0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Palo Alto Networks | PAN-OS | Fixed thresholds in PAN-OS 12.2.4-h1; 12.1.4-h13 (ETA 2026-10-29), 12.1.7-h11, 12.1.10-h3 (ETA 2026-10-30); 11.2.4-h23 (ETA 2026-10-30), 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12 (ETA 2026-10-30), 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39 (ETA 2026-10-30), 10.2.10-h42 (ETA 2026-10-29), 10.2.13-h27, 10.2.16-h12, 10.2.18-h13; earlier builds affected | Fix | Fix | CVE assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed hotfix thresholds for each affected PAN-OS branch; some listed hotfixes still carry 2026-10-29/30 ETAs. The same thresholds apply to PA-Series, VM-Series and Panorama (virtual and M-Series); earlier builds remain affected. Scope is the management web interface (HTTPS web UI and XML API), and active exploitation has been observed against internet-exposed management interfaces. Official vendor assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed PAN-OS hotfix thresholds; some branch hotfixes still carry 2026-10-29/30 ETAs, and earlier builds remain affected. |
source 1 source 2 source 3 |
| Palo Alto Networks | Panorama | Fixed thresholds in Panorama 12.2.4-h1; 12.1.4-h13 (ETA 2026-10-29), 12.1.7-h11, 12.1.10-h3 (ETA 2026-10-30); 11.2.4-h23 (ETA 2026-10-30), 11.2.7-h23, 11.2.10-h16, 11.2.13-h4, 11.2.16-h1; 11.1.4-h38, 11.1.6-h40, 11.1.7-h12 (ETA 2026-10-30), 11.1.10-h36, 11.1.13-h16, 11.1.16-h4; 10.2.7-h39 (ETA 2026-10-30), 10.2.10-h42 (ETA 2026-10-29), 10.2.13-h27, 10.2.16-h12, 10.2.18-h13; earlier builds affected | Fix | Fix | CVE assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed hotfix thresholds for each affected PAN-OS branch; some listed hotfixes still carry 2026-10-29/30 ETAs. The same thresholds apply to PA-Series, VM-Series and Panorama (virtual and M-Series); earlier builds remain affected. Scope is the management web interface (HTTPS web UI and XML API), and active exploitation has been observed against internet-exposed management interfaces. Official vendor assessment: Palo Alto Networks advisory, updated 2026-10-28, lists fixed Panorama hotfix thresholds; some branch hotfixes still carry 2026-10-29/30 ETAs, and earlier builds remain affected. |
source 1 source 2 source 3 |
| Pantheon | Pantheon managed PHP application runtime | Patched production/LTS and paid pre-production runtimes; upstream PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 plus vendor LTS backports | Fix | Fix | CVE assessment: Pantheon's current official incident API confirms patched live production, LTS, SFTP-mode and paid pre-production environments. The 22 October update leaves free/sandbox environments pending over the next 24-48 hours. This is a scoped confirmed fix, not fleet-wide completion; customers should follow their environment-specific status. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 source 4 |
| ParaTest / Brian Scaturro, Filippo Tessarotto and contributors | ParaTest parallel PHPUnit runner | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for brianium/paratest v7.27.2 declares PHP ~8.4.0 || ~8.5.0 || ~8.6.0 for this tool/library. |
source | |
| Part-DB project | Part-DB official Docker image (PHP 8.4.27 rebuild) | jbtronics/part-db1:2.20.2 rebuild containing PHP 8.4.27 | Fix | Fix | CVE assessment: The Part-DB maintainer confirms a republished 2.20.2 image with PHP 8.4.27. This Fix is limited to that rebuilt image content: later ARM64 reports still show PHP 8.4.26 and have no maintainer resolution. Do not treat every architecture or cached 2.20.2 image as fixed; verify the selected image's serving runtime. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source 1 source 2 |
| Part-DB project | Part-DB server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The application remains affected on an unpatched PHP runtime; confirmed fixed distribution scopes are recorded separately in PHP-0737. |
source 1 source 2 source 3 source 4 |
|
| Passbolt SA | Passbolt API server | Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport | Fix | Fix | CVE assessment: Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in progress. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| PayPal | PayPal Server SDK for PHP | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The PHP Server SDK requires curl/json and APIMatic support packages. Its README names five supported controller groups. |
source | |
| PCOV / Joe Watkins and contributors | PCOV PHP native code-coverage driver | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official release catalogue requires PHP for PCOV; upstream documents enabled versus disabled executor hooks. |
source 1 source 2 source 3 |
|
| PeachPie / iolevel | PeachPie PHP compiler and .NET runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance PeachPie compiles PHP programs to assemblies using its reimplemented .NET runtime. |
source 1 source 2 |
|
| PeachPie / WpDotNet project | WpDotNet compiled WordPress on PeachPie | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance The release announcement describes WpDotNet executing compiled WordPress without a php executable. |
source | |
| PEAR project / PHP Group | PEAR Base System | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown The official PEAR package page identifies the installer/base PHP error-handling classes and published version/runtime dependencies. |
source 1 source 2 source 3 |
|
| PECL XHProf / longxinH and contributors | XHProf native PHP collection extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release page separates a C data-collection extension from an all-PHP reporting layer. |
source | |
| PECL XHProf / longxinH and contributors | XHProf PHP reporting and navigation UI | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown The publisher explicitly states that XHProf reporting/UI is PHP, distinct from the native collector. |
source | |
| PestPHP / Nuno Maduro and contributors | Pest PHP testing framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for pestphp/pest v5.3.2 declares PHP ^8.4 for this tool/library. |
source 1 source 2 |
|
| Phalcon project | Phalcon framework PHP extension | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official installation guides describe Phalcon as a compiled PHP extension, with distinct web/CLI loading and feature-specific companion modules. |
source 1 source 2 source 3 |
|
| PHAR.io / Arne Blankerts, Sebastian Heuer and contributors | Phive PHAR installation and verification tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phar-io/phive 0.16.0 declares PHP ^8.0 for this tool/library. |
source | |
| Phillips Data / Blesta | Blesta billing platform | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Versioned vendor requirements explicitly identify PHP, encoded-code loader and native extensions for the billing platform. |
source | |
| Phing project / Michiel Rook and contributors | Phing PHP build system | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phing/phing 3.1.2 declares PHP >=8.1 for this tool/library. |
source | |
| PHP CS Fixer project | PHP CS Fixer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown The selected fixer release declares PHP and direct modules; official docs distinguish Composer/shim, PHAR and image use. |
source 1 source 2 |
|
| PHP CS Fixer project | PHP CS Fixer official PHP container image family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The installation guide documents PHP-version-qualified fixer images for local, GitHub and GitLab CI use. |
source | |
| PHP Depend project | PHP Depend source-metrics analyzer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for pdepend/pdepend 3.0.0 declares PHP >=8.1 with php-64bit capability for this tool/library. |
source | |
| PHP Ev extension project | Ev native PHP libev binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release exposes libev event-loop functionality to PHP and declares a PHP minimum. |
source 1 source 2 |
|
| PHP Event extension project | Event native PHP libevent binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release exposes native libevent scheduling APIs. The PHP manual makes OpenSSL conditional on OpenSSL features. |
source 1 source 2 source 3 |
|
| PHP Gearman extension project | Gearman native PHP client and worker extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Selected 2.2.1 exposes libgearman clients/workers and declares PHP 7.2.0 through 8.6.99. |
source 1 source 2 |
|
| PHP gnupg extension project | GnuPG native PHP GPGME binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Selected release identifies a GPGME binding and fixes PHP 8.5 and GPGME 2.0 build compatibility. |
source 1 source 2 source 3 |
|
| PHP Mailparse extension project | Mailparse native PHP MIME parser extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release parses RFC822/MIME messages and still lists mbstring. The official installation manual requires mbstring to load first. |
source 1 source 2 source 3 |
|
| PHP OAuth extension project | OAuth native PHP consumer extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release identifies an OAuth consumer extension and requires hash, now part of PHP core. |
source 1 source 2 |
|
| PHP SSH2 extension project | SSH2 native PHP client binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release provides PHP bindings to libssh2 for SSH2 and declares a PHP minimum. |
source 1 source 2 |
|
| PHP YAML extension project | YAML native PHP parser and emitter extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release provides YAML 1.1 parsing/emission using LibYAML. The catalogue names date but does not render required/optional classification. |
source 1 source 2 source 3 |
|
| php-amqp project | AMQP native PHP messaging client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release provides AMQP 0-9-1 client APIs. The official project documents native librabbitmq requirements separately from the test broker. |
source 1 source 2 source 3 |
|
| PHP-FIG | PSR logging interfaces package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The package distributes PHP interfaces/classes/traits for PSR-3 and explicitly does not provide a logger implementation. |
source | |
| php-memcached project | Memcached native PHP client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PECL identifies the libmemcached-based PHP client. The official 3.x README explicitly makes igbinary/msgpack serializer support optional, despite the flat PECL dependency list. |
source 1 source 2 source 3 |
|
| PHP-PM project | PHP-PM process manager | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release declares PHP and pcntl and describes retaining application bootstraps in worker processes. |
source | |
| php-rdkafka project | rdkafka native PHP Kafka client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected stable release is a librdkafka-based PHP client. The catalogue separately lists 7.0.0alpha1 with a higher PHP minimum. |
source 1 source 2 |
|
| Phpactor project | Phpactor PHP language server and refactoring tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Phpactor's manifest requires PHP ^8.2, mbstring, posix and tokenizer. Its README describes language-server/refactoring functionality and Linux/macOS or WSL. |
source | |
| phpBB Limited / phpBB project | phpBB | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The publisher package declares PHP and direct extensions for its displayed 4.0 alpha release, with separate runtime and development dependencies. |
source | |
| PHPBench / Daniel Leech and contributors | PHPBench benchmarking framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpbench/phpbench 1.7.0 declares PHP ^8.2 for this tool/library. |
source | |
| PHPCSStandards / PHP_CodeSniffer project | PHP_CodeSniffer and PHP Code Beautifier/Fixer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for squizlabs/php_codesniffer 4.0.4 declares PHP >=7.2.0 for this tool/library. |
source 1 source 2 |
|
| phpDocumentor project | phpDocumentor documentation generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpdocumentor/phpdocumentor v3.10.0 declares PHP ^8.1 for this tool/library. |
source | |
| phpIPAM project | phpIPAM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project supplies branch-specific PHP ranges and separately documents PHP modules and optional CLI functions. |
source 1 source 2 |
|
| phpLDAPadmin / leenooks project | phpLDAPadmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The application remains affected on an unpatched PHP runtime; confirmed fixed distribution scopes are recorded separately in PHP-0738. |
source 1 source 2 source 3 |
|
| phpLDAPadmin / leenooks project | phpLDAPadmin official Docker image | Docker release 2.3.12 (PHP 8.4.27) | Fix | Fix | CVE assessment: The phpLDAPadmin owner confirms Docker release 2.3.12 was pushed with PHP 8.4.27 in the issue for both PHP2Shell CVEs. Pull and recreate the container. This does not patch externally supplied PHP for non-container phpLDAPadmin deployments. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| phpList project | phpList | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official requirements explicitly identify PHP and warn that some functionality/modules and plugin requirements are conditional. |
source | |
| PHPMailer project | PHPMailer | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP mail creation/transport class declares three direct extension requirements and feature-specific mail/encoding integrations. |
source | |
| PHPMD project | PHPMD PHP Mess Detector | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpmd/phpmd 3.0.0 declares PHP ^8.1 for this tool/library. |
source | |
| phpMyAdmin project | phpMyAdmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. Registry metadata provides a release-specific PHP/module subset while the development manual separates optional archive/media/authentication features. |
source 1 source 2 |
|
| phpMyFAQ project | phpMyFAQ | phpMyFAQ deployments on affected PHP-CGI runtimes | Vulnerable | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown; The phpMyFAQ team's 21 October notice explicitly reports CVE-2026-109618 exposure on PHP-CGI. It does not assess CVE-2026-109619; that CVE remains Investigation. No application-code fix or complete configuration workaround is asserted. Update the deployed PHP runtime using the official PHP security guidance; do not treat the notice's CGI configuration suggestion as a complete fix. |
source 1 source 2 source 3 |
| phpPgAdmin project | phpPgAdmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official application manifest explicitly declares PHP and the PostgreSQL PHP extension. |
source | |
| PhpRedis project / Michael Grunder and contributors | PhpRedis native PHP client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The develop build declarations make native compression conditional. The installation guide distinguishes optional serializer builds from the feature-limited initial Windows PIE binaries. |
source 1 source 2 source 3 |
|
| PHPro / GrumPHP contributors | GrumPHP Git quality-check orchestration | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpro/grumphp v2.26.0 declares PHP ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 for this tool/library. |
source | |
| phpseclib project | phpseclib | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The library implements cryptography and secure communications in PHP; native crypto acceleration and XML-key features are optional. |
source | |
| PhpSpec project | PhpSpec specification test runner | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpspec/phpspec 9.0.0-rc.4.4 declares PHP 8.3.* || 8.4.* || 8.5.* || 8.6.* for this tool/library. |
source | |
| PHPStan / Ondrej Mirtes and contributors | PHPStan static analyzer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpstan/phpstan 2.3.1 declares PHP ^7.4|^8.0 for this tool/library. |
source 1 source 2 |
|
| PHPStan project | PHPStan PHPDoc parser library | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpstan/phpdoc-parser 2.3.6 declares PHP ^7.4 || ^8.0 for this tool/library. |
source | |
| PHPUnit project | PHPUnit test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown PHPUnit is a PHP CLI test runner; release-specific metadata refines broad manual requirements. |
source 1 source 2 source 3 |
|
| PHPUnit project / Sebastian Bergmann | PHPUnit PHP code-coverage library | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpunit/php-code-coverage 14.4.1 declares PHP >=8.4 for this tool/library. |
source | |
| phpVirtualBox project | phpVirtualBox server-side administration application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project describes a PHP web administration interface for VirtualBox. |
source | |
| Pi-hole project | Pi-hole v5 legacy PHP web interface | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Pi-hole's version6 announcement explicitly removes the former lighttpd/PHP dependency. |
source | |
| Pimcore project | Pimcore Platform | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Versioned platform requirements list PHP 8.5+ for 2026.2; the 2025.1 page specifies PHP 8.3/8.4. |
source 1 source 2 |
|
| Plesk | Plesk for Linux | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: Plesk now publishes fixed hosted PHP packages and internal-engine updates. Hosted scopes are recorded in PHP-0745/PHP-0746 and internal scopes in PHP-0385/PHP-0611. These released fixes do not cover every older or custom PHP handler in the broad product rows; unpatched versions remain affected. Plesk for Linux has published internal-engine and hosted-handler fixes, recorded in their component-specific entries. |
source |
| Plesk | Plesk for Linux hosted PHP 7.4 and 8.0-8.5 fixed packages | PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; 7.4.33 / 8.0.30 / 8.1.34 built 2026-10-21 | Fix | Fix | CVE assessment: Plesk confirms fixed Linux hosted PHP 8.2-8.5 packages and backports for 7.4.33, 8.0.30 and 8.1.34 built on 21 October 2026. The unchanged legacy version number alone is insufficient. PHP 5.6/7.2/7.3 and the internal sw-engine are separate update scopes. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| Plesk | Plesk for Windows | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: Plesk now publishes fixed hosted PHP packages and internal-engine updates. Hosted scopes are recorded in PHP-0745/PHP-0746 and internal scopes in PHP-0385/PHP-0611. These released fixes do not cover every older or custom PHP handler in the broad product rows; unpatched versions remain affected. Plesk for Windows has published internal-engine and hosted-handler fixes, recorded in their component-specific entries. |
source |
| Plesk | Plesk for Windows hosted PHP 8.2-8.5 fixed packages | PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: Plesk confirms released Windows hosted PHP fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. This covers hosted PHP handlers only. The internal plesk-engine requires its separate Plesk update; older or custom handlers are outside this fixed scope. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source |
| Plesk | Plesk Obsidian hosted-site PHP | Unpatched PHP builds; fixed release scopes listed separately | Vulnerable | Vulnerable | CVE assessment: Plesk has released hosted-PHP fixes for Linux 7.4 and 8.0-8.5 and Windows 8.2-8.5, recorded in PHP-0745 and PHP-0746. Linux 7.4/8.0/8.1 require builds dated 21 October 2026. This broad row retains Vulnerable for unpatched or older handlers; PHP 5.6/7.2/7.3 require separate ELS coverage and the internal engines have independent fixes. Plesk has released hosted-handler fixes for the named Linux and Windows branches; older handlers require separate coverage. |
source 1 source 2 source 3 |
| Plesk | Plesk plesk-engine internal PHP management runtime for Windows | Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4 | Fix | Fix | CVE assessment: Fixed in Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4 for the internal management PHP engine: Linux sw-engine and Windows plesk-engine. Hosted-site PHP packages are separate and also require their applicable security updates. Plesk confirms released fixes for the Windows plesk-engine internal PHP runtime in 18.0.80 Update 11 and 18.0.81 Update 4. |
source 1 source 2 |
| Plesk | Plesk sw-engine internal PHP management runtime | Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4 | Fix | Fix | CVE assessment: Fixed in Plesk Obsidian 18.0.80 Update 11 or 18.0.81 Update 4 for the internal management PHP engine: Linux sw-engine and Windows plesk-engine. Hosted-site PHP packages are separate and also require their applicable security updates. Plesk confirms released fixes for the Linux sw-engine internal PHP runtime in 18.0.80 Update 11 and 18.0.81 Update 4. |
source 1 source 2 source 3 |
| PluXml project | PluXml 5.8 documented branch | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The PluXml 5.8 installation guide requires a PHP interpreter and GD for images. |
source | |
| PmWiki project | PmWiki | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project requires PHP on the web server and describes its PHP compatibility range. |
source | |
| PostfixAdmin project | PostfixAdmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project identifies a PHP-capable web application used to administer virtual users for a separate Postfix mail server. |
source | |
| Predis project / Till Kruss and contributors | Predis PHP Redis and Valkey client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Predis declares PHP compatibility and a PSR message interface; Relay is suggested as an optional faster connection implementation. |
source | |
| PrestaShop project | PrestaShop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The version-9 requirements identify PHP, required modules and separate compatibility bands for 9.0 and 9.1. |
source | |
| PrivateBin project | PrivateBin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official manifest requires PHP; the project separately states that paste encryption/decryption occurs in the browser. |
source 1 source 2 |
|
| ProcessWire project | ProcessWire CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Official requirements list PHP 8.x as recommended, PHP 7.x compatibility, and image-processing support. |
source 1 source 2 |
|
| ProjectSend project | ProjectSend | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The current source installation guide lists PHP web/CLI requirements; LDAP is required even without configured LDAP use. |
source 1 source 2 |
|
| Prophecy / PhpSpec project | Prophecy PHP mocking library | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for phpspec/prophecy v1.26.1 declares PHP 8.2.* || 8.3.* || 8.4.* || 8.5.* for this tool/library. |
source | |
| Psalm project / Daniil Gentili | Psalm official custom-PHP container image | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Psalm's official installation guide describes an image containing a custom PHP build and its analyzer. |
source | |
| Psalm project / Matthew Brown, Daniil Gentili and contributors | Psalm PHP static analyzer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for vimeo/psalm 7.0.0-rc2 declares PHP ~8.1.31 || ~8.2.27 || ~8.3.16 || ~8.4.3 || ~8.5.0 for this tool/library. |
source 1 source 2 |
|
| PsySH / Justin Hileman and contributors | PsySH interactive PHP shell | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for psy/psysh v0.12.24 declares PHP ^8.0 || ^7.4 for this tool/library. |
source | |
| Pterodactyl project | Pterodactyl Panel PHP application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The Panel manifest declares PHP, Laravel and required PHP extensions for the management application. |
source 1 source 2 |
|
| Public Knowledge Project (PKP) | Open Journal Systems | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official OJS README requires PHP and supplies a platform-check example while warning that its sample version numbers are not minimum versions. |
source | |
| Public Knowledge Project (PKP) | Open Monograph Press | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official OMP README requires PHP and distinguishes PHP platform requirements from illustrative module version numbers. |
source | |
| Public Knowledge Project (PKP) | Open Preprint Systems | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official OPS README requires PHP for the preprint server and identifies web-versus-CLI configuration differences. |
source | |
| Pydio | Pydio 8 Enterprise Distribution | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor's legacy Enterprise guide explicitly requires PHP, modules and ionCube, and recommends a PHP CLI path. |
source 1 source 2 |