0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| N-able | Mail Assure / Spam Experts | Vendor platform fixes completed 22 October 2026 at 18:30 EDT | Fix | Fix | CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing. No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits. |
source |
| N-able | N-sight | Vendor platform fixes completed 22 October 2026 at 18:30 EDT | Fix | Fix | CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing. No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits. |
source |
| N-able | Passportal | Vendor platform fixes completed 22 October 2026 at 18:30 EDT | Fix | Fix | CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing. No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits. |
source |
| N-able | Take Control Session routing | Vendor platform fixes completed 22 October 2026 at 18:30 EDT | Fix | Fix | CVE assessment: N-able's final update confirms all relevant products secured against both vulnerabilities and their root causes across supported PHP versions. Take Control scope is session routing only, including standalone and integrated routing. No customer PHP patch is specified for these vendor-hosted fixes; retain the vendor's product and service scope limits. |
source |
| Nagios Enterprises | Nagios Fusion web component subsystem | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor explains how PHP component files are included during Fusion application instantiation and register web-page callbacks. |
source | |
| Nagios Enterprises | Nagios XI web configuration-wizard subsystem | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official development guide identifies PHP scripts and callback functions loaded by the XI configuration-wizard interface. |
source | |
| Neos project | Neos CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Neos publishes a Neos/Flow/PHP matrix and requires matching web and CLI PHP versions for class precompilation. |
source | |
| NetApp | ONTAP 9 | 9.15.1P20HF1 / 9.16.1P16HF1 / 9.17.1P11HF1 / 9.18.1P8HF1 / 9.19.1P3HF1 | Fix | Not vuln | CVE assessment: NetApp NTAP-20261021-0021 version 7.0 (2026-10-25) lists these currently available ONTAP 9 patches. ONTAP 9 is affected only by CVE-2026-109618; CVE-2026-109619 does not affect it. Exploitation of an unpatched release is limited to the www user in the PHP jail. NetApp NTAP-20261021-0021 version 7.0 (2026-10-25) lists these currently available ONTAP 9 patches. ONTAP 9 is affected only by CVE-2026-109618; CVE-2026-109619 does not affect it. Exploitation of an unpatched release is limited to the www user in the PHP jail. |
source |
| Netgate / pfSense | pfSense management components | Updated PHP packages: pfSense Plus 26.07 / 26.03.1 and CE 2.9.0: PHP 8.5.12; CE 2.8.1: PHP 8.3.36 | Fix | Fix | CVE assessment: Netgate explicitly identifies both CVEs and confirms published fixed PHP packages for the named pfSense Plus/CE releases. Existing installations require the command-line package update, not just a GUI update. GUI and Captive Portal exposure are configuration-specific; older releases are not included in this fix confirmation. Netgate's 21 October 2026 advisory supplies fixed PHP packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1. Exposure requires attacker access to the PHP GUI or Captive Portal; by default the GUI is LAN-only and Captive Portal is disabled. Apply the command-line update and reboot or restart the relevant services, including Captive Portal when enabled. Follow the advisory's WireGuard reinstall and connection-interruption warning. |
source 1 source 2 source 3 source 4 source 5 source 6 |
| Netlify | Netlify PHP build environment and Composer integration | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Netlify documents PHP_VERSION for building a site and Composer handling when composer.json is present. |
source | |
| Nette community | Nette Application | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown MVC kernel and application request dispatch are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Assets | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP-side asset mapping, versioning and storage integration are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Bootstrap | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP application bootstrap and configuration loading are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Caching | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP caching abstractions and selected storage are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Command Line | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP command-line interface utilities are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Database | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP database access and abstraction are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette DI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP dependency injection and container compilation are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Forms | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Server PHP form handling and validation are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette HTTP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP requests, uploaded-file handling, URLs and sessions are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Mail | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP mail construction and sending are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette PHP Generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown PHP source generation and optional source-body parsing are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette RobotLoader | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP class discovery, source analysis, autoloading and cache are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette SafeStream | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP safe/atomic file stream handling are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Security | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP authentication, authorization and ACL handling are implemented in this independently identifiable PHP package. |
source | |
| Nette community | Nette Utils | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP utility functions and selected image/string/JSON helpers are implemented in this independently identifiable PHP package. |
source | |
| Nette community / Latte | Latte template engine | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP template compilation and rendering are implemented in this independently identifiable PHP package. |
source | |
| Nette community / Tracy | Tracy debugger | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown PHP debugging, diagnostics and error handling are implemented in this independently identifiable PHP package. |
source | |
| Nette Foundation / Nette community | Nette framework metapackage | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Nette 3.3.0 is a metapackage with a finite seventeen-name direct runtime package list; each name was independently checked for PHP use. |
source | |
| Nextcloud | Nextcloud Office integration app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official integration app has PHP runtime dependencies distinct from its development tools and the external document-editing server. |
source | |
| Nextcloud | Nextcloud Server | Vulnerable | Vulnerable | CVE assessment: Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image Nextcloud confirms that deployments using affected PHP are at risk and points operators to fixed PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. |
source 1 source 2 source 3 source 4 source 5 source 6 |
|
| Nextcloud | Nextcloud Talk server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official application manifest contains a production PHP namespace/autoload tree and runtime dependencies, distinct from development tools. |
source | |
| Nextcloud Calendar project | Nextcloud Calendar server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The prior release-publisher version pin is retained. A dated official FreeBSD ports commit independently records Calendar 6.6.2 and its advertised source-archive checksum; it does not supply the missing app/core PHP compatibility pair. |
source 1 source 2 source 3 source 4 source 5 source 6 |
|
| Nextcloud Collectives project | Nextcloud Collectives server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official manifest separates PHP runtime requirements and collaboration libraries from development-only DOM and test tools. |
source | |
| Nextcloud Contacts project | Nextcloud Contacts server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official app manifest declares its PHP runtime constraint separately from development dependencies and the Composer platform target. |
source | |
| Nextcloud Deck project | Nextcloud Deck | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official repository explicitly documents PHP dependency installation and PHP tooling for the Deck app. |
source 1 source 2 |
|
| Nextcloud Docker community volunteers / Docker Official Images | Nextcloud community Docker image distribution | 35.0.2-apache / 34.0.5-fpm: PHP 8.5.12; 32-apache: PHP 8.3.36 (2026-10-29 digest scope) | Fix | Fix | CVE assessment: 35.0.2-apache / 34.0.5-fpm: PHP 8.5.12; 32-apache: PHP 8.3.36 (2026-10-29 digest scope) Nextcloud's security notice and Docker maintainer response explain the issue and scheduled rebuilds. They do not confirm completion for all three recorded tags; Fix relies on their checked registry digests and PHP's advisories, not on AIO releases. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 source 8 |
| Nextcloud GmbH / Nextcloud AIO maintainers | Nextcloud AIO Nextcloud application container | Nextcloud AIO 14.4.1 | Fix | Fix | CVE assessment: Fixed in Nextcloud AIO 14.4.1, whose release directs users to upgrade for the PHP CVEs and includes the patched PHP dependencies. This assessment is limited to AIO; other Nextcloud distributions have independent runtimes. Nextcloud AIO 14.4.1 ships updated PHP dependencies and is the project's published PHP2Shell security update. |
source 1 source 2 source 3 |
| Nextcloud Mail project | Nextcloud Mail server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The app manifest declares PHP and OpenSSL plus separate mail-processing libraries; its README requires a Nextcloud server and PHP dependency management. |
source | |
| Nextcloud Notes project | Nextcloud Notes | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official Notes manifest confirms PHP development tooling and distinguishes require-dev from a Composer resolution target. |
source | |
| Nextcloud Snap maintainers | Nextcloud Snap bundled PHP runtime | 34.0.5snap3 (bundled PHP 8.4.27) | Fix | Fix | CVE assessment: The official Nextcloud Snap release ships PHP 8.4.27, and its maintainers confirm the security update in issue 3701. PHP upstream identifies 8.4.27 as fixed for both CVEs. This finding applies to the Snap package. Refresh to Nextcloud Snap 34.0.5snap3 or a later release retaining the fixed PHP runtime. |
source 1 source 2 source 3 source 4 |
| NextcloudPi project / Nextcloud community | NextcloudPi turnkey PHP stack | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The NextcloudPi feature list explicitly includes PHP 8.1, Apache, APCu and Zend OPcache file cache. |
source | |
| Nikita Popov / PHP-Parser contributors | PHP-Parser userland parser | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown PHP-Parser is implemented in PHP and declares native tokenizer/json requirements for parsing source into an abstract syntax tree. |
source | |
| NixOS / Nixpkgs maintainers | Nixpkgs PHP runtime environments | Nixpkgs PHP 8.3.36 / 8.4.27 / 8.5.12; updated nixos-26.05-small and nixos-unstable-small inputs | Fix | Fix | CVE assessment: Nixpkgs merged PR 576853 fixing both CVEs; a maintainer confirms delivery to the small channels. Other channels and pinned inputs are not assumed updated, and this finding does not claim a PHP 8.2 fix from that PR. Update the applicable Nixpkgs input/channel, rebuild and activate services, and verify the running PHP version. |
source 1 source 2 source 3 source 4 |