0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| SalesAgility / SuiteCRM project | SuiteCRM | Installations served by unpatched PHP; application versions are not the patch boundary | Vulnerable | Vulnerable | CVE assessment: SuiteCRM confirms that both CVEs affect self-hosted installations running unpatched PHP. Updating SuiteCRM alone does not fix PHP. Vendor-hosted SuiteCRM is separately confirmed patched. SuiteCRM confirms that both CVEs affect self-hosted installations running unpatched PHP. Updating SuiteCRM alone does not fix PHP. Vendor-hosted SuiteCRM is separately confirmed patched. |
source 1 source 2 source 3 |
| Sangoma | PBXact 17 PHP management edition | PBXact 17 after latest PHP security updates (Sangoma advisory 2026-10-23); exact build unpublished | Fix | Fix | CVE assessment: Sangoma directs PBXact 17 operators to install the available PHP security updates for both CVEs. Fixed scope requires those system updates; an unupdated version 17 installation remains affected. The advisory does not specify an exact package build. Apply the latest system PHP security updates using Sangoma's version 17 update procedure and verify the installed packages. |
source 1 source 2 |
| Sangoma / FreePBX project | FreePBX 17 management framework | FreePBX 17 after latest PHP security updates (Sangoma advisory 2026-10-23); exact build unpublished | Fix | Fix | CVE assessment: Sangoma directs FreePBX 17 operators to install the available PHP security updates for both CVEs. Fixed scope requires those system updates; an unupdated version 17 installation remains affected. The advisory does not specify an exact package build. Apply the latest system PHP security updates using Sangoma's FreePBX 17 update procedure and verify the installed packages. |
source 1 source 2 source 3 source 4 |
| Scalingo | Scalingo PaaS | Scalingo PHP runtimes 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 available since 2026-10-21 16:40 UTC+2 | Fix | Fix | CVE assessment: Scalingo SSB-2026-005 explicitly names both CVEs and confirms all four fixed runtimes are available. Customers must rebuild/redeploy with compatible constraints and verify the deployed PHP version. Router multipart blocking is separate mitigation and does not update the runtime or prove a fix in an old deployment. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source |
| Scalingo | Scalingo PHP buildpack | Buildpack-selected PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: Scalingo confirms the buildpack can select all four fixed PHP releases. Rebuild and redeploy are required; restart-only, custom/forked/pinned buildpacks and incompatible PHP constraints do not automatically receive the fix. The upload-progress configuration workaround alone is not complete remediation. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source |
| Sean Morris / php-wasm project | php-cgi-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The publisher lists php-cgi-wasm as a separate package. |
source | |
| Sean Morris / php-wasm project | php-cli-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The publisher lists php-cli-wasm as a separate package. |
source | |
| Sean Morris / php-wasm project | php-cloud-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The publisher lists php-cloud-wasm as a separate package. |
source | |
| Sean Morris / php-wasm project | php-dbg-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The publisher lists php-dbg-wasm as a separate package. |
source | |
| Sean Morris / php-wasm project | php-sdl-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The publisher lists php-sdl-wasm as a separate package. |
source | |
| Sean Morris / php-wasm project | php-wasm-builder package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The publisher lists php-wasm-builder as a separate package. |
source | |
| Sean Morris / php-wasm project | Sean Morris php-wasm runtime package | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown The project documents embedded PHP WebAssembly packages. |
source | |
| Securepoint GmbH | Securepoint Resellerportal | Patched before 2026-10-22 inventory entry; fixed release not publicly stated | Fix | Fix | CVE assessment: The maintainer accepts issue #58's Securepoint employee report that the Resellerportal was patched before this inventory entry was created. No public fixed build was independently verified. Fix status is based on issue #58, where a Securepoint employee reports that the Resellerportal was patched before this inventory entry was created. The product was originally reported in PR #10; no public fixed build was independently verified. |
source 1 source 2 source 3 source 4 |
| Semantic MediaWiki project | Semantic MediaWiki | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The publisher manifest declares PHP and mbstring and explicitly requires MediaWiki and its dependencies. |
source | |
| Sendy | Sendy self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor describes Sendy as a PHP-hosted application and separately identifies Amazon SES for sending mail. |
source 1 source 2 |
|
| Serendipity project | Serendipity Blog System | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project calls Serendipity a PHP web application and specifies PHP 7.3+, cookie/session support and extensions. |
source | |
| Server Side Up | Server Side Up PHP Docker images, v5.0.2 for PHP 8.2-8.5 | v5.0.2: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 image variants | Fix | Fix | CVE assessment: The publisher reports v5.0.2 images for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 rebuilt and tested for CVE-2026-109618. This assessment covers those versioned image variants only. PHP 8.1.34 remains unpatched; image digests and running deployments were not verified.; The publisher reports v5.0.2 images for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 rebuilt and tested for CVE-2026-109619. This assessment covers those versioned image variants only. PHP 8.1.34 remains unpatched; image digests and running deployments were not verified. Publisher reports fixed v5.0.2 Docker images for PHP 8.2-8.5; image digests and deployed workers were not verified. |
source 1 source 2 |
| Shaarli community | Shaarli | Shaarli Docker v0.16.10 / v0.16 / release rebuilt with PHP 8.4.27 | Fix | Fix | CVE assessment: Fixed in the official ghcr.io/shaarli/shaarli images v0.16.10, v0.16 and release rebuilt with PHP 8.4.27. The remaining open issue concerns build reproducibility. Non-container installations must update their own PHP runtime. Shaarli's maintainer confirms fixed official Docker images with PHP 8.4.27 in the 0.16.10 release. |
source 1 source 2 source 3 source 4 |
| Shivam Mathur / setup-php project | setup-php GitHub Action external PHP provisioning | Patched setup-php v2-provisioned PHP builds announced 2026-10-21 | Fix | Fix | CVE assessment: The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require update=true, and pre-installed disables updates. Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 |
| Shlink project | Shlink | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The application remains affected on an unpatched PHP runtime; confirmed fixed distribution scopes are recorded separately in PHP-0739. |
source 1 source 2 source 3 |
|
| Shlink project | Shlink official Docker image | shlinkio/shlink:5.1.8, published 2026-10-22 | Fix | Fix | CVE assessment: Shlink 5.1.8 explicitly fixes both CVEs in its Docker images by moving to Alpine 3.24. Docker Hub confirms publication on 22 October after the initial build failure. Scope is the published image; non-container deployments must update their own PHP runtime. Vendor-confirmed published fix for both PHP2Shell CVEs in this specific package or image scope. |
source 1 source 2 |
| Shopify | Shopify API Library for PHP deprecated line | Investigation | Investigation | CVE assessment: Historical scope; current use unknown Published metadata identifies the PHP client and its extension subset. The README marks it deprecated and directs users to shopify/shopify-app-php. |
source | |
| Shopify | Shopify App PHP package | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The app package declares PHP >=8.2 with Firebase JWT and Guzzle dependencies for PHP Shopify app integration. |
source | |
| Shopware 5 project / shopware AG lineage | Shopware 5 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The v5.7.20 package declares PHP and its extension requirements. The project README says active maintenance is no longer guaranteed. |
source | |
| shopware AG | Shopware 6 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official 6.7 update guide requires PHP 8.2/8.3/8.4 and separately describes the Vue/Vite administration frontend. |
source 1 source 2 |
|
| Silverstripe CMS project | Silverstripe CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The 6.x manual requires a PHP web server, PHP 8.3-8.5 and specific extensions. |
source | |
| Simple Machines / SMF project | Simple Machines Forum | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official application manifest declares a PHP runtime constraint separately from PHP-CS-Fixer and PHPUnit development dependencies. |
source | |
| SimpleRisk | SimpleRisk PHP GRC application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. SimpleRisk publishes PHP version and extension requirements plus supported Apache/nginx execution modes. |
source | |
| SimpleSAMLphp project | SimpleSAMLphp | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. SimpleSAMLphp is a PHP SAML service-provider/identity-provider application with explicit PHP and extension requirements. |
source | |
| Slim project | Slim framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Slim is a PHP HTTP microframework; its package requires a separately chosen PSR-7 implementation and identifies XML parser modules as optional. |
source | |
| SnappyMail project | SnappyMail | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project documents PHP for its server-side webmail implementation and identifies its RainLoop lineage. |
source 1 source 2 |
|
| SnappyMail project | SnappyMail official Docker image (PHP2Shell rebuild) | v2.38.2.1 Docker release, published 2026-10-23 | Fix | Fix | CVE assessment: The SnappyMail maintainer released v2.38.2.1 specifically as the Docker PHP2Shell fix; its linked publication workflow completed successfully. Pull and recreate the v2.38.2.1 Docker release; updating application files alone does not patch an independently installed PHP runtime. |
source 1 source 2 source 3 |
| SolidWorx / SolidInvoice project | SolidInvoice application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official runtime manifest requires PHP and native extensions; source and binary installation methods have different packaging boundaries. |
source 1 source 2 |
|
| SolidWorx / SolidInvoice project | SolidInvoice self-contained binary | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The vendor explicitly documents a bundled PHP runtime and FrankenPHP worker controls; no separately installed host PHP is required. |
source | |
| Sophos | MyUTM portal | MyUTM hosted licensing portal before vendor PHP update | Vulnerable | Vulnerable | CVE assessment: Sophos advisory version 4 confirms the MyUTM hosted portal ran affected PHP and was taken offline pending its update. The separate statement that Sophos products are not affected does not exclude this hosted service. Use Sophos Support for licensing while the portal is offline; no completed portal fix is asserted. |
source |
| SPIP project | SPIP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official configuration table gives PHP compatibility and extension requirements separately for SPIP 4.4, 4.3 and 4.2. |
source | |
| Spryker Systems GmbH | Spryker Commerce OS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor documents PHP-backed commerce and marketplace applications; its upgrade guide distinguishes the 8.3 floor from the 8.5 recommendation. |
source 1 source 2 source 3 |
|
| Spryker Systems GmbH | Spryker spryker-php runtime images | 20261021: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: Spryker release 20261021 updates the supported PHP runtime images to fix both CVEs. Rebuild and redeploy using the vendor procedure; normal deployments may reuse cached images. Older PHP branches are outside this fix scope. |
source |
| SquirrelMail project | SquirrelMail legacy documented webmail | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The old official installation manual explicitly requires a PHP-capable web server for the webmail application. |
source | |
| Statamic project | Statamic CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Statamic describes itself as a PHP application installed as a Laravel package and lists PHP 8.3+ requirements. |
source | |
| Statamic project | Statamic static-site generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown The official guide installs statamic/ssg, invokes PHP/Artisan during the build and publishes storage/app/static. |
source | |
| Stripe and contributors | Stripe PHP client library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The displayed beta release requires PHP >=7.4.0 and curl, json and mbstring extensions in the PHP caller. |
source | |
| SugarAI / SugarCRM | Sugar application server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor's supported-platforms page explicitly lists PHP among application server requirements, separately from end-user browser requirements. |
source | |
| Sulu project | Sulu CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The Sulu 3.x requirements explicitly require PHP 8.2+ and DOM/XML extensions. |
source | |
| SURF | SURF Research Access Management EngineBlock proxy | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SURF's architecture names EngineBlock as the SRAM proxy. |
source 1 source 2 source 3 |
|
| SURF | SURF Research Drive Nextcloud server component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SURF's domain-vision PDF identifies Research Drive among Nextcloud-based services. |
source 1 source 2 |
|
| SURF | SURFconext OpenConext EngineBlock proxy role | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Project showcase and architecture connect SURFconext with OpenConext's EngineBlock proxy. |
source 1 source 2 source 3 |
|
| SURF | SURFdrive Nextcloud server component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SURF states that SURFdrive is based on Nextcloud. |
source 1 source 2 |
|
| SURF | SURFfilesender FileSender server component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SURF identifies FileSender as the origin of SURFfilesender. |
source 1 source 2 |
|
| SURF / SURFnet | SURFconext Service Provider Dashboard | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The registration/management application declares PHP ^8.2 in its root manifest. |
source 1 source 2 |
|
| SUSE | SUSE Linux Enterprise PHP8 package families | SLE 15 SP4: 8.0.30-150400.4.80.1; SP6: 8.2.35-150600.3.39.1; SP7: 8.3.36-150700.3.24.1; SLES 16.0: 8.4.27-160000.1.1 | Fix | Fix | CVE assessment: SUSE publishes fixed PHP8 packages for the listed SLE product branches. This does not assert that every SLE service pack or PHP package family is fixed; use the matching product-specific advisory. Install the product-specific SUSE security update and restart affected PHP services; do not select a package built for another SLE branch. |
source 1 source 2 source 3 source 4 source 5 source 6 source 7 |
| SUSE | SUSE SLE BCI PHP CLI container | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests. Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 source 4 |
|
| SUSE | SUSE SLE BCI PHP-Apache container | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests. Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 source 4 |
|
| SUSE | SUSE SLE BCI PHP-FPM 8 container | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests. Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references. |
source 1 source 2 source 3 source 4 |
|
| Swoole project | Swoole native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The release identifies an asynchronous PHP networking engine and explicit PHP-version bounds. |
source | |
| Sylius project | Sylius | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official prerequisites require PHP 8.2+ and five named extensions for the Symfony-based commerce application. |
source | |
| Sylvain Lassaut / NoiseByNorthwest | SPX native PHP profiling extension and built-in report UI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The maintainer README describes a loaded PHP extension with HTTP profiling/UI and CLI modes; build configuration links native zlib. |
source 1 source 2 |
|
| Symfony | Symfony Console component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP command-line application framework is distributed as an independently installable PHP package. |
source | |
| Symfony | Symfony framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade. The current Symfony setup guide identifies PHP and six extensions; the official component catalogue and separate manifests distinguish reusable packages from the full framework. |
source 1 source 2 source 3 |
|
| Symfony | Symfony HttpFoundation component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP request, response, session and upload abstractions is distributed as an independently installable PHP package. |
source | |
| Symfony | Symfony HttpKernel component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP HTTP kernel and request/response conversion pipeline is distributed as an independently installable PHP package. |
source | |
| Symfony | Symfony mbstring polyfill | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The PHP package provides the ext-mbstring Composer platform capability while implementing a fallback and directly requiring iconv. |
source | |
| Symfony | Symfony Process component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PHP API for invoking and managing system subprocesses is distributed as an independently installable PHP package. |
source | |
| Symplify | Easy Coding Standard PHP style tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher metadata for symplify/easy-coding-standard 13.3.7 declares PHP >=7.2 for this tool/library. |
source | |
| Synology | Synology PHP 5.6 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official archive publishes this named PHP package family and architecture/platform-labelled SPK files. |
source 1 source 2 |
|
| Synology | Synology PHP 7.0 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official archive publishes this named PHP package family and architecture/platform-labelled SPK files. |
source 1 source 2 |
|
| Synology | Synology PHP 7.2 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official archive publishes this named PHP package family and architecture/platform-labelled SPK files. |
source 1 source 2 |
|
| Synology | Synology PHP 7.3 archived package family | Synology PHP 7.3; end of life | Vulnerable | Vulnerable | CVE assessment: Synology-SA-26:14 lists PHP 7.3 as affected by both CVEs and states that no fix will be provided because the package is end of life. Migrate dependent applications to a supported, fixed Synology PHP package; do not expect a PHP 7.3 fix. |
source 1 source 2 source 3 |
| Synology | Synology PHP 7.4 archived package family | 7.4.33-0131 or above in the corresponding Synology PHP branch | Fix | Fix | CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected. Update the corresponding PHP package through DSM Package Center and verify dependent services restart. |
source 1 source 2 source 3 |
| Synology | Synology PHP 8.0 archived package family | 8.0.30-0122 or above in the corresponding Synology PHP branch | Fix | Fix | CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected. Update the corresponding PHP package through DSM Package Center and verify dependent services restart. |
source 1 source 2 source 3 |
| Synology | Synology PHP 8.1 archived package family | 8.1.34-0120 or above in the corresponding Synology PHP branch | Fix | Fix | CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected. Update the corresponding PHP package through DSM Package Center and verify dependent services restart. |
source 1 source 2 source 3 |
| Synology | Synology PHP 8.2 archived package family | 8.2.35-0171 or above in the corresponding Synology PHP branch | Fix | Fix | CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected. Update the corresponding PHP package through DSM Package Center and verify dependent services restart. |
source 1 source 2 source 3 |
| Synology | Synology PHP 8.3 archived package family | 8.3.36-0051 or above in the corresponding Synology PHP branch | Fix | Fix | CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected. Update the corresponding PHP package through DSM Package Center and verify dependent services restart. |
source 1 source 2 source 3 |
| Synology | Synology PHP 8.4 package distribution | 8.4.27-0051 or above in the corresponding Synology PHP branch | Fix | Fix | CVE assessment: Synology-SA-26:14 names this PHP package and publishes the listed fixed release for both CVEs. Earlier unpatched packages remain affected. Update the corresponding PHP package through DSM Package Center and verify dependent services restart. |
source 1 source 2 source 3 |
| Synology | Synology Web Station optional PHP hosting | Web Station with vendor-patched PHP packages from Synology-SA-26:14 | Fix | Fix | CVE assessment: Synology names Web Station among affected PHP-dependent packages and says updating PHP resolves the vulnerabilities after dependent packages restart. This is a PHP dependency fix, not a separate Web Station release. Update the applicable PHP package through Package Center; supported fixed branches and builds are listed in Synology-SA-26:14. DSM versions older than 7.2 require the vendor's additional upgrade guidance. |
source 1 source 2 source 3 |