0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| iBabs | iBabs bestuursportaal | Not vuln | Not vuln | PHP is not being used in iBabs. This is confirmed by an email of the supplier. | ||
| Ibexa | Ibexa DXP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The versioned requirements page lists PHP 8.3/8.4 for DXP 5.0, PHP CLI/FPM packages and runtime extensions. |
source | |
| Icinga GmbH | Icinga Certificate Monitoring | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official module guide requires Icinga Web; the release announcement explicitly identifies this PHP module and version support. |
source 1 source 2 |
|
| Icinga GmbH | Icinga DB Web | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The named web module has its own PHP/module requirements and is installed into Icinga Web. |
source | |
| Icinga GmbH | Icinga Director | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official module installation guide supplies PHP and extension requirements for configuration deployment and background work. |
source | |
| Icinga GmbH | Icinga PDF Export | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The vendor explicitly identifies the PHP PDF-export module and separates PHP libraries from its locally installed Chromium process. |
source | |
| Icinga GmbH | Icinga Reporting | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The module's own requirements explicitly identify PHP, mbstring and a database PDO connector. |
source 1 source 2 |
|
| Icinga GmbH | Icinga Web | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official guide explicitly separates PHP web/CLI requirements from Icinga 2 and Icinga DB monitoring services. |
source 1 source 2 |
|
| igbinary project | igbinary native PHP serializer extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release is a PHP binary serializer and states its PHP requirement. |
source 1 source 2 |
|
| ILIAS Society / ILIAS project | ILIAS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official release-branch guide documents mod_php, FCGI/PHP-FPM and PHP CLI setup and cron, with separate required and feature-dependent modules. |
source 1 source 2 |
|
| Imagick project | Imagick native PHP image extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release describes a native PHP wrapper for ImageMagick and declares a PHP minimum; its notes mention PHP 8.5 compilation compatibility. |
source 1 source 2 |
|
| iNextrix / ASTPP | ASTPP v7 PHP billing and management application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. ASTPP's vendor explicitly identifies PHP8.2 in version7. |
source | |
| Infection project | Infection PHP mutation-testing tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for infection/infection 0.35.8 declares PHP ^8.3 for this tool/library. |
source | |
| Invision Community / Invision Power Services | Invision Community Classic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor explicitly describes PHP requirements for the self-hosted Classic product and customer responsibility for server security patches and version upgrades. |
source | |
| Invoice Ninja | Invoice Ninja self-hosted server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The source manifest confirms the PHP server and direct extensions; the repository identifies a Laravel API/client-portal implementation. |
source 1 source 2 source 3 source 4 |
|
| InvoicePlane project | InvoicePlane | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The installation guide confirms PHP web/CLI use; the manifest identifies PHP libraries and a CodeIgniter 3.4 fork separately from development tools. |
source 1 source 2 |
|
| IONOS | IONOS webhosting PHP and CLI options | Provider-patched IONOS-managed webhosting PHP; build numbers unpublished | Fix | Fix | CVE assessment: IONOS confirms PHP2Shell updates are installed on its managed PHP infrastructure, including vendor-maintained older branches. This covers account-managed webhosting PHP; customer-managed VPS, dedicated-server and custom CLI installations require separate updates. No customer PHP patch installation is required for account-managed hosting PHP. Patch customer-managed server installations separately. |
source 1 source 2 source 3 |
| ISPConfig project | ISPConfig 3 control panel UI and scripts | ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers | Vulnerable | Vulnerable | CVE assessment: ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix. Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Issabel | Issabel 5 PHP communications management | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Issabel identifies PHP7.4 as a component of its version5 release. |
source |