0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Observium Limited / Observium project | Observium | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official installation guide explicitly provisions both the PHP web SAPI and command-line runtime. |
source | |
| October CMS project | October CMS | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: October CMS confirms that every October site running unpatched PHP is affected by both CVEs. No October CMS application update fixes the PHP runtime; the vendor publishes compatible fixed PHP branches. October CMS confirms that every October site running unpatched PHP is affected by both CVEs. No October CMS application update fixes the PHP runtime; the vendor publishes compatible fixed PHP branches. |
source 1 source 2 |
| Open eClass project / GUnet | Open eClass | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 4.1 installation page requires PHP and names modules; it explicitly says the current package does not include phpMyAdmin. |
source | |
| Open Social project | Open Social Drupal installation profile | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official repository manifest identifies a drupal-profile and explicitly declares PHP ^8.3 and Drupal core dependencies. |
source | |
| Open Web Analytics project | Open Web Analytics | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official analytics application manifest explicitly requires PHP and a Composer merge plugin for module requirements. |
source | |
| OpenBSD ports maintainers / PHP documentation team | OpenBSD optional PHP package and ports family | OpenBSD 8.0 amd64 packages-stable: php-8.3.36p1 / php-8.4.27p0 / php-8.5.12p0 | Fix | Fix | CVE assessment: OpenBSD 8.0 amd64 packages-stable: php-8.3.36p1 / php-8.4.27p0 / php-8.5.12p0 PHP documentation confirms split optional OpenBSD packages; dated7.9 release notes list four PHP source-version families. |
source 1 source 2 source 3 source 4 source 5 source 6 |
| OpenCart project | OpenCart | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Publisher package metadata for 4.1.0.4 explicitly requires PHP >=8.1.0. The official repository describes the PHP server and runtime modules. |
source 1 source 2 |
|
| OpenConext / SURF | OpenConext EngineBlock SAML proxy | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The SAML proxy manifest declares PHP ^8.5 and runtime extensions. |
source 1 source 2 source 3 source 4 |
|
| OpenDocMan project | OpenDocMan | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The source manifest requires PHP, while official README and website requirements show different generations of guidance. |
source 1 source 2 source 3 |
|
| OpenEMR project | OpenEMR | Binary Docker recipe b171ac28a57e5da96b1b8eaceb7324edac045948; Forge release 10212026 with PHP 8.5.12 (OpenEMR 8.4.1) | Fix | Fix | CVE assessment: OpenEMR's maintainer merged PR 14773, adopting the published binary-forge release 10212026 with fixed PHP 8.5.12. This confirms the corrected binary Docker recipe and its named forge build only. The separate standard Alpine-image update PR 14771 was still unmerged when reviewed; no blanket fix for all OpenEMR distributions is claimed. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| OpenMage project | OpenMage | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements establish PHP and intl. Publisher registry metadata separately identifies OpenMage as a Magento-1 fork. |
source 1 source 2 |
|
| openmediavault project | openmediavault PHP management backend | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official web GUI deployment state configures a dedicated PHP-FPM pool running as openmediavault-webgui. |
source | |
| OpenSearch Contributors; inherited Elastic client lineage | OpenSearch PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The PHP client declares PHP ^8.2, curl/json and PSR HTTP implementations. AWS SDK is suggested for the signing decorator and appears in require-dev. |
source | |
| OpenSwoole project | OpenSwoole native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release declares PHP >=8.3 and documents its native Zend Fiber integration. |
source | |
| OpenWrt packages feed maintainers | OpenWrt selectable PHP8 package family | Merged package recipes: master/openwrt-25.12 PHP 8.4.27; openwrt-24.10 PHP 8.3.36 | Fix | Fix | CVE assessment: OpenWrt member-authored security update PRs explicitly name both CVEs and are merged into the named package-feed branches. This confirms fixed package source recipes, not a completed binary mirror or firmware rollout for every target. Devices without the optional PHP packages are outside this record's runtime scope. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 source 4 |
| OPNsense / Deciso | OPNsense WebGUI and API | Community 26.7.7 PHP hotfix: 8.5.12; Business 26.4.2p3 PHP hotfix: 8.3.36 | Fix | Fix | CVE assessment: The OPNsense team's Administrator announcement explicitly confirms a released hotfix for both CVEs in Community 26.7.7 and Business 26.4.2p3. Install the PHP hotfix even if the displayed product release already matches; captive portal users must restart that service afterward. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 |
| OrangeHRM Inc. | OrangeHRM Starter | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The edition-labelled Starter repository links to vendor prerequisites that explicitly install the PHP web environment. |
source 1 source 2 |
|
| Oro Inc. | OroCommerce | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor separates server PHP/CLI and extension requirements from client-side browsers, cookies and JavaScript. |
source | |
| Oro, Inc. | OroCRM Community Edition application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The product-specific package metadata confirms PHP for the CRM Community application and distinguishes it from Enterprise, Commerce and Platform distributions. |
source 1 source 2 |
|
| osCommerce | osCommerce 4 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor explicitly states that its V4 commerce platform uses PHP 8.3 and also supports older PHP from 7.4. |
source | |
| osCommerce legacy project | osCommerce Online Merchant 2.3 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The archived v2.3 manual requires a PHP-enabled web server and describes compatibility with PHP 4/5. |
source | |
| OVHcloud | OVHcloud webhosting PHP / .ovhconfig runtime | Provider-patched Web Hosting PHP 5.3-8.5; deployment completed 2026-10-23 | Fix | Fix | CVE assessment: OVHcloud confirms PHP 7.4-8.5 patches on all Web Hosting clusters on 21 October and PHP 5.3-7.3 patches on 23 October; maintenance completed 26 October. Customer-managed VPS and dedicated servers are excluded. No customer PHP patch installation is required for this managed Web Hosting scope. Update customer-managed servers separately. |
source 1 source 2 source 3 |
| ownCloud / Kiteworks | ownCloud Classic 11 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor's 11.0 guide confirms that supported Docker installations include PHP 8 and Apache and replace native Linux installation. |
source | |
| ownCloud / Kiteworks | ownCloud Server 10 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The versioned vendor requirements identify PHP 7.4 for the classic server branch. |
source | |
| OXID eSales | OXID eShop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 7.3 vendor requirements name PHP 8.2-8.4 and required modules for the documented eShop editions. |
source |