index.html","source"],["src-nsa-x-2112903220209098897","NSA Cybersecurity (@NSACyber): NSA Cyber on X: Effective Immediately ... two critical vulnerabilities","sources/nsa-x-2112903220209098897/index.html","source"],["src-nsa-x-2113068811058622971","NSA Cybersecurity (@NSACyber): NSA Cyber on X: UPDATE: Specific mitigation guidance ... now available","sources/nsa-x-2113068811058622971/index.html","source"],["src-nsa-x-nsacyber","NSA Cybersecurity (@NSACyber): NSA Cyber (@NSACyber) / X profile timeline","sources/nsa-x-nsacyber/index.html","source"],["src-nsa-x-nsacyber-nitter","nitter.net: nitter.net (shutdown notice, no tweets)","sources/nsa-x-nsacyber-nitter/index.html","source"],["src-nvd-cve-2026-109618","NIST National Vulnerability Database: NVD - CVE-2026-109618","sources/nvd-cve-2026-109618/index.html","source"],["src-nvd-cve-2026-109619","NIST National Vulnerability Database: NVD - CVE-2026-109619","sources/nvd-cve-2026-109619/index.html","source"],["src-openai-blog-coordinated-disclosure","OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities","sources/openai-blog-coordinated-disclosure/index.html","source"],["src-openai-community-php-flaws","OpenAI Developer Community (user 'sps', Leader): OpenAI models help researchers uncover critical PHP security flaws","sources/openai-community-php-flaws/index.html","source"],["src-openai-patch-the-planet-launch","OpenAI: Patch the Planet (launch announcement)","sources/openai-patch-the-planet-launch/index.html","source"],["src-openwall-oss-security-109619-thread","oss-security list (replies: Aaron Rainbolt, Yves-Alexis Perez/Debian, Christian Fischer/Greenbone): Re: CVE-2026-109619 thread (21/16, 21/17","sources/openwall-oss-security-109619-thread/index.html","source"],["src-openwall-oss-security-2026-10-20-34","oss-security list (Alan Coopersmith, Oracle): Upcoming Critical PHP Security Release","sources/openwall-oss-security-2026-10-20-34/index.html","source"],["src-openwall-oss-security-2026-10-21-6","oss-security list (Jakub Zelenka, PHP security team): CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption","sources/openwall-oss-security-2026-10-21-6/index.html","source"],["src-openwall-oss-security-2026-10-21-7","oss-security list (Jakub Zelenka, PHP security team): CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state","sources/openwall-oss-security-2026-10-21-7/index.html","source"],["src-oxfordchronicle-councils-offline","Oxford Chronicle: Oxfordshire council websites offline amid critical global security issue | Oxford Chronicle","sources/oxfordchronicle-councils-offline/index.html","source"],["src-patchtheplanet-org","OpenAI (Patch the Planet / Daybreak): Patch the Planet — OpenAI","sources/patchtheplanet-org/index.html","source"],["src-php-foundation-blog-security-release","The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security","sources/php-foundation-blog-security-release/index.html","source"],["src-php-net-advisory","PHP Group (php.net): Security advisory: Critical remote code execution vulnerabilities, update now","sources/php-net-advisory/index.html","source"],["src-php-net-changelog-8","PHP Group (php.net): PHP 8 ChangeLog","sources/php-net-changelog-8/index.html","source"],["src-php2shell-com","OpenAI / Wiz / Calif joint microsite (php2shell.com): PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web","sources/php2shell-com/index.html","source"],["src-phparch-php-security-2025-audit","php[architect]: PHP Security in 2025: Lessons from the Core Security Audit | PHP Architect","sources/phparch-php-security-2025-audit/index.html","source"],["src-phpfoundation-blog-security-release-leak","The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security","sources/phpfoundation-blog-security-release-leak/index.html","source"],["src-prophetsecurity-php2shell-detect","Prophet Security: php2shell: Detecting and Investigating CVE-2026-109618 and CVE-2026-109619 | Prophet Security","sources/prophetsecurity-php2shell-detect/index.html","source"],["src-qualys-blog-php-preannounce","Qualys: 403 Forbidden","sources/qualys-blog-php-preannounce/index.html","source"],["src-quarkslab-blog-php-src-audit","Quarkslab: Security audit of PHP-SRC - Quarkslab's blog","sources/quarkslab-blog-php-src-audit/index.html","source"],["src-recordedfuture-php2shell","Recorded Future: PHP2Shell Exploitation: Two Critical PHP Flaws Explained","sources/recordedfuture-php2shell/index.html","source"],["src-reuters-factbox-websites-offline","Reuters factbox, via Global Banking and Finance: Global Websites Offline Amid PHP Security Flaws: Finance Sector Impact","sources/reuters-factbox-websites-offline/index.html","source"],["src-rijksoverheid-ncsc-php-news","Rijksoverheid (Dutch government) / NCSC-NL: NCSC: Ernstige kwetsbaarheden in PHP | Rijksoverheid.nl","sources/rijksoverheid-ncsc-php-news/index.html","source"],["src-safeguard-how-hard-to-exploit","Safeguard (vendor blog): PHP2Shell: How Hard Is It to Exploit, and What PHP Is Changing | Safeguard Blog","sources/safeguard-how-hard-to-exploit/index.html","source"],["src-safeguard-waf-rules-limits","Safeguard (vendor blog): PHP2Shell WAF rules: what they block and where they fall short | Safeguard Blog","sources/safeguard-waf-rules-limits/index.html","source"],["src-sansec-research-php2shell","Sansec: PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619) | Sansec","sources/sansec-research-php2shell/index.html","source"],["src-scotsman-edinburgh-council-offline","The Scotsman (Jack Davies): Edinburgh council website offline amid global cyber security alert","sources/scotsman-edinburgh-council-offline/index.html","source"],["src-securityweek-exploitation-days-before","SecurityWeek: PHP2Shell Exploitation Started Days Before Patches - SecurityWeek","sources/securityweek-exploitation-days-before/index.html","source"],["src-securityweek-first-attempts-sensors","SecurityWeek: PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors - SecurityWeek","sources/securityweek-first-attempts-sensors/index.html","source"],["src-securityweek-mass-exploitation-looms","SecurityWeek: PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws - SecurityWeek","sources/securityweek-mass-exploitation-looms/index.html","source"],["src-sentinelone-php2shell","SentinelOne: Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack Technique","sources/sentinelone-php2shell/index.html","source"],["src-socket-blog-embargo-dispute","Socket: Just a moment...","sources/socket-blog-embargo-dispute/index.html","source"],["src-substack-lopezkurtz-patch-is-the-exploit","David Lopez-Kurtz (Substack): The Patch Is the Exploit - by David Lopez-Kurtz","sources/substack-lopezkurtz-patch-is-the-exploit/index.html","source"],["src-techzine-php-chainguard","Techzine Global: PHP accuses Chainguard in PHP2shell","sources/techzine-php-chainguard/index.html","source"],["src-tenable-php2shell-faq","Tenable: php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®","sources/tenable-php2shell-faq/index.html","source"],["src-thehackernews-php2shell-4days","The Hacker News (Ravie Lakshmanan): Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed","sources/thehackernews-php2shell-4days/index.html","source"],["src-thehackernews-php2shell-unpatched-alert","The Hacker News: PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert","sources/thehackernews-php2shell-unpatched-alert/index.html","source"],["src-thehackernews-what-protects-you","The Hacker News: PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't","sources/thehackernews-what-protects-you/index.html","source"],["src-therecord-php-foundation-statement","The Record (Recorded Future News): PHP says AI review of critical bugs first sparked alarm in August, but signs surfaced in 2024 | The Recor","sources/therecord-php-foundation-statement/index.html","source"],["src-theregister-php-blames-chainguard","The Register: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk","sources/theregister-php-blames-chainguard/index.html","source"],["src-tpo-nl-digid-offline","TPO.nl: PHP-lek legt DigiD, MijnOverheid en Tweede Kamer plat | TPO.NL","sources/tpo-nl-digid-offline/index.html","source"],["src-watchtowr-php2shell","watchTowr: watchtowr.com","sources/watchtowr-php2shell/index.html","source"],["src-watchtowr-php2shell-faq","watchTowr: watchtowr.com","sources/watchtowr-php2shell-faq/index.html","source"],["src-weirdgloop-blog-php2shell","Weird Gloop (cookmeplox): Recent wiki downtime (PHP2Shell mitigation) | Weird Gloop","sources/weirdgloop-blog-php2shell/index.html","source"],["src-wikipedia-dan-kaminsky","Wikipedia (English): Dan Kaminsky - Wikipedia","sources/wikipedia-dan-kaminsky/index.html","source"],["src-wikipedia-equifax-breach","Wikipedia (English): 2017 Equifax data breach - Wikipedia","sources/wikipedia-equifax-breach/index.html","source"],["src-wikipedia-heartbleed","Wikipedia (English): Heartbleed - Wikipedia","sources/wikipedia-heartbleed/index.html","source"],["src-wikipedia-log4shell","Wikipedia (English): Log4Shell - Wikipedia","sources/wikipedia-log4shell/index.html","source"],["src-wikipedia-moveit-breach","Wikipedia (English): 2023 MOVEit data breach - Wikipedia","sources/wikipedia-moveit-breach/index.html","source"],["src-wikipedia-php2shell","Wikipedia (English): PHP2Shell - Wikipedia","sources/wikipedia-php2shell/index.html","source"],["src-wikipedia-shellshock","Wikipedia (English): Shellshock (software bug) - Wikipedia","sources/wikipedia-shellshock/index.html","source"],["src-wikipedia-spring-framework","Wikipedia (English): Spring Framework - Wikipedia","sources/wikipedia-spring-framework/index.html","source"],["src-wiz-blog-php2shell","Wiz (Wiz Research): PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet","sources/wiz-blog-php2shell/index.html","source"],["src-x-eastdakota-php2shell-stats","Matthew Prince (@eastdakota), Cloudflare CEO: Matthew Prince 🌥 on X: \"Some stats on #php2shell. In the 10 hours before it was publicly annou","sources/x-eastdakota-php2shell-stats/index.html","source"],["src-x-feross-chainguard","Feross Aboukhadijeh (@feross) on X: Feross on X: \"Chainguard received PHP’s fix for two critical RCEs under embargo, like every other distri","sources/x-feross-chainguard/index.html","source"],["src-x-lcfr-hax-hash-tweet","Ryan Austin (@lcfr_hax), Calif: LCFR on X: hash commitment d935be02…","sources/x-lcfr-hax-hash-tweet/index.html","source"],["src-x-openai-php2shell","OpenAI (@OpenAI): OpenAI on X: OpenAI models helped researchers ... discover critical security flaws in PHP","sources/x-openai-php2shell/index.html","source"],["src-x-wiz-io-php2shell","Wiz (@wiz_io): Wiz on X: BREAKING ... #PHP2SHELL ... impacting 70% of the Internet","sources/x-wiz-io-php2shell/index.html","source"],["src-yle-finland-government-sites-shut","Yle (Finnish public broadcaster): Finland temporarily shuts down government websites as a precaution for critical vulnerabilities | Yle News","sources/yle-finland-government-sites-shut/index.html","source"],["home-who","The briefing for you: fifteen readers","index.html#who","front"],["home-moments","How it unfolded: five moments","index.html#moments","front"],["home-stories","Stories: written here","index.html#stories","front"],["home-how","How this site knows","index.html#evidence","front"],["q-fix-or-wait","Can anything be done to fix it, or do we just have to wait for updates?","questions/fix-or-wait/index.html","question"],["q-most-websites","Is PHP really the software behind most websites?","questions/most-websites/index.html","question"],["q-been-hacked","Has anyone actually been hacked?","questions/been-hacked/index.html","question"],["q-passwords","Do I need to change my passwords?","questions/passwords/index.html","question"],["q-am-i-affected","How do I know whether my site is affected?","questions/am-i-affected/index.html","question"],["q-take-offline","Should we take our site offline?","questions/take-offline/index.html","question"],["q-why-big-news","Why is this such big news?","questions/why-big-news/index.html","question"],["q-old-php","We are on PHP 7.4, 8.0 or 8.1. Is there a patch?","questions/old-php/index.html","question"],["q-waf-enough","We are behind Cloudflare (or another firewall). Are we safe?","questions/waf-enough/index.html","question"],["q-change-code","Do our developers need to change our code?","questions/change-code/index.html","question"],["story-why-not-patch-every-version","Why can't every version of PHP just be patched?","articles/why-not-patch-every-version/index.html","story"],["story-where-php2shell-stands","Where php2shell stands: many sites dark, millions of attempts, no confirmed breach","articles/where-php2shell-stands/index.html","story"],["story-exposed-is-not-exploited","Exposed is not exploited: the sites php2shell did not hit, and what a hit will admit","articles/exposed-is-not-exploited/index.html","story"],["story-php2shell-in-perspective","php2shell in perspective: an old embargo model, a Log4Shell shape, and the shrinking gap between theory and proof","articles/php2shell-in-perspective/index.html","story"],["story-patch-at-the-speed-of-metasploit","Patch at the speed of Metasploit: where php2shell sits on the weaponisation ladder, and the attacks that come second and third","articles/patch-at-the-speed-of-metasploit/index.html","story"]],"examples":[{"id":"wordpress-shared","name":"A WordPress site behind Cloudflare, on Apache mod_php","components":[{"id":"net","kind":"internet","name":"The internet"},{"id":"cf","kind":"edge","name":"Cloudflare","vendor":"Cloudflare"},{"id":"wp","kind":"app","name":"WordPress shop","product":"WordPress project|WordPress"},{"id":"php","kind":"runtime","name":"PHP on the web server","version":"8.3.30","sapi":"Apache mod_php","controls":[]},{"id":"db","kind":"data","name":"MySQL: orders and customers","sensitivity":"personal"},{"id":"cfg","kind":"secret","name":"wp-config.php: database password, payment API key","sensitivity":"credentials"},{"id":"pay","kind":"service","name":"Payment provider API","sensitivity":"payment"}],"edges":[["net","cf"],["cf","wp"],["wp","php"],["php","db"],["php","cfg"],["php","pay"]]},{"id":"laravel-containers","name":"A Laravel API in containers on PHP-FPM, on AWS","components":[{"id":"net","kind":"internet","name":"The internet"},{"id":"aws","kind":"edge","name":"AWS load balancer and WAF","vendor":"AWS"},{"id":"api","kind":"app","name":"Customer API (Laravel)","product":"Laravel|Laravel 13 framework"},{"id":"img","kind":"platform","name":"Docker official php:8.4-fpm image","product":"Docker Official Images / docker-library PHP maintainers|Docker Official PHP FPM image variant"},{"id":"php","kind":"runtime","name":"PHP-FPM in the container","version":"8.4.20","sapi":"PHP-FPM","controls":["cgroup_memory"]},{"id":"pg","kind":"data","name":"Postgres: accounts","sensitivity":"personal"},{"id":"s3","kind":"data","name":"S3 bucket: uploaded documents","sensitivity":"personal"},{"id":"env","kind":"secret","name":"Environment: AWS keys, APP_KEY","sensitivity":"credentials"},{"id":"queue","kind":"service","name":"Billing worker (queue)","sensitivity":"payment"}],"edges":[["net","aws"],["aws","api"],["api","img"],["img","php"],["api","php"],["php","pg"],["php","s3"],["php","env"],["php","queue"]]},{"id":"internal-74","name":"An internal tool on PHP 7.4 from Ubuntu Focal, reachable only on the VPN","components":[{"id":"tool","kind":"app","name":"Staff directory tool","product":""},{"id":"deb","kind":"platform","name":"Ubuntu 20.04 php7.4-fpm package","product":"Canonical / Ubuntu package maintainers|Ubuntu Focal php7.4-fpm binary package"},{"id":"php","kind":"runtime","name":"PHP 7.4 FPM","version":"7.4.3","sapi":"PHP-FPM","controls":[]},{"id":"ldap","kind":"service","name":"LDAP directory","sensitivity":"credentials"}],"edges":[["tool","deb"],["deb","php"],["tool","php"],["php","ldap"]]}],"pulse":"Coming: the pulse adds other vulnerabilities, in other products, as rows in the same catalogue, each with its own rule. A stack saved today is checked against them as they arrive, and the items about them are matched to it the same way."}