0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| Ubiquiti | UISP CRM (UCRM) | UISP Application 3.1.70 (CRM module) | Fix | Fix | CVE assessment: Ubiquiti confirms that UISP Application 3.1.70 fixes both PHP2Shell CVEs in the PHP runtime used by the UISP CRM module. Fix status applies to that release; it does not establish that existing deployments or cloud instances have been upgraded. Public official release dated 2026-10-23; Ubiquiti recommends updating promptly. The release notes do not specify a standalone CRM version, bundled PHP version, or complete affected-version range. Official release: https://uisp.community.ui.com/releases/UISP-Application-3-1-70/8292c6cb-4eb4-447d-9c90-455ca41b4f67 ; Historical community discussion: https://uisp.community.ui.com/questions/UCRM-4-6-15-remains-exposed-to-CVSS-9-2-RCEs-CVE-2026-109618-109619-ETA-for-PHP-8-3-36/d0fae711-2df1-4550-80e3-2b395a6a5c86 ; Earlier EA release (contents not independently verified): https://uisp.community.ui.com/releases/UISP-Application-3-1-69/d19ae117-04f7-42b3-bf53-f77d2b9e09fc |
source 1 source 2 source 3 |
| UnoPim | UnoPim | Rebuilt webkul/unopim 3.1.3 / 3.1 / latest with PHP 8.4.27 | Fix | Fix | CVE assessment: An UnoPim collaborator confirms published images were rebuilt with PHP 8.4.27 fixing both CVEs. The web image digest is sha256:733a1ac27259acd59a9542eefbde1417edfc1920458b52dcc7fa1fd09f03ca50; cached copies of the same tags are not fixed. Pull the rebuilt image by verified digest and recreate containers. Custom FPM builds and existing cached images need separate rebuilding and verification. |
source 1 source 2 source 3 source 4 |
| UnoPim | UnoPim official Docker images (webkul/unopim, webkul/unopim-queue) | Images 3.1.3 / 3.1 / latest rebuilt 2026-10-22 on PHP 8.4.27 | Fix | Fix | CVE assessment: UnoPim's v3.1.3 release note confirms the official webkul/unopim and webkul/unopim-queue images were rebuilt on PHP 8.4.27 for both CVEs. This confirms the named Docker image scope only; self-hosted installs must update their own PHP runtime and cached/running containers require pull and redeploy. Vendor-confirmed fix available in the named official Docker image scope; see the CVE assessment for self-hosted and deployment caveats. |
source 1 source 2 |
| Upsun | Upsun PHP application containers | Managed PHP runtime images: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports for 7.4 / 8.0 / 8.1 | Fix | Fix | CVE assessment: Upsun's official technical notice names both CVEs and the patched images; its public incident RSS confirms grid deployment on 21 October and completed Dedicated-cluster patch deployment at 04:12 UTC on 22 October. PHP 7.3 and earlier receive no updates, and composable images require the separate customer action described by the vendor. Edge mitigations alone are not a fix. Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements. |
source 1 source 2 source 3 source 4 |
| Utrecht University / Yoda | Yoda v1.5 legacy PHP web portal | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. Version 1.5 notes explicitly document the PHP portal upgrade. |
source | |
| Uwe Steinmann / SeedDMS project | SeedDMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project identifies a PHP-based document-management application with MySQL, SQLite or PostgreSQL and separately publishes two branch families. |
source 1 source 2 |