0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| aaPanel | aaPanel PHP Project hosting and CLI selection | aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Acquia | Acquia Cloud Platform PHP hosting | Cloud Platform 2026-10-22: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: Cloud Platform 2026-10-22: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 Acquia publishes selectable PHP runtime settings for Cloud Platform environments. |
source 1 source 2 source 3 source 4 |
| Adiscon / LogAnalyzer project | Adiscon LogAnalyzer PHP web application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project identifies LogAnalyzer as a PHP syslog web application; its Composer platform value is only a resolution target. |
source 1 source 2 |
|
| Adobe | Adobe Commerce | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Adobe separately lists PHP modules for its commercial and open-source editions, requires pcntl for parallel indexers, and publishes per-release PHP matrices. |
source 1 source 2 |
|
| Adyen | Adyen API PHP library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Adyen's library metadata requires PHP >=7.3 and ctype, curl, json, mbstring and openssl in the calling application. |
source | |
| AfterLogic | AfterLogic WebMail Lite PHP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor requirements were re-read: PHP >=7.4 and mysqlnd-backed database access apply to the Lite PHP webmail application, separately from its mail services and other editions. |
source | |
| Aimeos project | Aimeos Laravel package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official package README requires PHP and adds shop/admin routes and PHP Artisan setup/jobs to Laravel. |
source | |
| Aimeos project | Aimeos TYPO3 extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official 2025.x installation guide requires PHP for its TYPO3 commerce extension. |
source | |
| Akaunting | Akaunting self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The application's root runtime requirements explicitly declare PHP and thirteen extensions; README separates PHP from the Node asset pipeline. |
source 1 source 2 |
|
| Akeneo | Akeneo PIM Community Edition | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown The official Akeneo PIM Community Edition Composer manifest declares PHP 8.1.* and required extensions. |
source | |
| Alpine Linux package maintainers | Alpine Linux v3.22 php84 package family | 8.4.27-r0 | Fix | Fix | CVE assessment: Alpine v3.22 community/php84 secfixes metadata lists both CVEs as fixed in 8.4.27-r0; the official x86_64 package catalogue confirms that build. Update the installed packages and restart PHP workers. Install php84 8.4.27-r0 or a later vendor-fixed build from Alpine v3.22 and restart PHP workers. |
source 1 source 2 |
| Amazon Web Services | AWS Elastic Beanstalk PHP platform | AL2023 PHP 8.2-8.5 platform version 4.13.13 | Fix | Fix | CVE assessment: AWS confirms released AL2023 PHP platform 4.13.13 with upstream fixes: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The earlier configuration-only platform update is not the fix recorded here. Update the environment platform to the applicable 4.13.13 release; managed updates apply during the configured maintenance window. |
source 1 source 2 source 3 source 4 |
| Amazon Web Services | AWS SDK for PHP v3 | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown AWS SDK 3.401.2 declares PHP >=8.1 and json/pcre/simplexml. aws/aws-crt-php is required as a userland package; it does not prove ext-awscrt is loaded. |
source 1 source 2 |
|
| Amazon Web Services; third-party/customer PHP runtime publisher | AWS Lambda customer PHP custom-runtime option | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown Bref explains that its PHP runtime names resolve to provided.al2023 plus a PHP layer, rather than native AWS PHP support. |
source 1 source 2 |
|
| AMPHP project | AMP asynchronous PHP framework | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown AMP is a PHP asynchronous programming library with a PHP runtime constraint and a separate event-loop dependency. |
source | |
| Antagonist | Antagonist DirectAdmin PHP hosting selector | Provider-patched managed hosting, including PHP Extended Support, by 2026-10-22; build numbers unpublished | Fix | Fix | CVE assessment: Antagonist confirms security updates for both CVEs were installed across its managed hosting systems, including older PHP versions under Extended Support. Original PHP version numbers were retained; exact patched builds are not published. No customer PHP patch installation is required for this provider-managed hosting scope. |
source 1 source 2 |
| Apache Friends | XAMPP | Windows x64 installers 8.3.36, 8.4.27 or 8.5.12 | Fix | Fix | CVE assessment: Apache Friends publishes Windows installers with matching fixed PHP versions; PHP's advisory confirms both CVE fixes. This finding covers those Windows builds only; Linux, macOS and older installers are not confirmed fixed. Install a listed fixed Windows bundle and ensure its PHP runtime is selected; restart the bundled services. |
source 1 source 2 source 3 |
| APCu / PHP extension maintainers | APCu native PHP user-cache extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official catalogue identifies APCu as APC User Cache and declares its selected release PHP requirement. |
source | |
| API Platform project | API Platform Core | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The API framework core declares PHP and runtime Symfony components; Laravel/Doctrine and tooling entries in require-dev are not automatically mandatory production dependencies. |
source | |
| Arch Linux package maintainers | Arch Linux Extra PHP package | 8.5.12-1 | Fix | Fix | CVE assessment: Fixed in Arch Linux php 8.5.12-1 Arch Linux states that php versions before 8.5.12 are affected by both CVEs; the current Extra package page lists php 8.5.12-1. |
source 1 source 2 |
| Arch Linux package maintainers | Arch Linux Extra php-legacy package | 8.3.36-1 | Fix | Fix | CVE assessment: Fixed in Arch Linux Extra php-legacy 8.3.36-1 Arch Linux states that php-legacy versions before 8.3.36 are affected by both CVEs; the current Extra package page lists php-legacy 8.3.36-1. |
source 1 source 2 |
| Artefactual Systems / AtoM project | AtoM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 2.9 manual requires PHP for archival description software and distinguishes PHP modules from Elasticsearch, ImageMagick and other external services/tools. |
source | |
| Artem Loboda / Zuzlan community builds | Zuzlan community PHP 5.6 RPMs for CentOS 6.10 i686 | 5.6.40-47.3.el6.local | Fix | Fix | CVE assessment: Maintainer-reported minimal EOL mitigation in 5.6.40-47.3.el6.local for CentOS 6.10 i686. This assessment is limited to the named community artifacts. It does not describe unmodified CentOS packages, all PHP installations, deployment or service restart. Maintainer-published PHP2Shell backport RPMs for CentOS 6.10 i686, with source and build materials. Full regression suites retain failures. |
source 1 source 2 source 3 source 4 |
| Artem Loboda / Zuzlan community builds | Zuzlan community PHP 8.0 RPMs for CentOS 7.9 x86_64 | 8.0.30-100.local.sec20261030.el7 | Fix | Fix | CVE assessment: Maintainer-reported minimal EOL mitigation in 8.0.30-100.local.sec20261030.el7 for CentOS 7.9 x86_64. This assessment is limited to the named community artifacts. It does not describe unmodified CentOS packages, all PHP installations, deployment or service restart. Maintainer-provided PHP2Shell backport RPMs for CentOS 7.9 x86_64, with source and build materials. Published as a locally validated upgrade candidate. |
source 1 source 2 source 3 source 4 |
| Ascensio System SIA / ONLYOFFICE | ONLYOFFICE integration for Nextcloud | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The vendor connector manifest requires PHP; the repository separately describes a required ONLYOFFICE Document Server. |
source 1 source 2 |
|
| Auth0 | Auth0 PHP SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The SDK requires PHP ^8.2, json, mbstring, openssl and PSR HTTP implementations. Cache/event-dispatcher implementations are suggested. |
source | |
| Automattic / WordPress.com | WordPress.com plugin-enabled PHP hosting environment | WordPress.com managed service protected as of 2026-10-21; patched build unpublished | Fix | Fix | CVE assessment: WordPress.com confirms all hosted sites, including plugin-enabled plans, are already protected. Its patched-version FAQ also covers displayed PHP 8.3.35 and 8.4.26. No customer PHP update is required; self-hosted sites and other hosts are excluded. No customer PHP patching is required for sites hosted on WordPress.com. Assess sites hosted elsewhere independently. |
source 1 source 2 |
| AWS SDK Common Runtime team | AWS Common Runtime native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Publisher requirements distinguish UNIX and Windows PHP minima and document OpenSSL-linked builds versus an AWS-LC build option. |
source 1 source 2 |
|
| AWS SDK Common Runtime team | AWS Common Runtime PHP userland binding package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The Composer package declares PHP >=5.5 and suggests ext-awscrt while explicitly stating that the native extension is needed to use its functionality. |
source |