0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| TeamPass project | TeamPass | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project identifies a PHP/MySQL credential vault, lists native modules and separates the server from a browser extension. |
source 1 source 2 |
|
| Tenable | Tenable Enclave Security | SC-202610.1 on Enclave Security 1.7.0 / 1.8.0 / 1.9.1 (PHP 8.2.35) | Fix | Fix | CVE assessment: Patch SC-202610.1 updates the bundled PHP to 8.2.35. Affected: Enclave Security 1.9.1 and earlier. Patch-supported scope: Security Center 6.7.5, 6.8.0 and 6.9.1 on Enclave Security 1.7.0, 1.8.0 and 1.9.1 respectively. Apply the matching vendor patch in the Security Center pod, following the documented service stop/start procedure; verify the patch applied successfully. Unpatched installations remain affected. Tenable Enclave Security bundles a PHP runtime; vendor advisory TNS-2026-29 confirms CVE-2026-109618/109619 and a fix. |
source 1 source 2 |
| Tenable | Tenable Security Center (formerly Tenable.sc) | SC-202610.1 on Security Center 6.6.0 / 6.7.2 / 6.8.0 / 6.9.1 (PHP 8.2.35) | Fix | Fix | CVE assessment: Patch SC-202610.1 updates the bundled PHP to 8.2.35. Affected: Security Center 6.9.1 and earlier. Patch-supported scope: Security Center 6.6.0, 6.7.2, 6.8.0 and 6.9.1 on Oracle Linux or Red Hat Enterprise Linux 8 or later. Install the matching vendor patch and restart Security Center after installation; verify the patch applied successfully. Unpatched installations remain affected. Tenable Security Center bundles a PHP runtime for its web console; vendor advisory TNS-2026-28 confirms CVE-2026-109618/109619 (CVSSv3 9.8) and a fix. |
source 1 source 2 |
| TerraMaster | TerraMaster TOS6 Web Server optional PHP hosting | TOS 6 systems using PHP/Web Server; migration to TOS 7 required | Vulnerable | Vulnerable | CVE assessment: TerraMaster support explicitly lists TOS 5/6 as affected by both CVEs and names Web Server among PHP-dependent applications. TOS 6 users must migrate to TOS 7 and install its patched PHP packages; no in-place TOS 6 fix is established. Migrate to TOS 7, install the vendor-fixed PHP package in App Center and restart PHP-dependent services. Update containers independently. |
source 1 source 2 |
| Textpattern project | Textpattern CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Textpattern lists PHP, MySQL and required/optional PHP modules for its 4.9 line. |
source 1 source 2 |
|
| The Cacti Group | Cacti | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The source manifest and README confirm PHP for the web application and built-in poller, with differing table/develop minima. |
source 1 source 2 |
|
| The PHP Foundation / PHP PIE project | PHP Installer for Extensions (PIE) | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown The official README identifies a PHP-based extension installer, distinguishes its PHP execution version from the target, and points to the paginated Packagist extension catalogue. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP BCMath | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown BCMath: Arbitrary precision arithmetic. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP built-in development web server | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official manual documents the CLI SAPI built-in HTTP server and says it is for controlled development/testing use. The server implementation is present in the pinned CLI source. |
source 1 source 2 |
|
| The PHP Group | PHP Bzip2 | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Bzip2: Bzip2 streams, filters and compression. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Calendar | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Calendar: Calendar and date conversions. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Clang fuzzer SAPI | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown The released fuzzer manifest declares developer harnesses for PHP parser, execution, JIT, serialization and selected extensions. |
source | |
| The PHP Group | PHP CLI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The pinned PHP source declares the cli SAPI. Built by upstream default unless --disable-cli; jobs may also run in production. |
source 1 source 2 |
|
| The PHP Group | PHP COM and .NET | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown COM and .NET: Windows COM automation and native interoperation. The released build manifest declares this PHP component. |
source | |
| The PHP Group | PHP core and Zend Engine | Unversioned PHP runtime family anchor for downstream dependency links; version-scoped affected and fixed runtime variants are recorded separately. | source 1 source 2 source 3 source 4 |
|||
| The PHP Group | PHP core and Zend Engine affected web-serving release scope | >=5.4.0 before fixed release or vendor backport; supported branches <8.2.35, <8.3.36, <8.4.27, <8.5.12 | Vulnerable | Vulnerable | CVE assessment: Affected web-serving PHP runtime scope; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older branches require vendor backports or upgrade. Version-scoped PHP runtime variant for affected web-serving releases. PHP says all PHP installations serving web requests are at risk; Calif found affected paths back to PHP 5.4.0. |
source 1 source 2 source 3 source 4 |
| The PHP Group | PHP core and Zend Engine fixed upstream releases | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers Version-scoped PHP runtime variant for the upstream fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. |
source 1 source 2 source 3 |
| The PHP Group | PHP Ctype | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Ctype: Character classification. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP cURL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown cURL: Outbound URL transfers via libcurl. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Date/Time | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Date/Time: Date parsing, time zones and timelib. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP DBA | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown DBA: Database-file handlers and local key-value storage. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP dl_test | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown dl_test: Dynamic-extension loading test fixture. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP DOM | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown DOM: XML and HTML document manipulation. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Embed SAPI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The released embed build manifest creates a shared or static PHP library for use inside a host application. |
source | |
| The PHP Group | PHP Enchant | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Enchant: Spell-checking provider bridge. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Exif | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Exif: Image metadata parsing. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP FFI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown FFI: Native C library and memory interface. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Fileinfo | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Fileinfo: File-type and MIME identification. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Filter | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Filter: Validation and sanitization of input values. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP FTP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown FTP: FTP client and optional TLS transfer. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP GD | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown GD: Image decode, transform and encode. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Gettext | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Gettext: Translation catalogues and locale messages. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP GMP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown GMP: Multiple-precision arithmetic bridge. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Hash | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Hash: Hashing and compatibility mhash APIs. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Iconv | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Iconv: Character-set conversions. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP IMAP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Selected release notes build fixes for PHP 8.4; package minimum is 8.3.0. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP Intl | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Intl: ICU-backed internationalization. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP JSON | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown JSON: JSON parsing and serialization. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP LDAP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown LDAP: LDAP directory client. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Lexbor support bridge | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Lexbor support bridge: Internal PHP glue for HTML and URL parsing. The released build manifest declares this PHP component. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP Libxml bridge | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Libxml bridge: PHP integration with libxml-based parsers. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP LiteSpeed SAPI | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers The released source contains an LSAPI SAPI, and the PHP manual identifies LiteSpeed integration as bundled PHP. |
source 1 source 2 |
| The PHP Group | PHP Mbstring | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Mbstring: Multibyte conversion and optional regex. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP MySQLi | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown MySQLi: MySQL client API through mysqlnd. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Mysqlnd | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Mysqlnd: PHP-native MySQL protocol client. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP OCI8 extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Release states testing with PHP 8.2-8.5 and requires Oracle Client 11.2+. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP ODBC | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown ODBC: ODBC database client. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP OPcache | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown OPcache: Bytecode caching and optimization. The released build manifest declares this PHP component. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP OPcache JIT | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The pinned OPcache manifest has a separate JIT build switch and compiles JIT sources conditionally. The runtime manual exposes opcache.jit controls. |
source 1 source 2 |
|
| The PHP Group | PHP OpenSSL extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown OpenSSL extension: Cryptography and TLS stream integration. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PCNTL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PCNTL: Process control for CLI and CGI jobs. The released build manifest declares this PHP component. |
source | |
| The PHP Group | PHP PCRE | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PCRE: Regular expressions and PCRE2 integration. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO: Database API and driver abstraction. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO_DBLIB | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO_DBLIB: FreeTDS/DB-Library database client for PDO. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO_FIREBIRD | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO_FIREBIRD: Firebird client for PDO. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO_MYSQL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO_MYSQL: MySQL client for PDO. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO_OCI extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The selected release uses PDO APIs and Oracle Client 11.2+ libraries. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP PDO_ODBC | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO_ODBC: ODBC client for PDO. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO_PGSQL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO_PGSQL: PostgreSQL client for PDO. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP PDO_SQLITE | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PDO_SQLITE: SQLite-backed database operations for PDO. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Phar | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Phar: Executable and data archive handling. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP phpdbg | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The released phpdbg manifest declares a debugger SAPI; the manual documents PHP debugging and optional remote-console controls. |
source | |
| The PHP Group | PHP POSIX | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown POSIX: POSIX identity, process and resource APIs. The released build manifest declares this PHP component. |
source | |
| The PHP Group | PHP PostgreSQL extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown PostgreSQL extension: PostgreSQL client API. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Pspell extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Selected PECL release minimum is separate from the PHP 8.4 packaging transition. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP Random | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Random: Random-number generation APIs. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Readline | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Readline: Interactive command-line input. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Reflection | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Reflection: Runtime type and symbol inspection. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Session | CVE-2026-109619: PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 (session upload-progress lifecycle) | Investigation | Fix | CVE assessment: PHP relationship confirmed; CVE match unknown; CVE-2026-109619: the upstream advisory confirms the session upload-progress lifecycle and lists the fixed PHP releases. This assessment covers that lifecycle in web workers; CVE-2026-109618 remains Investigation at the Session component scope. Upgrade the complete PHP runtime to a listed fixed release and restart PHP workers. This change assesses only CVE-2026-109619 at the Session component scope. |
source 1 source 2 source 3 |
| The PHP Group | PHP Shmop | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Shmop: Shared-memory segment access. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP SimpleXML | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SimpleXML: XML document access. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP SNMP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SNMP: Network-management protocol client. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP SOAP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SOAP: SOAP client/server and XML message processing. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Sockets | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Sockets: Low-level socket API. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Sodium | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Sodium: Libsodium cryptography APIs. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP SPL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SPL: Standard PHP Library objects and iterators. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP SQLite3 | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown SQLite3: SQLite database access. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Standard functions | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Standard functions: Core strings, files, streams, URLs and serialization functions. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Sysvmsg | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Sysvmsg: System V message queues. The released build manifest declares this PHP component. |
source | |
| The PHP Group | PHP Sysvsem | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Sysvsem: System V semaphores. The released build manifest declares this PHP component. |
source | |
| The PHP Group | PHP Sysvshm | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Sysvshm: System V shared memory. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Tidy | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Tidy: HTML repair and parsing bridge. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Tokenizer | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Tokenizer: PHP source tokenization. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP URI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown URI: RFC 3986 and WHATWG URL parsing. The released build manifest declares this PHP component. |
source 1 source 2 source 3 |
|
| The PHP Group | PHP XML parser | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown XML parser: Event-based XML parsing. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP XMLReader | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown XMLReader: Streaming XML reader. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP XMLWriter | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown XMLWriter: XML output generation. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP XSL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown XSL: XML stylesheet transformation. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP zend_test | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown zend_test: Zend Engine test hooks and fixtures. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Zip | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Zip: Zip archive parsing and creation. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP Zlib extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Zlib extension: Compressed streams and filters. The released build manifest declares this PHP component. |
source 1 source 2 |
|
| The PHP Group | PHP-CGI | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers The pinned PHP source declares the cgi SAPI. Built by upstream default unless --disable-cgi; downstream packaging may differ. |
source 1 source 2 source 3 |
| The PHP Group | PHP-FPM | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers The pinned PHP source declares the fpm SAPI. Optional --enable-fpm; not evidence of FPM in every PHP build. |
source 1 source 2 source 3 |
| The PHP Group / Apache operators | Apache PHP module (mod_php) | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers The pinned PHP source declares the apache2handler SAPI. Optional --with-apxs2; Apache presence alone does not establish PHP. |
source 1 source 2 source 3 |
| The PHP Group / PHP Windows maintainers | Official PHP Windows binary ZIP distribution | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream Windows binaries are available for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Official downloads distinguish NTS/TS roles and list four architecture/thread-safety ZIP choices; the security advisory points users to fixed Windows binaries. |
source 1 source 2 source 3 |
| The PHP League | Flysystem | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Flysystem supplies a PHP storage abstraction with a separately documented adapter set and distinct require-dev integrations. |
source | |
| Thelia project | Thelia | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official 3.0 guide requires PHP and modules; migration notes distinguish the root application from the lower-level core package floor. |
source 1 source 2 |
|
| thirty development llc / thirty bees project | thirty bees | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The release/download page gives a PHP-specific build selection and runtime requirements; the repository identifies its PrestaShop 1.6.1.11 fork point. |
source 1 source 2 |
|
| Thunder project | Thunder Drupal distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The official FAQ defines Thunder as a Drupal distribution for professional publishers, inheriting the PHP application runtime. |
source | |
| Tideways / open-source fork contributors | Tideways XHProf archived native extension fork | Investigation | Investigation | CVE assessment: Historical scope; current use unknown Maintainer archive notice directs users to PECL XHProf and says this fork is not compatible with the commercial Tideways service. |
source | |
| Tideways GmbH | Tideways commercial PHP profiling extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Vendor requirements distinguish the PHP extension from its daemon and describe separate platform and libc scopes. |
source 1 source 2 |
|
| Tiki Software Community Association / Tiki project | Tiki Wiki CMS Groupware | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project documents a PHP 7.4-to-8.1 migration boundary and PHP-dependent Composer libraries. |
source | |
| Totara | Totara | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The vendor requires a PHP server and separates supported PHP branches, mandatory modules and recommended modules. |
source | |
| TransIP | TransIP API PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The client declares PHP, json/openssl and HTTP dependencies. A Guzzle adapter and Symfony cache are suggested separately. |
source | |
| TransIP | TransIP shared webhosting PHP option | Shared-hosting PHP patches deployed 21 October 2026, including 7.4 / 8.0 / 8.1 | Fix | Fix | CVE assessment: TransIP confirms all PHP versions offered on its shared-webhosting platform were patched. Customer-managed VPS, Kubernetes and OpenStack PHP installations are excluded and require customer updates. No action required on TransIP shared webhosting; separately patch customer-managed PHP environments. |
source 1 source 2 |
| Trend Micro | Apex Central | Apex Central; vendor version ranges not specified | Vulnerable | Vulnerable | CVE assessment: Trend Micro KA-0024802, updated 23 October, confirms Apex Central is impacted and mitigation is in development; no released fix is identified. Monitor KA-0024802 for vendor hotfixes or critical patches and restrict management access to trusted networks. |
source 1 source 2 |
| Trend Micro | Apex One | Apex One on-premises server; vendor version ranges not specified | Vulnerable | Vulnerable | CVE assessment: Trend Micro KA-0024802, updated 23 October, confirms Apex One on-premises server is impacted and mitigation is in development. Apex One as a Service is a separate scope. Monitor KA-0024802 for vendor hotfixes or critical patches and restrict management access to trusted networks. |
source 1 source 2 |
| TurnKey Linux | TurnKey Linux LAMP appliance PHP stack | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The LAMP appliance page includes PHP, CLI tooling and an upstream Composer installation. |
source | |
| TurnKey Linux | TurnKey Linux LAPP appliance PHP stack | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The LAPP appliance page documents PHP and PostgreSQL client support with Debian-packaged Composer. |
source | |
| TuxCare / CloudLinux | TuxCare ELS PHP distribution family | TuxCare ELS security packages released by 2026-10-22 00:07 UTC; vendor-supported PHP/OS combinations | Fix | Fix | CVE assessment: CloudLinux's 22 October completed-release update confirms that TuxCare ELS fixed packages are released for alt-php, distribution PHP and Windows PHP. Scope is vendor-supported ELS packages; lower upstream PHP version numbers can contain backports, so verify the installed package revision and CVE changelog. CloudLinux's completed release update confirms TuxCare ELS fixed packages for alt-php, distribution PHP and Windows PHP. |
source 1 source 2 source 3 |
| TuxCare / CloudLinux | TuxCare ELS PHP package for CentOS 8.4 | 7.4.6 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS CloudLinux reports a fixed TuxCare ELS php-7.4.6 release for CentOS 8.4 ELS. |
source 1 source 2 |
| TuxCare / CloudLinux | TuxCare ELS PHP package for CentOS 8.5 | 7.4.19 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS CloudLinux reports a fixed TuxCare ELS php-7.4.19 release for CentOS 8.5 ELS. |
source 1 source 2 |
| TuxCare / CloudLinux | TuxCare ELS PHP package for Ubuntu 16.04 | 7.0.33 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS CloudLinux reports a fixed TuxCare ELS php-7.0.33 release for Ubuntu 16.04 ELS. |
source 1 source 2 |
| TuxCare / CloudLinux | TuxCare ELS PHP package for Ubuntu 18.04 | 7.2.24-0 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS CloudLinux reports a fixed TuxCare ELS php-7.2.24-0 release for Ubuntu 18.04 ELS. |
source 1 source 2 |
| Twig / Symfony community | Twig template engine | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Twig compiles templates to PHP; its stable 3.x documentation and the registry default alpha describe distinct compatibility scopes. |
source 1 source 2 |
|
| Twilio API Team | Twilio PHP helper SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The helper SDK declares PHP >=7.1.0; Guzzle is suggested as an HTTP client and appears separately in require-dev. |
source | |
| Twilio SendGrid | Twilio SendGrid PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown The client declares PHP >=7.3, five extensions, HTTP-client and ECDSA packages; it replaces the sendgrid/sendgrid-php package name. |
source | |
| TYPO3 project | TYPO3 13.4 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official 13.4.36 download page publishes a PHP 8.2-8.5 requirement and source-archive checksums. Versioned 13.4 documentation describes required and optional modules. |
source 1 source 2 |