Caution
GetPageSpeed: HTML modification and service-blocking risk. Review the documented safety concerns before using these packages. Vendor links are disabled. The CVE status does not assess these additional behaviours.
0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Gentoo PHP maintainers | Gentoo dev-lang/php runtime package family | dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot | Fix | Fix | CVE assessment: Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| GetPageSpeed | GetPageSpeed PHP 5.6-8.4 backport packages for CentOS 7 / EL7 | Known patched EL7 builds: 5.6.40-44.el7; 7.0.33-46.el7; 7.1.33-35.el7; 7.2.34-30.el7; 7.3.33-26.el7; 7.4.33-35.el7; 8.0.30-25.el7; 8.1.34-8.el7; 8.2.35-2.el7; 8.3.36-2.el7; 8.4.27-3.el7 | Fix | Fix | CVE assessment: Fixed in GetPageSpeed CentOS 7 / EL7 PHP builds: 5.6 5.6.40-44.el7; 7.0 7.0.33-46.el7; 7.1 7.1.33-35.el7; 7.2 7.2.34-30.el7; 7.3 7.3.33-26.el7; 7.4 7.4.33-35.el7; 8.0 8.0.30-25.el7; 8.1 8.1.34-8.el7; 8.2 8.2.35-2.el7; 8.3 8.3.36-2.el7; 8.4 8.4.27-3.el7 SAFETY WARNING: GetPageSpeed terms describe modifying served HTML in unlicensed Everpatch PHP installations. Review GETPAGESPEED_SAFETY_NOTICE.md before installation. GetPageSpeed released fixed PHP 5.6 to 8.4 RPMs for CentOS 7 / EL7, including backports for the branches upstream no longer supports (5.6 to 8.1). |
source 1: hxxps://www.getpagespeed[.]com/php2shell#eol (link disabled)source 2: hxxps://www.getpagespeed[.]com/server-setup/php/php2shell-on-centos-7 (link disabled)source 3: hxxps://www.getpagespeed[.]com/eol/centos-7 (link disabled) |
| GetPageSpeed | GetPageSpeed PHP 7.2-8.4 packages for Ubuntu 18.04/20.04 and Debian 10 | Known patched builds (not necessarily first fixed revisions): bionic PHP 7.2 7.2.34-66+gps1+ubuntu1804+stable.1; buster PHP 7.3 7.3.33-35+gps1+deb10+stable.1; focal PHP 7.4 1:7.4.33-31+gps1+ubuntu2004+stable.1; PHP 8.0 1:8.0.30-25+gps1+ubuntu2004+stable.1; PHP 8.1 8.1.34-9+gps1+ubuntu2004+stable.1; PHP 8.2 8.2.35-1+gps1+ubuntu2004+stable.1; PHP 8.3 8.3.36-1+gps1+ubuntu2004+stable.1; PHP 8.4 8.4.27-1+gps1+ubuntu2004+stable.1 | Fix | Fix | CVE assessment: Fixed in the specified GetPageSpeed amd64 DEB builds: bionic PHP 7.2 7.2.34-66+gps1+ubuntu1804+stable.1; buster PHP 7.3 7.3.33-35+gps1+deb10+stable.1; focal PHP 7.4 1:7.4.33-31+gps1+ubuntu2004+stable.1; PHP 8.0 1:8.0.30-25+gps1+ubuntu2004+stable.1; PHP 8.1 8.1.34-9+gps1+ubuntu2004+stable.1; PHP 8.2 8.2.35-1+gps1+ubuntu2004+stable.1; PHP 8.3 8.3.36-1+gps1+ubuntu2004+stable.1; PHP 8.4 8.4.27-1+gps1+ubuntu2004+stable.1 SAFETY WARNING: GetPageSpeed terms describe modifying served HTML in unlicensed Everpatch PHP installations. Review GETPAGESPEED_SAFETY_NOTICE.md before installation. GetPageSpeed released PHP2Shell-fixed DEB packages for the specified PHP branches on Ubuntu 18.04/20.04 and Debian 10, on amd64. |
source 1: hxxps://www.getpagespeed[.]com/server-setup/php/php2shell-on-ubuntu-debian (link disabled)source 2: hxxps://www.getpagespeed[.]com/php2shell (link disabled)source 3: hxxps://extras.getpagespeed[.]com/ubuntu/dists/bionic/main/binary-amd64/Packages.gz (link disabled)source 4: hxxps://extras.getpagespeed[.]com/debian/dists/buster/main/binary-amd64/Packages.gz (link disabled)source 5: hxxps://extras.getpagespeed[.]com/ubuntu/dists/focal/main/binary-amd64/Packages.gz (link disabled) |
| GLPI / Teclib | GLPI | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: Teclib confirms that servers hosting GLPI remain vulnerable to both CVEs until their PHP runtime is patched, regardless of the GLPI application version. The separate GLPI Network Cloud service has already received patches. Teclib confirms that servers hosting GLPI remain vulnerable to both CVEs until their PHP runtime is patched, regardless of the GLPI application version. The separate GLPI Network Cloud service has already received patches. |
source 1 source 2 source 3 source 4 source 5 |
| GLPI / Teclib | GLPI official Docker images (main, 12, 11, 10) | Official main / 12 / 11 / 10 image rebuilds announced 2026-10-21 | Fix | Fix | CVE assessment: GLPI confirms rebuilt official Docker images for main, 12, 11 and 10 with patched PHP. Pull and recreate containers; updating GLPI application files or restarting an old container is insufficient. Other self-hosted deployments require their own PHP security update. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| Google APIs Client Library for PHP | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The PHP API client requires PHP ^8.1, generated API service classes and Google Auth, with PHP HTTP/JWT dependencies. |
source | ||
| Google Auth Library for PHP | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Publisher metadata declares PHP ^8.1 for OAuth/JWT credential and HTTP client support. phpseclib is suggested for some signing/token paths. |
source | ||
| Google Cloud Firestore PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Firestore client metadata requires ext-grpc and PHP ^8.2, while ext-protobuf is suggested to improve throughput over pure-PHP serialization. |
source | ||
| Google Cloud Storage PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The client requires PHP ^8.2 and google/cloud-core. Pub/Sub notifications and phpseclib signing are suggestions, not universal requirements. |
source | ||
| Google / googleapis contributors | Google Cloud PHP client monolith | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Publisher metadata declares PHP ^8.2 and PHP RPC/serialization dependencies. The project recommends individual client packages and distinguishes optional versus required gRPC transports. |
source | |
| Google / Protocol Buffers project | Protocol Buffers native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PECL release declares PHP >=8.2.0 for the native extension. Firestore's independent metadata suggests it for throughput rather than requiring it. |
source | |
| Google / Protocol Buffers project | Protocol Buffers PHP userland runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP runtime declares PHP >=8.2.0 and suggests bcmath for JSON deserialization. It is separate from the native protobuf extension and protoc generator. |
source | |
| Google Cloud | Google App Engine Flexible PHP runtime | App Engine Flexible PHP runtimes not redeployed onto patched supported images | Vulnerable | Vulnerable | CVE assessment: Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding with fixed PHP; unsupported runtimes remain exposed. Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Google Cloud | Google App Engine Standard PHP runtime | PHP 8.2+ supported runtimes | Fix | Fix | CVE assessment: Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically Google documents its managed Standard PHP runtime, PHP-FPM serving and automatic patch updates within the selected runtime family. |
source 1 source 2 |
| Google Cloud; customer image publisher | Google Cloud Run customer PHP container option | Cloud Run customer containers with unpatched PHP on their respective branches | Vulnerable | Vulnerable | CVE assessment: Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe. Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Grav project | Grav CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The application remains affected on an unpatched PHP runtime; confirmed fixed distribution scopes are recorded separately in PHP-0736. |
source 1 source 2 source 3 |
|
| Grav project | Grav official Docker images (getgrav/grav) | getgrav/grav tags rebuilt 2026-10-21 with patched PHP | Fix | Fix | CVE assessment: Grav confirms all official getgrav/grav tags were rebuilt on 21 October 2026 with patched PHP for both CVEs. This applies to those replacement images; pull and recreate containers. Non-container Grav installations still require their own PHP update. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| Grokability / Snipe-IT project | Snipe-IT | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor distinguishes required PHP extensions from LDAP and alternative image-processing requirements. |
source | |
| grommunio GmbH | grommunio PHP packages for SUSE-based installations | Out-of-band PHP security packages announced 2026-10-21 | Fix | Fix | CVE assessment: grommunio confirms its patched PHP packages are available in community and supported repositories for SUSE-based installations. The advisory does not give exact package revisions. Debian, Ubuntu and other distributions must obtain their own distribution PHP fixes; a grommunio Web application update alone does not fix those runtimes. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| grommunio GmbH | grommunio Web | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: grommunio confirms both CVEs affect the PHP-FPM runtime it uses. Fixed out-of-band PHP packages are available for SUSE-based installations; other installations must use their distribution PHP updates. grommunio confirms both CVEs affect the PHP-FPM runtime it uses. Fixed out-of-band PHP packages are available for SUSE-based installations; other installations must use their distribution PHP updates. |
source 1 source 2 |
| gRPC project | gRPC native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PECL identifies a stable PHP extension release. The Windows catalogue distinguishes PHP versions, TS/NTS and x86/x64 builds; quickstart requires it for PHP client calls. |
source 1 source 2 source 3 source 4 |
|
| gRPC project | gRPC PHP Composer support library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The Composer mirror contains PHP support files and declares PHP >=7.1.0. Official quickstart separately requires the native grpc extension for PHP clients. |
source 1 source 2 source 3 |
|
| Guzzle project | Guzzle HTTP client | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Guzzle declares a PHP HTTP client with promises and PSR-7 packages; cURL is a chosen-handler requirement rather than an unconditional root runtime requirement. |
source |