0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Cachet project | Cachet | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown The official Cachet repository requires PHP 8.3 or later for the self-hosted status page system, and GitHub exposes an SPDX dependency-graph SBOM for the repository. |
source 1 source 2 |
|
| CakePHP project | CakePHP framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. CakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages. |
source | |
| Canonical / Ubuntu package maintainers | Ubuntu Bionic php7.2-fpm binary package | 7.2.24-0ubuntu0.18.04.17+esm14 | Fix | Fix | CVE assessment: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 with Ubuntu Pro. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Focal php7.4-fpm binary package | 7.4.3-4ubuntu2.29+esm5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 with Ubuntu Pro. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Jammy php8.1-fpm binary package | 8.1.2-1ubuntu2.28 | Fix | Fix | CVE assessment: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Jammy php8.1-fpm 8.1.2-1ubuntu2.28. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Noble php8.3-fpm binary package | 8.3.6-0ubuntu0.24.04.13 | Fix | Fix | CVE assessment: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13. |
source 1 source 2 |
| Canonical / Ubuntu package maintainers | Ubuntu optional PHP package and SAPI family | Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows. USN-8948-1 supplies fixes for the listed Ubuntu Apache-module, CGI, CLI and FPM packages; separately inventoried FPM rows also retain USN-8948-2 release and entitlement scope. |
source 1 source 2 source 3 source 4 |
| Canonical / Ubuntu package maintainers | Ubuntu Resolute php8.5-fpm binary package | 8.5.4-0ubuntu1.5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Resolute php8.5-fpm 8.5.4-0ubuntu1.5. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Stonking php8.5-fpm binary package | 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1 Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Stonking php8.5-fpm 8.5.9-0ubuntu2.1. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Trusty php5-fpm binary package | 5.5.9+dfsg-1ubuntu4.29+esm18 | Fix | Fix | CVE assessment: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 with Ubuntu Pro Legacy Support. |
source |
| Canonical / Ubuntu package maintainers | Ubuntu Xenial php7.0-fpm binary package | 7.0.33-0ubuntu0.16.04.16+esm22 | Fix | Fix | CVE assessment: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 with Ubuntu Pro Legacy Support. |
source |
| CaptainHook / Sebastian Feldmann and contributors | CaptainHook PHP Git-hook manager | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for captainhook/captainhook 5.29.2 declares PHP >=8.0 for this tool/library. |
source | |
| CarbonPHP project | Carbon date/time library | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Carbon is a PHP DateTime API library with translation, clock and polyfill dependencies. |
source | |
| Catalyst IT / Mahara project | Mahara | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement. |
source 1 source 2 |
|
| Centreon | Centreon Web and central-server PHP interface | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor installation procedure explicitly enables PHP 8.2 for the central web environment. |
source 1 source 2 |
|
| Chamilo Association / Chamilo project | Chamilo | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced. |
source | |
| Check Point | Check Point firewall web interfaces | sk1000302 hotfix: R81.10 / R81.20 / R82 / R82.10 / R82.20; Spark R81.10.17 build 996004992 or R82.00.11 build 998002823 | Fix | Fix | CVE assessment: Check Point sk1000302 confirms released hotfixes implementing the PHP 7.4 fix for both CVEs. Install the matching sk1000302 hotfix and reboot. R81.20 requires Jumbo Hotfix Take 166 or higher. Older end-of-support versions outside the listed fix scope are not declared fixed. |
source |
| Checkmk GmbH | Checkmk Appliance | 1.7.25 | Fix | Fix | CVE assessment: Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update Checkmk's appliance 1.7.25 release manifest upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release for both php2shell CVEs. |
source 1 source 2 source 3 |
| CIRCL, Luxembourg | CIRCL-operated MISP threat-sharing service | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown CIRCL publicly states it operates multiple MISP instances; MISP's server PHP relationship is independently documented. |
source 1 source 2 |
|
| CircleCI | CircleCI cimg/php CI runtime image family | cimg/php:8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (linux/amd64 and linux/arm64) | Fix | Fix | CVE assessment: cimg/php:8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (linux/amd64 and linux/arm64) CircleCI's merged release PR specifies the patched PHP versions; its image guide explains the versioned tags. Published base-tag metadata corroborates availability for the recorded platforms. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 source 9 source 10 |
| Cisco | AppDynamics On-Premises Secure Application | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | AppDynamics PHP Agent | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | AppDynamics SaaS Secure Application | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco AI Defense (hybrid on-premises deployment) | Not vuln | Not vuln | Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco AI Defense (hybrid on-premises deployment) as not vulnerable to CVE-2026-109618 and CVE-2026-109619. | source | |
| Cisco | Cisco ASR 5000 Series Software (StarOS) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Business Process Automation (BPA) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Catalyst Center (formerly DNA Center) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. |
source |
| Cisco | Cisco Catalyst SD-WAN Manager | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco CX Cloud | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. |
source |
| Cisco | Cisco Defense Orchestrator | Security Cloud Control - Firewall Management (formerly Defense Orchestrator) | Not vuln | Not vuln | CVE assessment: Cisco confirms Security Cloud Control - Firewall Management, formerly Cisco Defense Orchestrator, is not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Expressway Select Series | 15.5.21 | Fix | Fix | CVE assessment: Cisco advisory v1.9 lists 15.5.21 as an available fixed release for Expressway Select Series (CSCwx37062). Upgrade to Expressway Select 15.5.21; Cisco confirms availability under CSCwx37062. |
source |
| Cisco | Cisco Expressway Series | 15.5.21 | Fix | Fix | CVE assessment: Cisco advisory v1.9 lists 15.5.21 as an available fixed release for Expressway Series (CSCwx37062). Upgrade to Expressway 15.5.21; Cisco confirms availability under CSCwx37062. |
source |
| Cisco | Cisco Hypershield | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Identity Services Engine (ISE) | ISE; excludes separately investigated ISE Portal Builder | Not vuln | Not vuln | CVE assessment: Cisco confirms ISE is not vulnerable. ISE Portal Builder remains separately under investigation; that component is not covered by this conclusion. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Identity Services Engine (ISE) Portal Builder | Vulnerable | Vulnerable | CVE assessment: Cisco advisory version 1.8 (Final, 2026-10-27) lists ISE Portal Builder as vulnerable and offline for remediation. It does not confirm a released fix; the separate ISE product's Not vuln assessment does not cover Portal Builder. Follow Cisco's remediation status for Portal Builder. Service shutdown is not confirmation of a software fix. |
source | |
| Cisco | Cisco IoT Control Center | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. |
source |
| Cisco | Cisco Meraki Dashboard | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. |
source |
| Cisco | Cisco Multicloud Defense | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Nexus Dashboard Insights | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Panoptica | Cisco final advisory v1.9 (2026-10-28): unlisted-product scope | Not vuln | Not vuln | Not vuln under Cisco final advisory v1.9: Cisco states that products absent from the advisory are not affected; Panoptica is absent. This applies the explicit vendor coverage rule, rather than an individually named not-vulnerable entry. | source |
| Cisco | Cisco Policy Suite (CPS) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Secure Access | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Secure Email Threat Defense | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco Ultra Cloud Core - Converged Policy and Charging | Cisco advisory 1.7 confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.7 explicitly lists Ultra Packet Core - Converged Policy and Charging as confirmed not vulnerable to both CVEs. This matches the existing Ultra Cloud Core product entry; no status is inferred from absence. No remediation is required for this vendor-confirmed non-vulnerable product scope. |
source |
| Cisco | Cisco Ultra Cloud Core - Policy Control Function | PCF / SMI scope named under Ultra Packet Core in the advisory | Not vuln | Not vuln | CVE assessment: Cisco confirms the named PCF and SMI products are not vulnerable; the advisory uses Ultra Packet Core naming for these Ultra Cloud Core components. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source 1 source 2 |
| Cisco | Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure | PCF / SMI scope named under Ultra Packet Core in the advisory | Not vuln | Not vuln | CVE assessment: Cisco confirms the named PCF and SMI products are not vulnerable; the advisory uses Ultra Packet Core naming for these Ultra Cloud Core components. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source 1 source 2 |
| Cisco | Cisco Ultra-Reliable Wireless Backhaul (URWB) | URWB; affected release range not specified | Vulnerable | Vulnerable | CVE assessment: Cisco lists URWB as vulnerable under CSCwx37073 and requires an authenticated administrator for exploitation. Release 27.1.1 is only estimated for February 2027, not an available fix. Monitor CSCwx37073 for an available fixed release; do not treat its estimated date as released software. |
source |
| Cisco | Cisco Umbrella | Not vuln | Not vuln | Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco Umbrella as not vulnerable to CVE-2026-109618 and CVE-2026-109619. | source | |
| Cisco | Cisco Unified Industrial Wireless Software | Vulnerable | Vulnerable | CVE assessment: Cisco advisory version 1.8 (Final, 2026-10-27) lists Unified Industrial Wireless Software as vulnerable. Bug CSCwx37073 lists 27.1.1 for March 2027; this is a planned release, not an available fix. Follow Cisco's product-specific guidance and release availability for CSCwx37073; no currently available fixed build is confirmed by this advisory. |
source | |
| Cisco | Cisco Vulnerability Management (formerly Kenna.VM) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Cisco WAN Automation Engine (WAE) | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. |
source |
| Cisco | Cisco+ Secure Connect | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.4 explicitly lists this product as confirmed not vulnerable to both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Cisco | Slido | Vendor-confirmed not vulnerable product scope | Not vuln | Not vuln | CVE assessment: Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. Cisco advisory version 1.6 (2026-10-23) explicitly lists this product under Products Confirmed Not Vulnerable for both CVEs. |
source |
| Cisco | Webex | Webex Meetings, Webex Teams and Webex Web SDK only | Not vuln | Not vuln | CVE assessment: Cisco explicitly confirms Webex Meetings, Teams and Web SDK are not vulnerable. This assessment is limited to those named offerings, not every Webex-branded product. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Citrix / NetScaler | Citrix NetScaler ADC and Citrix NetScaler Gateway | Fixed in NetScaler ADC and Gateway 14.1-73.49 and later; 13.1-64.32 and later releases of 13.1; ADC 14.1-FIPS 14.1-73.49 FIPS and later; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later; earlier builds impacted | Fix | Fix | CVE assessment: CTX697263, updated 2026-10-27, lists fixed NetScaler ADC and NetScaler Gateway releases: NetScaler ADC and Gateway 14.1-73.49 and later; 13.1-64.32 and later releases of 13.1; ADC 14.1-FIPS 14.1-73.49 FIPS and later; ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.286 and later. Earlier builds remain impacted. Exposure is the PHP-based management access (NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI). Citrix NetScaler Console is listed as not impacted; NetScaler Product Security also excludes NetScaler SVM. Official vendor assessment: CTX697263, updated 2026-10-27, lists fixed Citrix NetScaler ADC and Citrix NetScaler Gateway releases for CVE-2026-109618 and CVE-2026-109619 (14.1-73.49, 13.1-64.32, 14.1-73.49 FIPS, 13.1.37.286 FIPS/NDcPP); earlier builds remain impacted. |
source 1 source 2 source 3 source 4 |
| CiviCRM project | CiviCRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Publisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release's direct manifest. |
source 1 source 2 |
|
| ClassicPress project | ClassicPress | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files. |
source 1 source 2 |
|
| Cleo | Cleo Streem (Streem Print) | Patch available by mail; fixed release not publicly stated | Fix | Fix | CVE assessment: Fix available by mail according to maintainer-accepted PR #41; fixed release not publicly stated. Cleo Streem release notes establish a PHP-bearing product scope. PR #41 reports that the PHP2Shell fix is distributed by email from Streem support; no public fixed build was independently verified. |
source 1 source 2 |
| Clever Cloud fork of Caucho Technology Quercus | Quercus CleverCloud development branch | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The branch maintainer identifies a Java PHP implementation copied from Caucho Quercus/Resin. |
source | |
| Clientexec | Clientexec | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown Official Clientexec system requirements list PHP runtime support for Clientexec 6.x and 7.x plus required extensions and ionCube Loader versions. |
source | |
| Cloudflare | Cloudflare Pages v1 legacy PHP build image | Investigation | Investigation | CVE assessment: Historical scope; current use unknown The build-image page retains a legacy PHP row and separately dates v1 migration to v3 before this retrieval. |
source | |
| CloudLinux | CloudLinux ea-PHP fixed packages for CloudLinux 7-10 | ea-php52 through ea-php85: vendor fixed build matrix released 2026-10-21 20:55 UTC (EL7/8/9/10) | Fix | Fix | CVE assessment: CloudLinux confirms fixed ea-php52 through ea-php85 packages in stable for EL7/8/9/10. Use the exact vendor package revisions, not the upstream PHP number alone: for example ea-php84 8.4.26-2.elX.cloudlinux.1 contains both fixes. CL6 and other platforms are not included in this fixed scope. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| CloudLinux | CloudLinux legacy ea-PHP extended-support packages | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: CloudLinux confirms released ea-php52 through ea-php85 security builds for EL7/8/9/10, recorded in PHP-0744. The historical family includes CloudLinux 6, which is not covered by this fixed matrix. Unpatched builds remain affected; upstream PHP version numbers alone cannot identify the vendor backport. CloudLinux has released fixed ea-PHP builds for EL7/8/9/10; the historical broader platform scope is retained separately. |
source 1 source 2 source 3 |
| CloudLinux / TuxCare | CloudLinux Alt-PHP / PHP Selector runtime family | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: CloudLinux confirms fixed Alt-PHP packages for the listed CloudLinux 7-10 and Ubuntu 22.04 branch combinations; these are recorded in PHP-0743. The broad family remains Vulnerable for unpatched runtimes; the notice does not establish fixed coverage for CloudLinux 6 or every unlisted platform/branch combination. CloudLinux has released additional platform-specific Alt-PHP fixes, recorded separately without extending them to unlisted platforms. |
source 1 source 2 source 3 |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 7.4 fixed package set | Fix | Fix | CVE assessment: Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04 CloudLinux reports fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, 18.04, 22.04, 24.04 and 26.04. |
source | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23 | Fix | Fix | CVE assessment: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23 CloudLinux reports a fixed alt-php80 release for Alpine Linux 3.23. |
source | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP fixed packages for CloudLinux 7-10 and Ubuntu 22.04 | Stable security builds released 2026-10-21/22; CL8/9 PHP 8.2.35-1, 8.3.36-1, 8.4.27-1, 8.5.12-1 also released 2026-10-23 | Fix | Fix | CVE assessment: CloudLinux confirms fixed alt-php 5.2-5.6, 7.0-7.4 and 8.0-8.5 for CL7/8/9; Ubuntu 22.04 covers 5.2, 5.6, 7.0-7.4 and 8.0-8.5. CL10 has fixed 5.2 in stable and other branches through ELS ALT PHP. CL8/9 also have new upstream-number builds for 8.2-8.5. CL6 and unlisted platform/branch combinations are excluded. Check backport revisions and changelogs. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| Code LTS / William Desportes and contributors | Doctum PHP API documentation generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for code-lts/doctum v5.6.0 declares PHP ^8.1 for this tool/library. |
source | |
| Codeception / Michael Bodnarchuk and contributors | Codeception PHP test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for codeception/codeception 5.3.7 declares PHP ^8.2 for this tool/library. |
source | |
| CodeIgniter Foundation | CodeIgniter 4 framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific. |
source | |
| Combodo | iTop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official application manifest declares a bounded PHP runtime requirement separately from development packages. |
source | |
| Composer / Packagist project | Packagist.org open-source web application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation. |
source 1 source 2 |
|
| Composer / Satis maintainers | Satis Composer repository generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for composer/satis 1.0.0 legacy tag declares PHP ^5.6 || ^7.0 for this tool/library. |
source 1 source 2 |
|
| Composer / Satis maintainers | Satis official PHP container build recipe | composer/satis:latest with PHP 8.4.27 (2026-10-29 digest scope) | Fix | Fix | CVE assessment: composer/satis:latest with PHP 8.4.27 (2026-10-29 digest scope) Satis documentation identifies the official image and PHP runtime recipe but does not announce these fixes. Fix applies to the checked published image digest containing PHP 8.4.27, as established by registry metadata and PHP's advisories. |
source 1 source 2 source 3 source 4 source 5 |
| Composer project | Composer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Composer itself runs on PHP, while its platform model describes PHP, ext-* and lib-* requirements separately from the project packages it manages. |
source 1 source 2 |
|
| Composer project / Docker Official Images | Composer default Docker runtime image | composer:2 with PHP 8.5.12 (2026-10-29 digest scope) | Fix | Fix | CVE assessment: composer:2 with PHP 8.5.12 (2026-10-29 digest scope) The official repository and readable image page establish publisher and artifact identity. No product-specific fix announcement was found; Fix is based on the checked image's PHP 8.5.12 runtime metadata and PHP's advisories. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 |
| Concrete CMS / PortlandLabs | Concrete CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Concrete states that it is primarily written in PHP and gives a per-release PHP compatibility table. |
source | |
| Contao project | Contao CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions. |
source | |
| Contao project | Contao Manager | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Contao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation. |
source | |
| Coolify | Coolify | Coolify 4.0.1 / 4.1.3 / 4.2.1 / 4.3.24 / 4.4.7 on their respective v4 lines | Fix | Fix | CVE assessment: Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| Corporation for Digital Scholarship / Omeka project | Omeka Classic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project provides version-specific PHP requirements and separately requires ImageMagick for image resizing. |
source | |
| Corporation for Digital Scholarship / Omeka project | Omeka S | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends. |
source | |
| Couchbase, Inc. | Couchbase native PHP SDK extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Version 4.5.0 is a PHP client extension. Vendor notes update its native C++ core to 1.3.1 and drop PHP 8.1 support despite the registry minimum. |
source 1 source 2 source 3 source 4 |
|
| Couchbase, Inc. | Couchbase PHP Composer SDK package | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The 4.5.0 userland package requires JSON; sockets is require-dev, while gRPC/Protobuf are suggestions. |
source 1 source 2 |
|
| Couchbase, Inc. | Couchbase PHP OpenTelemetry integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown The integration requires PHP>=8.2, couchbase/couchbase^4.5, open-telemetry/api^1.0 and exporter-otlp^1.4. |
source | |
| Craft CMS / Pixel & Tonic | Craft CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Craft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line. |
source | |
| Crater Invoice | Crater | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown The official Crater repository identifies an invoicing application and its installer config sets a minimum PHP version of 7.4.0; GitHub exposes an SPDX dependency-graph SBOM for the repository. |
source 1 source 2 |
|
| CS-Cart | CS-Cart and Multi-Vendor | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor. |
source | |
| CyberPanel project | CyberPanel hosted PHP / LSPHP options | Ubuntu 26.04 LSPHP: 8.2.35-1+resolute, 8.3.36-1+resolute, 8.4.27-1+resolute or 8.5.12-1+resolute | Fix | Fix | CVE assessment: CyberPanel confirms fixed LiteSpeed packages for both CVEs and verifies this Ubuntu 26.04 configuration. The fix requires matching modules, refreshing the separate panel PHP copy and recycling workers. Other OS/package combinations need separate confirmation. Apply the vendor's PHP package and panel-copy procedure; this is not a new CyberPanel source release or confirmation that customer installations have been patched. |
source 1 source 2 source 3 |