0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Jakub Vrana / Adminer project | Adminer | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official site describes a database administration application shipped as a single PHP file and requiring PHP session support. |
source | |
| JBMC Software / DirectAdmin | DirectAdmin CustomBuild hosted PHP | CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1 | Fix | Fix | CVE assessment: DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledged. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 |
| JetBrains | PhpStorm external PHP interpreter integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown The guide requires a separately installed PHP engine and configures its executable/php.ini, interpreter selection and optional Xdebug integration. |
source | |
| Joomla project | Joomla 6.x | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. The stable/current Joomla documentation identifies version 6.1 and gives a PHP 8.3.0 minimum, PHP 8.4 recommendation and required modules. |
source | |
| Jordi Boggiano / Monolog contributors | Monolog | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Monolog is a PHP logging library; handler-dependent modules and service clients are optional, and several integrations appear only in require-dev. |
source | |
| JPHP Group | JPHP JVM compiler and runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance JPHP compiles PHP source to JVM bytecode and distinguishes its own runtime library from Zend PHP. |
source | |
| Juniper Networks | Junos OS J-Web (EX/SRX scope) | Junos OS J-Web on EX/SRX using affected PHP; SRX 25.2R1 no longer uses PHP | Vulnerable | Not vuln | CVE assessment: Juniper JSA112681 states Junos OS is vulnerable to CVE-2026-109618 but not exploitable; the reachable out-of-memory issue is described as harmless. SRX stops using PHP at 25.2R1.; Juniper JSA112681, updated 2026-10-27, explicitly states that Junos OS is not affected by CVE-2026-109619. CVE-2026-109618 remains Vulnerable: Juniper says the issue is reachable but not exploitable. SRX stops using PHP at 25.2R1; that release boundary must not be applied to EX. |
source 1 source 2 source 3 |