0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| F5 | BIG-IP APM PHP page templates | BIG-IP 17.1.3.7 / 17.5.1.11 / 21.1.0.4 | Fix | Fix | CVE assessment: F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable. F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable. |
source 1 source 2 source 3 |
| F5 | BIG-IP TMOS platform PHP | BIG-IP 17.1.3.7 / 17.5.1.11 / 21.1.0.4 | Fix | Fix | CVE assessment: F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable. F5 K000163821, updated 2026-10-24, lists fixes in 17.1.3.7, 17.5.1.11 and 21.1.0.4 for both CVEs. APM exposure concerns the data-plane access profile; all-module control-plane exposure concerns the Configuration utility. Earlier affected releases remain vulnerable. |
source 1 source 2 source 3 |
| Facebook / HHVM project | HHVM 3.30 PHP-compatible legacy line | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The 3.30 announcement identifies the final PHP-compatible release family. |
source 1 source 2 source 3 |
|
| Facebook / HipHop project | HipHop for PHP compiler (HPHPc) | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance Facebook describes replacing its PHP-to-C++ HipHop compiler with HHVM in early 2013. |
source | |
| Fedora Project PHP maintainers | Fedora PHP distribution package family | php-8.4.27-2.fc43; php-8.5.12-1.fc44; php-8.5.12-1.fc45; php-8.5.12-1.fc46 (Rawhide) | Fix | Fix | CVE assessment: Fedora bug 2556842 names both CVEs and the fixed RPMs. Fedora Update System confirms the Fedora 43 and 45 updates reached stable; the report also records the Fedora 44 update as live and Fedora 46/Rawhide as pushed. Only the listed builds are assessed as fixed. Fedora bug 2556842 names both CVEs and the fixed RPMs. Fedora Update System confirms the Fedora 43 and 45 updates reached stable; the report also records the Fedora 44 update as live and Fedora 46/Rawhide as pushed. Only the listed builds are assessed as fixed. |
source 1 source 2 |
| Feng Office | Feng Office Community Edition | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official Community repository explicitly requires a PHP/MySQL web-server environment and documents application installation/cron setup. |
source | |
| Fiery | Fiery Digital Front End (DFE) | Fiery FS200/300/350/400/500/600/700/800, including Pro variants; patch releases are planned, not yet confirmed available | Vulnerable | Vulnerable | CVE assessment: XRX26-016 v4 confirms both CVEs affect this product. Target patches: FS800/700/600/500, including Pro variants, by 2026-11-09; FS400/350/300, including Pro variants, by 2026-11-16; FS200 and FS200 Pro by 2026-11-23. These are planned dates, not released fixes. Monitor Xerox and Fiery advisories. Affected PHP component; the bulletin does not publish exact PHP or product build numbers. |
source 1 source 2 |
| FileCloud | FileCloud Server PHP installation and maintenance | FileCloud Server 23.263.2 (PHP 8.4.27), Windows and Linux | Fix | Fix | CVE assessment: Fixed in FileCloud Server 23.263.2, which includes PHP 8.4.27, for Windows and Linux. Earlier Server versions are affected. This does not confirm completion of the separately announced FileCloud Online rollout. FileCloud confirms that Server 23.263.2 includes PHP 8.4.27 and fixes both CVEs on Windows and Linux. |
source 1 source 2 |
| FileGator project | FileGator | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project requires a PHP web server and ZIP; its sample distro installation also installs mbstring, DOM and XML packages. |
source | |
| FileRun | FileRun | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The application remains affected on an unpatched PHP runtime; confirmed fixed distribution scopes are recorded separately in PHP-0734. |
source 1 source 2 |
|
| FileRun | FileRun official Docker image (fixed PHP rebuild) | filerun/filerun:2026.03 rebuilt with fixed PHP, announced 2026-10-21 | Fix | Fix | CVE assessment: FileRun confirms its official Docker image already includes the PHP fix and identifies filerun/filerun:2026.03 in the update instructions. Re-pull and recreate the container. Non-Docker FileRun installations still require a separate PHP update. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| FileSender project | FileSender | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 3.x installation guide requires PHP, identifies web/CLI paths and a separately installed SimpleSAMLphp authentication dependency. |
source 1 source 2 |
|
| Firefly III project | Firefly III | Rebuilt existing Firefly III container tags with PHP 8.5.12; maintainer confirmation 2026-10-21 | Fix | Fix | CVE assessment: Firefly III's maintainer JC5 explicitly confirms that Firefly III and its data importer now run PHP 8.5.12 and closes the CVE issue. Existing image tags were rebuilt without a new application release. This confirms the container runtime fix, not a PHP update for independently hosted non-container installations. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| Flarum project / Flarum Foundation | Flarum | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official 2.x documentation distinguishes PHP, database drivers and CLI/Composer maintenance; 1.x has a separate compatibility scope. |
source 1 source 2 |
|
| Fly.io; customer runtime-image publisher | Fly.io customer Laravel/PHP Machines deployment | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown Fly.io documents Laravel detection, generated nginx/php-fpm container configuration and PHP CLI job/release processes. |
source | |
| Forma LMS project | Forma LMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project mirror README explicitly lists a PHP server, required extensions and web-based installation. |
source | |
| Fortinet | FortiADC | Vendor-confirmed not impacted product scope | Not vuln | Not vuln | CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source 1 source 2 source 3 |
| Fortinet | FortiADC Manager | Vendor-confirmed not impacted product scope | Not vuln | Not vuln | CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Fortinet | FortiClient Cloud Services | Remediated forticlient-forensics-{dev,us,eu,ap}.forticloud.com services; build unpublished | Fix | Fix | CVE assessment: Fortinet FG-IR-26-186 confirms remediation of four FortiClient forensics endpoints: dev, us, eu and ap under forticloud.com. No customer action is required. This does not assess other FortiClient Cloud Services endpoints; service build numbers are unpublished. No customer action is required for the four vendor-remediated FortiClient forensics endpoints. |
source 1 source 2 |
| Fortinet | FortiDDoS | Investigation | Investigation | CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published Fortinet PSIRT advisory FG-IR-26-186 lists FortiDDoS as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Fortinet | FortiDDoS-F | FortiDDoS-F; vendor-confirmed not impacted scope | Not vuln | Not vuln | CVE assessment: Fortinet FG-IR-26-186, updated 2026-10-23, lists FortiDDoS-F among products confirmed not impacted. FortiDDoS without the -F suffix remains under investigation. Fortinet FG-IR-26-186, updated 2026-10-23, lists FortiDDoS-F among products confirmed not impacted. FortiDDoS without the -F suffix remains under investigation. |
source |
| Fortinet | FortiEndpoint | Vendor-confirmed not impacted product scope | Not vuln | Not vuln | CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Fortinet | FortiMonitor | Vendor-confirmed not impacted product scope | Not vuln | Not vuln | CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Fortinet | FortiSIEM | Vendor-confirmed not impacted product scope | Not vuln | Not vuln | CVE assessment: Fortinet FG-IR-26-186, updated 23 October 2026, explicitly confirms this product is not impacted by both CVEs. Official vendor non-vulnerability confirmation reviewed 2026-10-23. |
source |
| Fortinet | FortiSOAR | Investigation | Investigation | CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published Fortinet PSIRT advisory FG-IR-26-186 lists FortiSOAR as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| Fortinet | FortiSOAR PaaS | Investigation | Investigation | CVE assessment: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published Fortinet PSIRT advisory FG-IR-26-186 lists FortiSOAR PaaS as under investigation for CVE-2026-109618 and CVE-2026-109619. |
source | |
| FOSSBilling project | FOSSBilling | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The current requirements identify PHP and distinguish mandatory modules, recommended media/cache support and the Plesk-only SimpleXML requirement. |
source 1 source 2 |
|
| FrankenPHP | FrankenPHP static builds | FrankenPHP 1.13.2 static binaries with PHP 8.5.12 | Fix | Fix | CVE assessment: Fixed in FrankenPHP 1.13.2 static binaries embedding PHP 8.5.12. Replace the embedded runtime binary; updating a separate system PHP installation does not repair older static builds. FrankenPHP 1.13.2 publishes static binaries with PHP 8.5.12 fixing both PHP2Shell CVEs. |
source 1 source 2 source 3 source 4 |
| FreeBSD Project / ports maintainers | FreeBSD PHP port and mod_php package integration | Ports source: php82 8.2.35; php83 8.3.36; php84 8.4.27; php85 8.5.12 | Fix | Fix | CVE assessment: FreeBSD VuXML names both CVEs and the fixed PHP branch thresholds. Current official main-branch port Makefiles independently select those fixed releases. This confirms corrected ports source, not binary package availability for every architecture/quarterly repository or all mod_php subpackages; no installed system was tested. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 |
| FreeScout project | FreeScout | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project describes a PHP/Laravel helpdesk and documents both web and CLI requirements. |
source 1 source 2 source 3 |
|
| FreshRSS project | FreshRSS | 1.30.3 official default Debian Docker images; PHP 8.4.27-1~deb13u1 | Fix | Fix | CVE assessment: FreshRSS 1.30.3 fixes both CVEs in the official default Debian Docker images, using PHP 8.4.27-1~deb13u1. The release explicitly excludes delayed alternative Alpine images. Source installations still require their own patched PHP runtime. Pull and recreate the official default Debian Docker image for release 1.30.3. Do not assume its alternative Alpine images or source deployments are fixed. |
source 1 source 2 |
| FrontAccounting project | FrontAccounting | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official project mirror explicitly requires PHP for the accounting application and explains PHP session/web-server configuration. |
source | |
| Froxlor Team | Froxlor control panel PHP branches | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The main manifest declares PHP^8.5 and Laravel13, while the separately scoped 2.0 migration guide documents older PHP requirements and PHP CLI helpers. |
source 1 source 2 |
|
| FusionDirectory | FusionDirectory | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The versioned manual identifies a PHP identity-management web application with an independently operated LDAP server. |
source | |
| FusionDirectory | FusionDirectory Orchestrator | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor manual identifies Orchestrator as a PHP web application with its own version requirements and a separate FusionDirectory/LDAP dependency. |
source | |
| FusionPBX project | FusionPBX PHP management application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. FusionPBX publishes a PHP CLI/FPM installation recipe with version-specific package choices. |
source |