{"source":"https://github.com/NCSC-NL/php2shell","commit":"ecad8f7dbcc8197b825ae3ca3d790fa4069235d3","retrievedAt":"2026-10-23T05:43:05.842485+00:00","sha256":"c841d7d93548abba9ee4943043666a048a12071291b1b5fbf47c7342a5984bc1","license":"EUPL-1.2","transformation":"Pwnsy normalized package records and VEX assessments on 2026-10-23. Missing assessments remain Investigation; no deployment counts inferred.","records":[{"id":"PHP-0001","name":"PHP-FPM","vendor":"The PHP Group","category":"Runtime interfaces","version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","summary":"The pinned PHP source declares the fpm SAPI. Optional --enable-fpm; not evidence of FPM in every PHP build.","scope":"Inventory record: PHP-0001\nCategory: Runtime interfaces\nOriginal relationship: bundles\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: FPM / FastCGI\nPHP version scope: Source-confirmed PHP 8.5.10; other installed versions/builds not measured\nExtensions: Build-specific\nLimitations: Only workloads served by an affected FPM build and reachable code path.\nPatch owner: PHP package maintainer and operator\nDownstream surface: Web request processing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: php-fpm, fpm-fcgi\nConditional downstream consequence: A matching core/extension flaw can affect code executed by this SAPI; a SAPI-specific flaw requires this exact interface and deployment configuration. Worker privileges and isolation determine downstream consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package maintainer and operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fpm/config.m4","https://www.php.net/manual/en/book.fpm.php","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."}}},{"id":"PHP-0002","name":"PHP-CGI","vendor":"The PHP Group","category":"Runtime interfaces","version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","summary":"The pinned PHP source declares the cgi SAPI. Built by upstream default unless --disable-cgi; downstream packaging may differ.","scope":"Inventory record: PHP-0002\nCategory: Runtime interfaces\nOriginal relationship: bundles\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: CGI / FastCGI\nPHP version scope: Source-confirmed PHP 8.5.10; other installed versions/builds not measured\nExtensions: Build-specific\nLimitations: CGI-only vulnerabilities must not be generalized to FPM, CLI or all Windows PHP.\nPatch owner: PHP package maintainer and operator\nDownstream surface: Web request processing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: php-cgi, cgi-fcgi\nConditional downstream consequence: A matching core/extension flaw can affect code executed by this SAPI; a SAPI-specific flaw requires this exact interface and deployment configuration. Worker privileges and isolation determine downstream consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package maintainer and operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cgi/config9.m4","https://www.php.net/manual/en/install.php","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."}}},{"id":"PHP-0003","name":"Apache PHP module (mod_php)","vendor":"The PHP Group / Apache operators","category":"Runtime interfaces","version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","summary":"The pinned PHP source declares the apache2handler SAPI. Optional --with-apxs2; Apache presence alone does not establish PHP.","scope":"Inventory record: PHP-0003\nCategory: Runtime interfaces\nOriginal relationship: integrates\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache module\nPHP version scope: Source-confirmed PHP 8.5.10; other installed versions/builds not measured\nExtensions: Build-specific\nLimitations: Apache itself does not imply PHP is installed or that mod_php is enabled.\nPatch owner: PHP package maintainer and operator\nDownstream surface: Web request processing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: mod_php, apache2handler\nConditional downstream consequence: A matching core/extension flaw can affect code executed by this SAPI; a SAPI-specific flaw requires this exact interface and deployment configuration. Worker privileges and isolation determine downstream consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package maintainer and operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/apache2handler/config.m4","https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."}}},{"id":"PHP-0004","name":"PHP CLI","vendor":"The PHP Group","category":"Runtime interfaces","version":"Not specified","summary":"The pinned PHP source declares the cli SAPI. Built by upstream default unless --disable-cli; jobs may also run in production.","scope":"Inventory record: PHP-0004\nCategory: Runtime interfaces\nOriginal relationship: bundles\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Command-line execution\nPHP version scope: Source-confirmed PHP 8.5.10; other installed versions/builds not measured\nExtensions: Build-specific\nLimitations: CLI-only exposure usually requires attacker-controlled files, jobs or build input.\nPatch owner: PHP package maintainer and operator\nDownstream surface: Jobs and build systems\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: php CLI, cli\nConditional downstream consequence: A matching core/extension flaw can affect code executed by this SAPI; a SAPI-specific flaw requires this exact interface and deployment configuration. Worker privileges and isolation determine downstream consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package maintainer and operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/config.m4","https://docs.phpunit.de/en/12.5/installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0005","name":"FrankenPHP static builds","vendor":"FrankenPHP","category":"Embedded runtimes","version":"Not specified","summary":"PHP names FrankenPHP among web-serving installations at risk from both CVEs; maintainers state builds are prepared but fixed artifact release is not yet confirmed.","scope":"Inventory record: PHP-0005\nCategory: Embedded runtimes\nOriginal relationship: embeds\nRelationship direction: distributes_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Embedded PHP / ZTS\nPHP version scope: Selected at build\nExtensions: Selected at build\nLimitations: Do not assume an OS PHP update changes PHP embedded in a binary.\nPatch owner: Binary or image publisher and operator\nDownstream surface: Long-running application server\nRelease pin: Documentation URL; immutable release pin pending\nSource accessed: 2026-10-21\nConditional downstream consequence: Analyst judgment: a matching flaw in the PHP or extension code embedded in a selected static binary could affect requests and data accessible to that process. Remediation requires a rebuilt replacement binary or image and restart. Updating separate system PHP does not update the embedded runtime.\nVulnerability status: Vendor/upstream notice 2026-10-21: PHP names FrankenPHP among web-serving installations at risk and FrankenPHP maintainers state builds are prepared, but fixed artifact release is not yet confirmed.\nCVE-2026-109618: Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed\nCVE-2026-109619: Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed\nCVE assessment limit: PHP confirms web-serving FrankenPHP scope; exact affected FrankenPHP artifact versions and completed fixed release identifiers remain pending.","owner":"Binary or image publisher and operator","links":["https://frankenphp.dev/docs/static/","https://www.php.net/archive/2026.php#2026-10-21-1","https://github.com/php/frankenphp/issues/2732"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed","action":"Apply rebuilt FrankenPHP images, packages or binaries containing fixed PHP releases when available.","detail":"Added from the PHP security advisory and FrankenPHP project issue updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed","action":"Apply rebuilt FrankenPHP images, packages or binaries containing fixed PHP releases when available.","detail":"Added from the PHP security advisory and FrankenPHP project issue updated 2026-10-21."}}},{"id":"PHP-0006","name":"WordPress","vendor":"WordPress project","category":"CMS and publishing","version":"Not specified","summary":"Current WordPress requirements recommend PHP 8.3+ and allow legacy PHP 7.4+. The Hosting Handbook distinguishes required JSON/mysqli from recommended modules.","scope":"Inventory record: PHP-0006\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Compatible PHP web runtime\nPHP version scope: Current requirements: PHP 8.3+ recommended, legacy PHP 7.4+ compatibility; exact WordPress release constraints not pinned\nExtensions: Required: json and mysqli; pcre is core. Recommended modules include curl, dom, fileinfo, imagick, intl, mbstring, openssl, xml and zip. mysqlnd is a driver, not a standalone replacement for mysqli.\nLimitations: The current requirements page governs the PHP floor. Some handbook text still describes older WordPress/PHP generations. A current WordPress installation does not establish that its PHP runtime is patched.\nPatch owner: Hosting provider or operator\nDownstream surface: Public content and admin endpoints\nRelease pin: Documentation URL; immutable release pin pending\nSource accessed: 2026-10-16\nAliases: WordPress.org, wordpress/wordpress\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://wordpress.org/about/requirements/","https://make.wordpress.org/hosting/handbook/server-environment/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0007","name":"Drupal","vendor":"Drupal project","category":"CMS and publishing","version":"Not specified","summary":"The refreshed official compatibility matrix preserves major/minor-specific PHP bands. It directs exact extension requirements to core/composer.json; that linked source rendered only a loading placeholder.","scope":"Inventory record: PHP-0007\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Compatible PHP web runtime\nPHP version scope: Official matrix updated 4 August 2026: Drupal 10.4–10.6 supports PHP 8.1–8.4; 11.1–11.2 supports 8.3–8.4; 11.3–11.4 supports 8.3–8.5. Drupal 12 is a separate PHP 8.5 scope. Stable-release manifests remain unread; registry-default 12 beta must not set the stable 10/11 floor.\nExtensions: Guide-level, not a released manifest: PDO plus selected database driver, XML/DOM, JSON and an image backend. OpenSSL is feature-conditional/recommended; cURL testing/feature and mbstring language guidance are not a complete current-release extension set.\nLimitations: The guide mixes legacy database-connector/configuration prose with newer compatibility tables. Its connector names are not an exact Drupal 11 driver manifest. Stable 11.4.10/10.6.19 identities and advertised digest retained from prior evidence; package bytes, signatures and installed builds remain unverified. Registry API retrieval also failed. No exposure inferred.\nPatch owner: Hosting provider or operator\nDownstream surface: Public content and API endpoints\nRelease pin: Official 11.4.10 release page (14 Oct 2026), advertised tar.gz SHA256 e900d4c1b8753c5878526446c517c92b199429f9f99a9cff14d3e63c7b6ee909; not independently verified\nSource accessed: 2026-10-19\nAliases: Drupal core\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://www.drupal.org/docs/getting-started/system-requirements/php-requirements","https://www.drupal.org/project/drupal","https://www.drupal.org/project/drupal/releases/11.4.10","https://www.drupal.org/project/drupal/releases/10.6.19","https://packagist.org/packages/drupal/core"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0008","name":"Joomla 6.x","vendor":"Joomla project","category":"CMS and publishing","version":"Not specified","summary":"The stable/current Joomla documentation identifies version 6.1 and gives a PHP 8.3.0 minimum, PHP 8.4 recommendation and required modules.","scope":"Inventory record: PHP-0008\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Compatible PHP web runtime\nPHP version scope: Fresh stable/current documentation is labelled 6.1: PHP 8.3.0 minimum and PHP 8.4 recommended; other 6.x artifacts not independently pinned\nExtensions: Required: json, simplexml, dom, zlib, gd and the selected database module. Recommended: mbstring.\nLimitations: This replaces the seed /next/ source with the current 6.1 table. It does not prove a precise PHP requirement or affected build for every Joomla 6.x release.\nPatch owner: Hosting provider or operator\nDownstream surface: Public content and admin endpoints\nRelease pin: Joomla 6.1 version-labelled documentation retrieved 2026-10-16; immutable manifest pin pending\nSource accessed: 2026-10-16\nAliases: Joomla, Joomla CMS\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://manual.joomla.org/docs/get-started/technical-requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0009","name":"TYPO3 13.4","vendor":"TYPO3 project","category":"CMS and publishing","version":"Not specified","summary":"The official 13.4.36 download page publishes a PHP 8.2–8.5 requirement and source-archive checksums. Versioned 13.4 documentation describes required and optional modules.","scope":"Inventory record: PHP-0009\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Compatible PHP web runtime and CLI\nPHP version scope: Vendor page for TYPO3 13.4.36 lists PHP >=8.2.0 <=8.5.99; 13.4 requirements documentation supplies extension roles\nExtensions: Requirements vary by database/features. The 13.4 docs distinguish core modules from database connectors and optional GD, Zip and Zlib uses; full release manifest remains uninspected.\nLimitations: The archive checksum is published vendor metadata, not an independent download/signature verification. The actual installed PHP image, extensions and third-party TYPO3 packages remain unmeasured.\nPatch owner: Hosting provider or operator\nDownstream surface: Public content and admin endpoints\nRelease pin: TYPO3 13.4.36; published source tar.gz SHA-256 49aed89d1d90e2919c4fcc05d6fea95b8b693d3481589d74ed5215084c3fce3b\nSource accessed: 2026-10-16\nAliases: TYPO3, typo3/cms-core 13.4\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://docs.typo3.org/m/typo3/reference-coreapi/13.4/en-us/Administration/Installation/SystemRequirements/Index.html","https://get.typo3.org/version/13"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0010","name":"Adobe Commerce","vendor":"Adobe","category":"Commerce","version":"Not specified","summary":"Adobe separately lists PHP modules for its commercial and open-source editions, requires pcntl for parallel indexers, and publishes per-release PHP matrices.","scope":"Inventory record: PHP-0010\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI\nPHP version scope: Version matrix: 2.4.8-p5/p4 PHP 8.3 or 8.4; 2.4.7-p10/p9 8.2 or 8.3; 2.4.6-p15/p14 8.1 or 8.2. Matrix also has a distinct 2.4.9 PHP 8.5 column and 2.4.10-alpha section; release state not inferred from a table alone.\nExtensions: Required in current edition-specific documentation: bcmath, ctype, curl, dom, fileinfo, filter, ftp, gd, hash, iconv, intl, json, libxml, mbstring, openssl, pcre, pdo_mysql, reflection, simplexml, soap, sockets, sodium, tokenizer, xmlwriter, xsl, zip, zlib, spl. Conditional: pcntl for parallel indexers. Exact release/module differences unresolved.\nLimitations: Requirements are not a deployment measurement. Cloud Infrastructure and on-premises patch responsibility differ; this evidence does not establish exact PHP in a separate SaaS service or support entitlement. Editions, forks and shared instances overlap. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: Vendor, hosting provider and operator by deployment\nDownstream surface: Storefront, admin, APIs and indexers\nRelease pin: Versioned matrix samples 2.4.8-p5/p4, 2.4.7-p10/p9 and 2.4.6-p15/p14; immutable source/artifact pin pending\nSource accessed: 2026-10-17\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Vendor, hosting provider and operator by deployment","links":["https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings","https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0011","name":"Magento Open Source","vendor":"Magento / Adobe","category":"Commerce","version":"Not specified","summary":"Adobe’s shared PHP settings page supplies a separate Magento Open Source extension list and makes pcntl conditional on parallel indexing.","scope":"Inventory record: PHP-0011\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI\nPHP version scope: PHP required by the edition-specific Magento Open Source documentation; exact released PHP constraint not independently pinned in this batch. Commercial Adobe Commerce matrix is comparison context only.\nExtensions: Required in current edition-specific documentation: bcmath, ctype, curl, dom, fileinfo, filter, ftp, gd, hash, iconv, intl, json, libxml, mbstring, openssl, pcre, pdo_mysql, reflection, simplexml, soap, sockets, sodium, tokenizer, xmlwriter, xsl, zip, zlib. Conditional: pcntl for parallel indexers. Exact release/module differences unresolved.\nLimitations: The commercial Adobe Commerce version matrix is not applied as an exact Magento Open Source constraint. Edition-specific extension requirements are confirmed, but release differences and transitive modules remain unresolved. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: Hosting provider or operator\nDownstream surface: Storefront, admin, APIs and indexers\nRelease pin: Magento Open Source edition documentation; exact released composer manifest/source pin pending\nSource accessed: 2026-10-17\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/prerequisites/php-settings","https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0012","name":"WooCommerce","vendor":"WooCommerce","category":"Commerce","version":"Not specified","summary":"The vendor distinguishes its recommended PHP stack from a still-compatible legacy floor and names optional integration requirements.","scope":"Inventory record: PHP-0012\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0006\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP through WordPress\nPHP version scope: WooCommerce 10.8+ guidance recommends PHP >=8.3, tested through 8.4; same page says legacy PHP >=7.4 still works. Recommendation and compatibility floor are distinct.\nExtensions: Inherited WordPress requirements. Conditional: curl or fsockopen for selected network integrations; soap for some extensions; mbstring for the documented non-English-store use case.\nLimitations: A recommendation is not an observed runtime or release manifest. WordPress, WooCommerce and payment extensions may share one PHP worker and database. Compatible legacy PHP is not evidence of an installed old system. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: Hosting provider or operator\nDownstream surface: Storefront and checkout\nRelease pin: Documentation labelled WooCommerce 10.8+; immutable release pin pending\nSource accessed: 2026-10-17\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://woocommerce.com/document/server-requirements/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0013","name":"Moodle","vendor":"Moodle project","category":"Education and knowledge","version":"Not specified","summary":"Official 5.3 notes specify PHP 8.3.0+, additional 8.4.x support, sodium and 64-bit PHP. The download catalogue separates the 5.3 release from weekly 5.3+ packages and publishes a release checksum.","scope":"Inventory record: PHP-0013\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI\nPHP version scope: 5.3 release notes, dated 5 October 2026: PHP >=8.3.0, PHP 8.4.x also supported; 64-bit only. Separate documented matrix: 4.5 LTS 8.1–8.3; 5.0/5.1 8.2–8.4; 5.2 8.3–8.4.\nExtensions: Sodium required for 5.3. Complete release-resolved set and selected database driver not yet verified; generic extension guidance mixes required and recommended items.\nLimitations: Release date, package build/listing date and moving weekly 5.3+ are separate. The v5.3.0 environment.xml read was denied; full extension inventory remains unknown. The old Git link redirected to repository root, not tag content. Bundled Moodle4Mac/Windows stacks are separately scoped and not proof of a supported unmodified 5.3 environment. Clients and deployed institutions remain separate.\nPatch owner: Hosting provider or operator\nDownstream surface: Learning portals, uploads and scheduled jobs\nRelease pin: Moodle 5.3 release notes: 5 October 2026. Download listing labels the release package 3 October. Advertised tgz SHA256 7e5edf110555956571f40e42acffde0eb23681ebebd212a2fec0fe7d795dd511; bytes/signatures not verified.\nSource accessed: 2026-10-19\nAliases: Moodle LMS, moodle/moodle\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://moodledev.io/general/releases/5.3","https://docs.moodle.org/503/en/PHP","https://download.moodle.org/releases/latest/","https://packaging.moodle.org/stable503/moodle-5.3.tgz.sha256"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0014","name":"MediaWiki","vendor":"MediaWiki project","category":"Education and knowledge","version":"Not specified","summary":"MediaWiki explicitly requires PHP, lists native modules and distinguishes recommended modules from a 32-bit arithmetic alternative.","scope":"Inventory record: PHP-0014\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI\nPHP version scope: Moving latest-stable requirements: PHP >=8.3.0. Exact MediaWiki release and application artifact not independently pinned.\nExtensions: Required: calendar, ctype, dom, fileinfo, iconv, json, openssl, sodium, xml, xmlreader, intl, mbstring. Recommended: apcu, curl. Conditional: bcmath OR gmp on 32-bit; selected database driver; extra extensions may add modules.\nLimitations: The moving manual is not a measured build. Bundled Parsoid and optional Semantic MediaWiki are separate overlapping component records. Native libraries used by PHP and external image tools do not become PHP-dependent products. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: Hosting provider or operator\nDownstream surface: Wiki content, APIs and uploads\nRelease pin: Moving latest-stable manual; immutable MediaWiki release/composer pin pending\nSource accessed: 2026-10-17\nAliases: MediaWiki core\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator","links":["https://www.mediawiki.org/wiki/Manual:Installation_requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0015","name":"Nextcloud Server","vendor":"Nextcloud","category":"Collaboration and storage","version":"Not specified","summary":"Nextcloud confirms that deployments using affected PHP are at risk and points operators to fixed PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.","scope":"Inventory record: PHP-0015\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: mod_php or PHP-FPM\nPHP version scope: Revision-pinned project matrix: Nextcloud 35 PHP 8.3/8.4/8.5; 33–34 PHP 8.2–8.5; 31–32 PHP 8.1–8.4. All 27 listed major versions 9–35 are retained in a bounded catalogue. Current observed release identities: 35.0.2, 34.0.5 and 33.0.10 (15 October 2026), not a support-lifetime claim.\nExtensions: Required in current guide: ctype, curl, dom, fileinfo, gd, xml, simplexml, xmlreader, xmlwriter, mbstring, openssl, posix, session, zip, zlib. Choose one database PDO driver. Optional caching/media/CLI and app modules are feature-specific; filter is documented only for Mageia/FreeBSD.\nLimitations: The matrix is project documentation, not exact patch-level runtime constraints or an installed module measurement. The release commit only shows version.php, not full PHP prerequisites. Calendar’s complete app/core release pairing remains unread. AIO/Snap/NCP/Docker and operator services need separate builds; browser/mobile/desktop and office/signaling clients are not PHP servers. No deployed build or vulnerability inferred.\nPatch owner: Hosting provider or operator; image publisher for bundled distributions\nDownstream surface: Files, sharing, identity and apps\nRelease pin: Compatibility wiki revision d90292c6b2f2d0707fc61571364185fa311525bb (1 September 2026); 35.0.2 source commit ba900af933e61ffa005315b09d6454bfbbcbcc81 (published 15 October 2026). Not a verified distribution archive.\nSource accessed: 2026-10-21\nAliases: Nextcloud Server core, Nextcloud Hub server runtime\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Vendor notice 2026-10-21: Nextcloud states the PHP issue affects Nextcloud deployments and points operators to fixed PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35; Nextcloud-specific rebuilt image/release coverage remains separate.\nCVE-2026-109618: Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image\nCVE-2026-109619: Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image\nCVE assessment limit: Nextcloud confirms product impact and fixed upstream PHP release thresholds; installed PHP, image rebuilds, backports, configuration and reachable path need separate evidence.","owner":"Hosting provider or operator; image publisher for bundled distributions","links":["https://github.com/nextcloud/server/wiki/Releases-and-PHP-versions/d90292c6b2f2d0707fc61571364185fa311525bb","https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html","https://docs.nextcloud.com/server/stable/admin_manual/installation/php_configuration.html","https://github.com/nextcloud/server/releases","https://github.com/nextcloud/server/commit/ba900af933e61ffa005315b09d6454bfbbcbcc81","https://github.com/nextcloud/server/issues/65754"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers and follow Nextcloud guidance.","detail":"Added from the Nextcloud Server issue updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers and follow Nextcloud guidance.","detail":"Added from the Nextcloud Server issue updated 2026-10-21."}}},{"id":"PHP-0016","name":"ownCloud Classic 11","vendor":"ownCloud / Kiteworks","category":"Collaboration and storage","version":"Not specified","summary":"The vendor’s 11.0 guide confirms that supported Docker installations include PHP 8 and Apache and replace native Linux installation.","scope":"Inventory record: PHP-0016\nCategory: Collaboration and storage\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP 8 and Apache bundled in vendor Docker image; precise web SAPI/module ABI unverified\nPHP version scope: Classic 11 official installation guide explicitly says the only supported deployment is Docker including PHP 8 and Apache. Exact PHP minor/patch/build unknown.\nExtensions: Bundled with vendor image; exact native-module list not established by the current guide\nLimitations: A Docker host’s PHP installation is separate from PHP inside the image. The guide does not identify an image digest or exact loaded runtime/modules. Classic 10, Classic 11 and Infinite Scale are separate branch/implementation scopes; native clients do not inherit PHP. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: Vendor image publisher and operator\nDownstream surface: Files and sharing\nRelease pin: Versioned Classic 11 guide; exact vendor image tag/digest/SBOM and PHP patch pending\nSource accessed: 2026-10-17\nAliases: ownCloud Classic 11, ownCloud Server 11 Docker distribution\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Vendor image publisher and operator","links":["https://doc.owncloud.com/server/11.0/admin_manual/installation/installing_with_docker.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0017","name":"Laravel 13 framework","vendor":"Laravel","category":"Frameworks and packages","version":"Not specified","summary":"Laravel 13 deployment documentation identifies server PHP requirements and web/CLI deployment operations. The separately versioned 12 guide has a lower PHP floor.","scope":"Inventory record: PHP-0017\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI\nPHP version scope: Laravel 13 moving deployment guide: PHP >=8.3. Separately inspected Laravel 12 guide: >=8.2; do not apply the 13 floor to every Laravel application.\nExtensions: ctype; curl; dom; fileinfo; filter; hash; mbstring; openssl; pcre; pdo; session; tokenizer; xml\nLimitations: Framework, host application, queues and optional server packages overlap. Effective transitive floors and optional workers require release-specific resolution. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Application operator or hosting provider\nDownstream surface: Public APIs, apps and queue workers\nRelease pin: Version-labelled moving deployment documentation; exact release and deployed graph unverified\nSource accessed: 2026-10-17\nAliases: laravel/framework, Laravel 13\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application operator or hosting provider","links":["https://laravel.com/framework/docs/deployment","https://laravel.com/framework/docs/12.x/deployment"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0018","name":"Symfony framework","vendor":"Symfony","category":"Frameworks and packages","version":"Not specified","summary":"The current Symfony setup guide identifies PHP and six extensions; the official component catalogue and separate manifests distinguish reusable packages from the full framework.","scope":"Inventory record: PHP-0018\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI\nPHP version scope: Current setup guide targets 8.1.* and says PHP >=8.4. Independently inspected 8.1.9 component registry manifests require >=8.4.1. These scopes are not universal floors for older Symfony branches.\nExtensions: ctype; iconv; pcre; session; simplexml; tokenizer\nLimitations: A framework documentation minimum is not the exact resolved component minimum. Components can be used independently and overlap downstream applications; browser bundles and the separate Symfony CLI binary need their own evidence. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Application operator or hosting provider\nDownstream surface: Apps, APIs and console jobs\nRelease pin: Current setup documentation and 8.1.9 package declarations; immutable source retrievals failed\nSource accessed: 2026-10-17\nAliases: symfony/symfony, Symfony framework family\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application operator or hosting provider","links":["https://symfony.com/doc/current/setup.html","https://symfony.com/components","https://packagist.org/packages/symfony/http-foundation"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0019","name":"Composer","vendor":"Composer project","category":"Development and build","version":"Not specified","summary":"Composer itself runs on PHP, while its platform model describes PHP, ext-* and lib-* requirements separately from the project packages it manages.","scope":"Inventory record: PHP-0019\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; some generated runtime support\nPHP version scope: Current introduction documents PHP >=7.2.5 for the latest Composer tool; the separately described Composer 2.2.x LTS supports >=5.3.2. Project platform requirements can be higher.\nExtensions: Platform requirements represented as ext-* and lib-*\nLimitations: Composer does not install or patch the interpreter. require-dev, config.platform, provides/replaces, optional features and transitive choices must be kept separate from measured loaded components. Legacy compatibility is not an endorsement of PHP security support. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Build-image maintainer and operator\nDownstream surface: Dependency management and build credentials\nRelease pin: Current official introduction and platform documentation; exact PHAR build unverified\nSource accessed: 2026-10-17\nAliases: composer/composer, composer.phar\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while parsing untrusted package, source, archive or build metadata could affect the build/installer process and its credentials or generated artifacts. Normal package/plugin execution is not itself evidence of a PHP vulnerability. Production impact requires an additional propagation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Build-image maintainer and operator","links":["https://getcomposer.org/doc/articles/composer-platform-dependencies.md","https://getcomposer.org/doc/00-intro.md"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0020","name":"PHPUnit test framework","vendor":"PHPUnit project","category":"Development and build","version":"Not specified","summary":"PHPUnit is a PHP CLI test runner; release-specific metadata refines broad manual requirements.","scope":"Inventory record: PHP-0020\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI runner; Composer package or PHAR bundle\nPHP version scope: 12.5 guide: PHP8.3;13.4 guide: PHP8.4; selected13.4.3 registry narrows to PHP>=8.4.1\nExtensions: 13.4.3 required dom,filter,json,libxml,mbstring,xmlwriter; PHAR mode needs phar; coverage selects PCOV or Xdebug\nLimitations: The original12seed is preserved as version history within this family.13.4.3’s patch floor must not replace every12/13release requirement. Manual PHAR examples are not verified SBOMs for every downloaded bundle. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: PHPUnit maintainers for tool/bundle; PHP/OS/CI image maintainers and developer/operator for runtime, optional native drivers and rollout\nDownstream surface: Test runners and CI jobs\nRelease pin: Publisher13.4.3 advertised source2180c47c4229e5da117ff248753370443c074f10; bytes/signature unverified\nSource accessed: 2026-10-18\nAliases: phpunit/phpunit, PHPUnit 12, phpunit.phar\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHPUnit maintainers for tool/bundle; PHP/OS/CI image maintainers and developer/operator for runtime, optional native drivers and rollout","links":["https://packagist.org/packages/phpunit/phpunit","https://docs.phpunit.de/en/12.5/installation.html","https://docs.phpunit.de/en/13.4/installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0021","name":"PHP CS Fixer","vendor":"PHP CS Fixer project","category":"Development and build","version":"Not specified","summary":"The selected fixer release declares PHP and direct modules; official docs distinguish Composer/shim, PHAR and image use.","scope":"Inventory record: PHP-0021\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI / PHAR\nPHP version scope: Selected v3.95.27 registry: PHP^7.4||^8.0; scoped shim/image modes need their own build qualification\nExtensions: Required filter,hash,json,tokenizer; suggested dom for XML and mbstring for non-UTF8 handling\nLimitations: Optional native mbstring differs from a userland polyfill. Release/shim/image variants overlap; tool PHP does not establish PHP in every formatted output. Exact shim payload and current native modules remain unverified. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: PHP CS Fixer maintainers for tool/distribution; PHP/OS/CI image maintainers and operator for compatible runtime/modules and rollout\nDownstream surface: Formatting and CI jobs\nRelease pin: v3.95.27 advertised source1d0c68ee5f37446d8ad5970b82384cd1bb0a3317; source/binary bytes not verified\nSource accessed: 2026-10-18\nAliases: friendsofphp/php-cs-fixer, php-cs-fixer/shim, php-cs-fixer.phar\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP CS Fixer maintainers for tool/distribution; PHP/OS/CI image maintainers and operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/friendsofphp/php-cs-fixer","https://cs.symfony.com/doc/installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0022","name":"Zabbix web frontend","vendor":"Zabbix","category":"Monitoring and administration","version":"Not specified","summary":"The 7.4 guide identifies the PHP frontend, its PHP version range and conditional authentication/database modules separately from native server/proxy/agent requirements.","scope":"Inventory record: PHP-0022\nCategory: Monitoring and administration\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web frontend\nPHP version scope: Versioned 7.4 requirements: PHP 8.0.0–8.5.x; 8.5 support added in 7.4.9. Exact released PHP/build/module combination remains unpinned.\nExtensions: Required frontend list: bcmath, mbstring, gd (PNG/JPEG/FreeType), libxml, xmlwriter, xmlreader, ctype, session. Database connector and authentication/script/translation/mail modules are conditional.\nLimitations: The frontend requirement does not establish PHP in every Zabbix server, proxy, agent or external script. Browser/client libraries and native compilation dependencies are separate. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Zabbix for frontend application releases; PHP package/provider and deploying operator for compatible runtime/modules\nDownstream surface: Privileged monitoring console\nRelease pin: Zabbix 7.4 version-scoped documentation, including 7.4.9 PHP-8.5 note; immutable frontend/PHP pins pending\nSource accessed: 2026-10-17\nAliases: Zabbix PHP frontend\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Zabbix for frontend application releases; PHP package/provider and deploying operator for compatible runtime/modules","links":["https://www.zabbix.com/documentation/7.4/en/manual/installation/frontend","https://www.zabbix.com/documentation/7.4/en/manual/installation/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0023","name":"LibreNMS","vendor":"LibreNMS project","category":"Monitoring and administration","version":"Not specified","summary":"The root manifest requires PHP and runtime modules; the guide separately configures PHP-FPM/CLI and Python/native helper packages.","scope":"Inventory record: PHP-0023\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-FPM web environment and PHP CLI dependencies/jobs; Python/native collection and helper processes are distinct\nPHP version scope: Inspected master root require.php ^8.2; installation examples now provision PHP 8.5 and include an older 8.4 restart example. OS setup choice is not a universal minimum.\nExtensions: Root required: curl, gd, json, mbstring, pcre, pdo, session, simplexml, sockets, xml, zlib. Suggested modules include gmp, ldap, memcached, mysqlnd and posix; installed environment may add requirements.\nLimitations: Laravel ^12.10 and other resolved packages may impose additional bounds; the root is not the full compatible graph. Installer nmap/SNMP/system commands were only read, never installed or run. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: LibreNMS/component maintainers for application code; provider/operator for PHP/modules and separate poller/helper dependencies\nDownstream surface: Monitoring web UI and polling jobs\nRelease pin: Moving master composer manifest and installation guide; immutable application/lock/image pin pending\nSource accessed: 2026-10-17\nAliases: librenms/librenms\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"LibreNMS/component maintainers for application code; provider/operator for PHP/modules and separate poller/helper dependencies","links":["https://docs.librenms.org/Installation/Install-LibreNMS/","https://github.com/librenms/librenms/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0024","name":"GLPI","vendor":"GLPI / Teclib","category":"Monitoring and administration","version":"Not specified","summary":"The official release catalogue and pinned version-bump diff establish GLPI 12.0.0 final. The installation guide still covers only 10/11 PHP minima; the 12 release Composer manifest read was denied.","scope":"Inventory record: PHP-0024\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime; nginx PHP-FPM or documented Apache/other web-server setup\nPHP version scope: Guide: GLPI 10.0.x PHP >=7.4; 11.0.x >=8.2. GLPI 12.0.0 was released 7 October 2026, but its exact PHP floor and extension set were not retrieved. Do not inherit the guide’s 10/11 table as a 12 requirement.\nExtensions: Retained guide-scoped 10/11 requirements: dom, fileinfo, filter, libxml, simplexml, tokenizer, xmlreader, xmlwriter, curl, gd, intl, mysqli, session, zlib. GLPI 11 adds bcmath, mbstring, openssl. Full 12.0.0 list unknown; optional/emulated features remain separate.\nLimitations: A release identity is not a requirements manifest. PHP floors and required/optional arrays retained here apply only to the explicitly documented 10/11 scope. Version 12 minimums remain unknown. Official release advisory text was not treated as a PHP-core CVE or current product exposure. GLPI Agent/client, exact deployed build and plugin state remain separate.\nPatch owner: GLPI/Teclib and app maintainers for application releases; PHP package/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: IT service, inventory and admin data\nRelease pin: GLPI 12.0.0, 7 October 2026, commit cd812fbc82eaa8d0356d0fb650842069c1c18f4e. Version/changelog diff read; requirements and archive bytes not verified.\nSource accessed: 2026-10-19\nAliases: GLPI Server, GLPI 10 server, GLPI 11 server\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"GLPI/Teclib and app maintainers for application releases; PHP package/hosting provider and deploying operator for compatible runtime/module updates","links":["https://glpi-install.readthedocs.io/en/latest/prerequisites.html","https://github.com/glpi-project/glpi-agent","https://github.com/glpi-project/glpi/releases/tag/12.0.0","https://github.com/glpi-project/glpi/commit/cd812fbc82eaa8d0356d0fb650842069c1c18f4e"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0025","name":"phpMyAdmin","vendor":"phpMyAdmin project","category":"Monitoring and administration","version":"Not specified","summary":"Registry metadata provides a release-specific PHP/module subset while the development manual separates optional archive/media/authentication features.","scope":"Inventory record: PHP-0025\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime\nPHP version scope: Publisher registry advertises 5.2.3 (2025-10-08), PHP ^7.2.5 || ^8.0. Moving manual labelled 5.2.4-dev says >=7.2.5; these are distinct source/release scopes.\nExtensions: 5.2.3 registry requires hash, iconv, json, mysqli, openssl, pcre and xml. Sessions/SPL/ctype and conditional archive/media/update features differ in the manual; polyfills and optional modules are separate.\nLimitations: The development manual and release manifest are not merged into a universal native-module inventory. A browser interface does not put PHP in the client or MySQL/MariaDB server. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: phpMyAdmin for application releases; provider/operator for PHP/native modules and actual database credentials/privileges\nDownstream surface: Database administration console\nRelease pin: Registry-advertised 5.2.3 source reference ffb18e81197430a8a18475f6d104a3913521c985; immutable manifest retrieval failed\nSource accessed: 2026-10-17\nAliases: phpmyadmin/phpmyadmin\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"phpMyAdmin for application releases; provider/operator for PHP/native modules and actual database credentials/privileges","links":["https://docs.phpmyadmin.net/en/latest/require.html","https://packagist.org/packages/phpmyadmin/phpmyadmin"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0026","name":"Roundcube Webmail","vendor":"Roundcube project","category":"Mail and analytics","version":"Not specified","summary":"The official project identifies a PHP/JavaScript webmail server with an internal IMAP library; registry supplies a named release and bounded PHP range.","scope":"Inventory record: PHP-0026\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime\nPHP version scope: Registry advertises 1.7.4 (2026-09-06), PHP >=8.1 <8.6; inspected master has the same direct range. Other branches/plugins need separate constraints.\nExtensions: Full required native extension set unresolved. The manifest suggests sodium for EdDSA/OAuth; separate native database/authentication/plugin modules depend on the build.\nLimitations: The browser UI and remote IMAP/SMTP/database servers are separate. An internal IMAP library is not proof of the PHP imap native module being required, nor of PHP in the mail server. Plugins/skins and release variants need their own requirements. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Roundcube and plugin maintainers for application code; provider/operator for PHP/modules and separate mail services\nDownstream surface: Webmail, messages and user sessions\nRelease pin: Registry-advertised 1.7.4 source reference 0d05c37a6e565b1ff0f3a4472081f20a64d569a1; immutable manifest retrieval failed\nSource accessed: 2026-10-17\nAliases: roundcube/roundcubemail, Roundcube 1.7\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Roundcube and plugin maintainers for application code; provider/operator for PHP/modules and separate mail services","links":["https://github.com/roundcube/roundcubemail","https://packagist.org/packages/roundcube/roundcubemail","https://github.com/roundcube/roundcubemail/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0027","name":"Matomo On-Premise","vendor":"Matomo","category":"Mail and analytics","version":"Not specified","summary":"The vendor FAQ confirms PHP web/CLI processing and upcoming beta requirements; the 5.x source root preserves a lower declared PHP floor.","scope":"Inventory record: PHP-0027\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web tracking/API/report server and PHP CLI/background processing where configured\nPHP version scope: FAQ says Matomo 4.16/5 use PHP 8 and Matomo 6.0.0 beta requires >=8.1. Inspected 5.x-dev root manifest still declares >=7.2.5. Conflict/source scope retained; exact released dependency graph unresolved.\nExtensions: Database choice: pdo/pdo_mysql OR mysqli. GD/reporting and recommended curl/xml/mbstring/CLI packages are separate from a fully resolved mandatory module set.\nLimitations: Matomo 6 is explicitly labelled beta/upcoming in these sources and is not silently promoted to the current stable branch. Standalone, WordPress-integrated and connection-only plugins overlap differently. Browser/mobile trackers and cloud backends are not inferred from this server record. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Matomo/core/plugin maintainers for application code; provider/operator for PHP/modules and separately deployed tracking/report processes\nDownstream surface: Tracking endpoints, reports and archive jobs\nRelease pin: Moving FAQ plus 5.x-dev root manifest; exact Matomo stable/beta artifact, lock and PHP build pins pending\nSource accessed: 2026-10-17\nAliases: Matomo standalone server, Matomo analytics on-premise\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached by tracking/API requests, imported data, links, reports or background jobs could cause denial of service, disclosure, tampering or worker-level code execution. Analytics/customer data, configured integrations and responses/redirects could then be affected within application permissions. Browser execution, host privilege, remote service compromise and tenant escape are additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Matomo/core/plugin maintainers for application code; provider/operator for PHP/modules and separately deployed tracking/report processes","links":["https://matomo.org/faq/on-premise/matomo-requirements/","https://github.com/matomo-org/matomo/blob/5.x-dev/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0028","name":"cPanel EasyApache 4 / MultiPHP","vendor":"WebPros / cPanel","category":"Hosting and cloud","version":"EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0028\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Hosted PHP handlers; documented separate CLI and CGI binaries; exact active handler is configuration-specific\nPHP version scope: Moving EA4 page lists7.4 and8.1–8.5; version availability does not imply upstream support. Default-profile paragraph and maintenance wording conflict\nExtensions: Per installed EA-PHP version/profile; optional vendor backports distinct from normal cPanel updates\nLimitations: Hosting support does not establish PHP in every cPanel component; internal PHP is separately evidenced as PHP-0384. Old default-profile text is not accepted as a current supported-build pin. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: cPanel or selected backport vendor publishes EA-PHP packages; hosting operator applies updates and domain/handler configuration\nDownstream surface: Only hosted domains/jobs configured for installed EA-PHP packages\nRelease pin: EA4 documentation last modified2026-07-08; no exact package build/deployed state verified\nSource accessed: 2026-10-17\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"cPanel or selected backport vendor publishes EA-PHP packages; hosting operator applies updates and domain/handler configuration","links":["https://docs.cpanel.net/ea4/php/about-php/","https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/\nAction statement: Install the EA4 25.91 security packages for each active PHP branch and restart its workers; verify backported package revisions rather than upstream version alone."},"CVE-2026-109619":{"status":"Fix","notes":"EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/\nAction statement: Install the EA4 25.91 security packages for each active PHP branch and restart its workers; verify backported package revisions rather than upstream version alone."}}},{"id":"PHP-0029","name":"Plesk Obsidian hosted-site PHP","vendor":"Plesk","category":"Hosting and cloud","version":"Not specified","summary":"Plesk confirms hosted PHP remains affected in aggregate: Linux fixes are available for PHP 8.2-8.5, while Linux EOL branches and Windows builds remain affected.","scope":"Inventory record: PHP-0029\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Optional customer CGI/FastCGI/PHP-FPM handlers; Linux/Windows availability depends on OS/version\nPHP version scope: Plesk's 21 October 2026 advisory lists hosted PHP on Linux 8.5.11 and below, 8.4.26 and below, 8.3.35 and below, and 8.2.34 and below as affected, with fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux PHP 8.1, 8.0 and 7.4 remain affected with fixes in development. Plesk hosted PHP on Windows 8.2-8.5 remains affected with fixes in development.\nExtensions: Installed handler/package-specific; OS/OpenSSL compatibility affects available old PHP families\nLimitations: This aggregate hosted-site row spans Linux and Windows plus supported and EOL PHP branches; it remains affected while any included branch remains affected. Hosted patches cannot be copied into sw-engine or plesk-engine records. Optional handler availability, actual installed packages, OS eligibility and backports still need operator/build evidence. No package, tenant or listener was tested.\nPatch owner: Plesk or OS/custom PHP package supplier publishes updates; hosting operator applies selected hosted-handler updates\nDownstream surface: Only sites selecting the relevant installed PHP handler\nRelease pin: Plesk security advisory updated 2026-10-21; package bytes/digests and rollout unverified\nSource accessed: 2026-10-21\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Confirmed affected by Plesk advisory for CVE-2026-109618 and CVE-2026-109619; fixed Linux 8.2-8.5 hosted builds are available, but the aggregate hosted-site PHP row still includes affected Linux EOL and Windows branches.\nCVE-2026-109618: Vulnerable\nCVE-2026-109619: Vulnerable\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Plesk or OS/custom PHP package supplier publishes updates; hosting operator applies selected hosted-handler updates","links":["https://docs.plesk.com/release-notes/obsidian/change-log/","https://docs.plesk.com/en-US/obsidian/administrator-guide/web-hosting/php-management/installing-php.75153/","https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected hosted Plesk PHP in aggregate: Linux PHP 7.4, 8.0 and 8.1 plus Windows PHP 8.2-8.5 remain affected; fixed Linux PHP 8.2-8.5 builds are available","action":"Upgrade Linux hosted PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as applicable; apply Windows and EOL branch fixes when Plesk publishes them.","detail":"Added from the Plesk security advisory updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected hosted Plesk PHP in aggregate: Linux PHP 7.4, 8.0 and 8.1 plus Windows PHP 8.2-8.5 remain affected; fixed Linux PHP 8.2-8.5 builds are available","action":"Upgrade Linux hosted PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as applicable; apply Windows and EOL branch fixes when Plesk publishes them.","detail":"Added from the Plesk security advisory updated 2026-10-21."}}},{"id":"PHP-0030","name":"pfSense management components","vendor":"Netgate / pfSense","category":"Appliances and embedded","version":"Updated PHP packages: pfSense Plus 26.07 / 26.03.1 and CE 2.9.0: PHP 8.5.12; CE 2.8.1: PHP 8.3.36","summary":"Netgate's 21 October 2026 advisory supplies fixed PHP packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1. Exposure requires attacker access to the PHP GUI or Captive Portal; by default the GUI is LAN-only and Captive Portal is disabled. Apply the command-line update and reboot or restart the relevant services, including Captive Portal when enabled. Follow the advisory's WireGuard reinstall and connection-interruption warning.","scope":"Inventory record: PHP-0030\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: PHP legacy management interface and retained bundled management runtime; new Plus/Nexus GUI is separately Go-based, with coexistence documented\nPHP version scope: Updated PHP packages: pfSense Plus 26.07 / 26.03.1 and CE 2.9.0: PHP 8.5.12; CE 2.8.1: PHP 8.3.36\nExtensions: Optional extra modules include mysqli,pdo_mysql,pgsql; complete base module set is release-specific\nLimitations: CE and Plus do not share an assumed PHP patch. The new GUI does not establish removal of backend/CLI PHP or migration of every deployment. No WAN reachability, forwarding-plane PHP, tenant escape or compromise inferred. Full firmware/module/SBOM and enabled interfaces unknown.\nPatch owner: Appliance vendor and operator\nDownstream surface: Firewall configuration and administration\nRelease pin: Updated PHP packages: pfSense Plus 26.07 / 26.03.1 and CE 2.9.0: PHP 8.5.12; CE 2.8.1: PHP 8.3.36\nSource accessed: 2026-10-22\nAliases: pfsense:management-php\nConditional downstream consequence: Analyst judgment: a PHP flaw would need a matching still-used PHP runtime/component and reachable input. A Go GUI cannot automatically inherit a PHP bug, nor prove that PHP was removed elsewhere. Privileged configuration effects depend on the actual worker, rights and management path.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Netgate explicitly identifies both CVEs and confirms published fixed PHP packages for the named pfSense Plus/CE releases. Existing installations require the command-line package update, not just a GUI update. GUI and Captive Portal exposure are configuration-specific; older releases are not included in this fix confirmation.\nCVE-2026-109619: Netgate explicitly identifies both CVEs and confirms published fixed PHP packages for the named pfSense Plus/CE releases. Existing installations require the command-line package update, not just a GUI update. GUI and Captive Portal exposure are configuration-specific; older releases are not included in this fix confirmation.\nVendor advisory sources: https://www.netgate.com/blog/critical-php-security-update\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Appliance vendor and operator","links":["https://www.netgate.com/blog/critical-php-security-update","https://www.netgate.com/blog/the-new-gui-for-pfsense-plus","https://docs.netgate.com/pfsense/en/latest/development/additional-php-modules.html","https://docs.netgate.com/pfsense/en/latest/releases/2-9-0.html","https://docs.netgate.com/pfsense/en/latest/releases/26-07.html","https://docs.netgate.com/pfsense/en/latest/nexus/options.html"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Netgate explicitly identifies both CVEs and confirms published fixed PHP packages for the named pfSense Plus/CE releases. Existing installations require the command-line package update, not just a GUI update. GUI and Captive Portal exposure are configuration-specific; older releases are not included in this fix confirmation.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://www.netgate.com/blog/critical-php-security-update\nAction statement: Follow Netgate's command-line package update procedure, including its WireGuard reinstall warning, then reboot or restart the relevant PHP/GUI/Captive Portal services."},"CVE-2026-109619":{"status":"Fix","notes":"Netgate explicitly identifies both CVEs and confirms published fixed PHP packages for the named pfSense Plus/CE releases. Existing installations require the command-line package update, not just a GUI update. GUI and Captive Portal exposure are configuration-specific; older releases are not included in this fix confirmation.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://www.netgate.com/blog/critical-php-security-update\nAction statement: Follow Netgate's command-line package update procedure, including its WireGuard reinstall warning, then reboot or restart the relevant PHP/GUI/Captive Portal services."}}},{"id":"PHP-0031","name":"OPNsense WebGUI and API","vendor":"OPNsense / Deciso","category":"Appliances and embedded","version":"Community 26.7.7 PHP hotfix: 8.5.12; Business 26.4.2p3 PHP hotfix: 8.3.36","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0031\nCategory: Appliances and embedded\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Separate index.php WebGUI and api.php entrypoints; mixed legacy/MVC management\nPHP version scope: Community 26.7.7 PHP hotfix: 8.5.12; Business 26.4.2p3 PHP hotfix: 8.3.36\nExtensions: Phalcon5.22.1 listed in the inspected release; full required/optional enabled module set unknown\nLimitations: Management routing, legacy/MVC coexistence and forwarding data planes are separate. A newer firmware label does not prove unchanged PHP package bytes. Exact26.7.7 payload/SBOM, loaded modules, worker identities, installed systems and current vulnerability status remain unknown.\nPatch owner: Appliance vendor and operator\nDownstream surface: Firewall and network management\nRelease pin: Community 26.7.7 PHP hotfix: 8.5.12; Business 26.4.2p3 PHP hotfix: 8.3.36\nSource accessed: 2026-10-22\nAliases: opnsense:webgui-api-php\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: The OPNsense team's Administrator announcement explicitly confirms a released hotfix for both CVEs in Community 26.7.7 and Business 26.4.2p3. Install the PHP hotfix even if the displayed product release already matches; captive portal users must restart that service afterward.\nCVE-2026-109619: The OPNsense team's Administrator announcement explicitly confirms a released hotfix for both CVEs in Community 26.7.7 and Business 26.4.2p3. Install the PHP hotfix even if the displayed product release already matches; captive portal users must restart that service afterward.\nVendor advisory sources: https://forum.opnsense.org/index.php?topic=53191.msg276103\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Appliance vendor and operator","links":["https://docs.opnsense.org/releases/CE_26.7.html","https://docs.opnsense.org/development/frontend/routing.html","https://forum.opnsense.org/index.php?topic=53191.msg276103"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"The OPNsense team's Administrator announcement explicitly confirms a released hotfix for both CVEs in Community 26.7.7 and Business 26.4.2p3. Install the PHP hotfix even if the displayed product release already matches; captive portal users must restart that service afterward.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://forum.opnsense.org/index.php?topic=53191.msg276103\nAction statement: Install the vendor's PHP security hotfix and restart the captive portal service if used."},"CVE-2026-109619":{"status":"Fix","notes":"The OPNsense team's Administrator announcement explicitly confirms a released hotfix for both CVEs in Community 26.7.7 and Business 26.4.2p3. Install the PHP hotfix even if the displayed product release already matches; captive portal users must restart that service afterward.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://forum.opnsense.org/index.php?topic=53191.msg276103\nAction statement: Install the vendor's PHP security hotfix and restart the captive portal service if used."}}},{"id":"PHP-0032","name":"Docker Official Image: php","vendor":"Docker Official Images maintainers","category":"Containers and distribution","version":"Not specified","summary":"Official Docker PHP source definitions and official-images metadata reference patched stable PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed image digests still need verification.","scope":"Inventory record: PHP-0032\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed image definitions\nDeployment status: Not measured\nPHP surface: CLI/Apache/FPM/ZTS build variants; Debian and Alpine bases\nPHP version scope: Official versions.json lists patched stable branches 8.2.35, 8.3.36, 8.4.27 and 8.5.12; the selected stable 8.5.12 matrix maps to source f6048b5f6e3c2202ee082665a4ccc0d90de291a3; RC tags are distinct.\nExtensions: Variant/version/custom-build specific; optional PECL/extension installer examples are not default module presence\nLimitations: Aliases/latest are not installations. Advertised source commits are not image content digests. Native ABI differs by Debian/glibc versus Alpine/musl. OS PHP packages do not patch source-built /usr/local PHP; downstream images need rebuild and rollout. Mutable tags and cached layers do not prove that a deployed workload has been updated.\nPatch owner: Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout\nDownstream surface: Derived images and running containers\nRelease pin: Stable PHP 8.5.12 build source f6048b5f6e3c2202ee082665a4ccc0d90de291a3; image digests unverified\nSource accessed: 2026-10-21\nAliases: docker.io/library/php\nConditional downstream consequence: Analyst judgment: a matching PHP or loaded-extension flaw could affect a selected affected image variant when the relevant input path is reachable. The base publisher must provide a corrected build, derived images must rebuild against it, and operators must replace running containers. Tags, cached layers and separate OS PHP updates do not prove that rollout occurred.\nVulnerability status: Official Docker PHP image source definitions and official-images metadata were updated to PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests still need verification.\nCVE-2026-109618: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE-2026-109619: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE assessment limit: Vendor source establishes updated source definitions and official-images metadata, not deployed image bytes; operators must verify tags/digests, pull rebuilt images and rebuild/redeploy derived images and running containers.","owner":"Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout","links":["https://github.com/docker-library/official-images/blob/master/library/php","https://hub.docker.com/_/php","https://github.com/docker-library/docs/blob/master/php/README.md","https://github.com/docker-library/php/pull/1694","https://raw.githubusercontent.com/docker-library/php/master/versions.json","https://github.com/docker-library/official-images/pull/22541"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."}}},{"id":"PHP-0033","name":"XAMPP","vendor":"Apache Friends","category":"Containers and distribution","version":"Not specified","summary":"Apache Friends explicitly lists PHP in its Apache/MariaDB/Perl native bundles. The browser/Endor environment is separated into its own delivery record.","scope":"Inventory record: PHP-0033\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled Apache and PHP\nPHP version scope: Downloads list Windows/Linux 8.0.30/8.1.25/8.2.12, macOS 8.0.28/8.1.17/8.2.4. Linux 8.2.12 label conflicts with included-components prose8.2.4.\nExtensions: Installer/OS-specific; PEAR is tooling rather than a native extension; complete module inventory unresolved\nLimitations: Old available installers are not proof of maintenance/security support. Linux label/prose conflict prevents treating either patch as measured binary contents. Development bundle use is not assumed internet-facing. Browser listing is not a native installer or PHP in every browser.\nPatch owner: Apache Friends/bundle publisher and operator replacing the selected OS installer/runtime\nDownstream surface: Developer systems and any exposed bundled services\nRelease pin: Dated installer catalogue; binary checksums/contents not independently verified\nSource accessed: 2026-10-17\nAliases: xampp:native-installers\nConditional downstream consequence: Analyst judgment: a matching flaw in the selected bundle's PHP or loaded modules could affect that process and accessible files or credentials. Replace the affected OS-specific bundle/runtime and restart its services. A development bundle's presence alone does not establish Internet exposure, production impact or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Apache Friends/bundle publisher and operator replacing the selected OS installer/runtime","links":["https://www.apachefriends.org/download.html","https://www.apachefriends.org/index.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0034","name":"Azure App Service PHP on Linux","vendor":"Microsoft","category":"Hosting and cloud","version":"Not specified","summary":"Microsoft documents Linux PHP workloads and explicitly says Windows PHP support ended in November2022.","scope":"Inventory record: PHP-0034\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Managed Linux customer PHP web/API runtime; custom extension configuration\nPHP version scope: PHP supported on App Service Linux; built-in Windows PHP support ended November2022. Current stack/patch not statically resolved\nExtensions: Default common extensions and optional compatible .so modules; complete current Linux list unknown\nLimitations: The page says reference-only and retains Windows/VC9 examples beside Linux text. These are not current Linux ABI or runtime-version guidance. Server PHP does not establish PHP in browser/mobile clients or Azure control planes. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Microsoft for managed stack distribution; app owner for chosen stack, compatible extensions/dependencies and rollout verification; custom-image owner for custom runtimes\nDownstream surface: Managed app instances and deployment slots\nRelease pin: Moving reference-only Microsoft guide; exact supported runtime release/build remains a gap\nSource accessed: 2026-10-17\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Microsoft for managed stack distribution; app owner for chosen stack, compatible extensions/dependencies and rollout verification; custom-image owner for custom runtimes","links":["https://learn.microsoft.com/en-us/azure/app-service/configure-language-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0035","name":"AWS Elastic Beanstalk PHP platform","vendor":"Amazon Web Services","category":"Hosting and cloud","version":"Not specified","summary":"AWS publishes four PHP AL2023 platform4.13.10 rows with branch-specific PHP patches and Composer2.10.3/PIE1.5.1.","scope":"Inventory record: PHP-0035\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Selected AL2023 PHP application platform; nginx(default)/Apache proxy choice, precise SAPI not established by platform table\nPHP version scope: AL2023 platform4.13.10, AMI2023.12.20260930: PHP8.5.11,8.4.26,8.3.33,8.2.33 across four named branches\nExtensions: Complete required/built-in/optional module inventory not supplied by supported-platform table\nLimitations: This is a released-platform catalogue, not measured tenant AMIs or PHP patches. Proxy software does not itself establish the PHP SAPI; no inference to other AWS services. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: AWS publishes updated PHP platforms; environment operator selects/applies appropriate platform update policy and app dependencies\nDownstream surface: Application environments and instances\nRelease pin: PHP AL2023 platform4.13.10; AMI version2023.12.20260930; four PHP branch rows, image bytes unverified\nSource accessed: 2026-10-17\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"AWS publishes updated PHP platforms; environment operator selects/applies appropriate platform update policy and app dependencies","links":["https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0036","name":"AWS SDK for PHP v3","vendor":"Amazon Web Services","category":"SDKs and integrations","version":"Not specified","summary":"AWS SDK 3.401.2 declares PHP >=8.1 and json/pcre/simplexml. aws/aws-crt-php is required as a userland package; it does not prove ext-awscrt is loaded.","scope":"Inventory record: PHP-0036\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Client-side PHP library in a calling application\nPHP version scope: 3.401.2: PHP >=8.1; PHAR/ZIP mbstring requirement is a separate installation scope\nExtensions: Direct Composer requires json, pcre, simplexml; optional curl/openssl/pcntl/sockets; PHAR/ZIP installation additionally needs mbstring\nLimitations: Caller-side PHP only. The installation guide's mbstring requirement applies to PHAR/ZIP paths, not the direct Composer ext-* set. SDK presence does not identify AWS backend language, actual API use, permissions or deployed build. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: AWS SDK maintainers for client library; calling application and PHP/OS/image owners for runtime, dependency selection and rollout\nDownstream surface: Cloud API credentials and client applications\nRelease pin: Publisher registry 3.401.2; advertised source b1af9196bd0f94bcebdb6588a150dd85dc240758; bytes/signatures unverified\nSource accessed: 2026-10-18\nAliases: aws/aws-sdk-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"AWS SDK maintainers for client library; calling application and PHP/OS/image owners for runtime, dependency selection and rollout","links":["https://packagist.org/packages/aws/aws-sdk-php","https://docs.aws.amazon.com/sdk-for-php/v3/developer-guide/getting-started_installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0037","name":"PHP core and Zend Engine","vendor":"The PHP Group","category":"PHP core","version":"Not specified","summary":"Unversioned PHP runtime family anchor for downstream dependency links; version-scoped affected and fixed runtime variants are recorded separately.","scope":"Inventory record: PHP-0037\nCategory: PHP core\nOriginal relationship: component\nRelationship direction: part_of_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Engine shared by selected SAPIs; request lifecycle, parser and execution engine\nPHP version scope: Unversioned runtime family node; affected and fixed release scopes are represented by PHP-0649 and PHP-0650 variants.\nExtensions: Enabled extensions vary by binary; main runtime and Zend Engine are core components\nLimitations: This family anchor does not itself assert a vulnerable or fixed build. It overlaps with SAPIs, modules and downstream application records; version-scoped VEX is carried by dedicated variant nodes.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Common language runtime beneath web apps, scheduled jobs, build tools and embedded PHP\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-21\nAliases: Zend Engine, php-src/main, php-src/Zend\nConditional downstream consequence: A reachable matching engine flaw could affect multiple application families using the same binary. Severity, worker privileges and isolation determine disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Version-scoped VEX is represented on PHP-0649 (affected runtime scope) and PHP-0650 (fixed upstream releases).\nCVE-2026-109618: See version-scoped PHP runtime variants\nCVE-2026-109619: See version-scoped PHP runtime variants\nCVE assessment limit: Installed version, backport, configuration, SAPI and reachable path still need deployment-specific evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/Zend/zend.c","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/main/main.c","https://www.php.net/supported-versions.php","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"No scoped VEX assessment in this snapshot."},"CVE-2026-109619":{"status":"Investigation","notes":"No scoped VEX assessment in this snapshot."}}},{"id":"PHP-0038","name":"PHP BCMath","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"BCMath: Arbitrary precision arithmetic. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0038\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Arbitrary precision arithmetic\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Arbitrary precision arithmetic\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: bcmath, ext/bcmath\nConditional downstream consequence: A matching arithmetic or numeric-parser flaw could affect computed results or availability when an application passes attacker-controlled values. No defect or RCE is inferred.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bcmath/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0039","name":"PHP Bzip2","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Bzip2: Bzip2 streams, filters and compression. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0039\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bzip2 streams, filters and compression\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Bzip2 streams, filters and compression\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: bz2, ext/bz2\nConditional downstream consequence: If a matching flaw is reached through an untrusted archive or compressed stream, file-processing workers could suffer DoS, disclosure or integrity impact; native code execution requires separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/bz2/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0040","name":"PHP Calendar","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Calendar: Calendar and date conversions. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0040\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Calendar and date conversions\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified. The generic calendar alias must be qualified; it is not an app dependency edge to Nextcloud Calendar.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Calendar and date conversions\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: calendar, ext/calendar\nConditional downstream consequence: A matching arithmetic or numeric-parser flaw could affect computed results or availability when an application passes attacker-controlled values. No defect or RCE is inferred.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/calendar/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0041","name":"PHP COM and .NET","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"COM and .NET: Windows COM automation and native interoperation. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0041\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Windows COM automation and native interoperation\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Windows manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified. Windows-only; do not apply its automation surface to Unix PHP.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Windows COM automation and native interoperation\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: com_dotnet, ext/com_dotnet\nConditional downstream consequence: A matching PHP/native-interface flaw could affect the invoking process. The intended ability to call native or automation APIs is not itself a vulnerability; application permissions and configuration remain decisive.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/com_dotnet/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0042","name":"PHP Ctype","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Ctype: Character classification. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0042\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Character classification\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Character classification\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: ctype, ext/ctype\nConditional downstream consequence: A matching validation or conversion flaw could change application decisions or exhaust resources when untrusted input reaches this API. No authorization bypass is established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ctype/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0043","name":"PHP cURL","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"cURL: Outbound URL transfers via libcurl. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0043\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Outbound URL transfers via libcurl\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Outbound URL transfers via libcurl\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: curl, ext/curl\nConditional downstream consequence: A matching response-parser, connection or TLS flaw could affect the PHP client process, its outbound credentials or availability. Client-library presence does not make the remote service backend PHP-based.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/curl/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0044","name":"PHP Date/Time","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Date/Time: Date parsing, time zones and timelib. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0044\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Date parsing, time zones and timelib\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Date parsing, time zones and timelib\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: date, ext/date\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config0.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/date/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0045","name":"PHP DBA","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"DBA: Database-file handlers and local key-value storage. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0045\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Database-file handlers and local key-value storage\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Database-file handlers and local key-value storage\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: dba, ext/dba\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dba/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0046","name":"PHP dl_test","vendor":"The PHP Group","category":"Development and build","version":"Not specified","summary":"dl_test: Dynamic-extension loading test fixture. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0046\nCategory: Development and build\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP test build; Dynamic-extension loading test fixture\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Optional PHP source test fixture. Do not infer installed production code, a web listener or a current vulnerability.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Dynamic-extension loading test fixture\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: dl_test, ext/dl_test\nConditional downstream consequence: Relevant to developer or CI binaries only when the test component was built and attacker-controlled test input reaches it. Source inclusion is not evidence of a production service.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dl_test/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0047","name":"PHP DOM","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"DOM: XML and HTML document manipulation. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0047\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: XML and HTML document manipulation\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: libxml, lexbor\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: XML and HTML document manipulation\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: dom, ext/dom\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/dom/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0048","name":"PHP Enchant","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Enchant: Spell-checking provider bridge. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0048\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Spell-checking provider bridge\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Spell-checking provider bridge\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: enchant, ext/enchant\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/enchant/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0049","name":"PHP Exif","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Exif: Image metadata parsing. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0049\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Image metadata parsing\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest; optional: mbstring\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Image metadata parsing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: exif, ext/exif\nConditional downstream consequence: A matching image, MIME or metadata parser flaw could affect upload, thumbnail or file-classification workers. Native-code execution and exposure require a demonstrated matching build and reachable parser.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/exif/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0050","name":"PHP FFI","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"FFI: Native C library and memory interface. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0050\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native C library and memory interface\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Native C library and memory interface\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: ffi, ext/ffi\nConditional downstream consequence: A matching PHP/native-interface flaw could affect the invoking process. The intended ability to call native or automation APIs is not itself a vulnerability; application permissions and configuration remain decisive.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ffi/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0051","name":"PHP Fileinfo","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Fileinfo: File-type and MIME identification. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0051\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: File-type and MIME identification\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pcre\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: File-type and MIME identification\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: fileinfo, ext/fileinfo\nConditional downstream consequence: A matching image, MIME or metadata parser flaw could affect upload, thumbnail or file-classification workers. Native-code execution and exposure require a demonstrated matching build and reachable parser.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/fileinfo/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0052","name":"PHP Filter","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Filter: Validation and sanitization of input values. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0052\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Validation and sanitization of input values\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pcre\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Validation and sanitization of input values\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: filter, ext/filter\nConditional downstream consequence: A matching validation or conversion flaw could change application decisions or exhaust resources when untrusted input reaches this API. No authorization bypass is established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/filter/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0053","name":"PHP FTP","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"FTP: FTP client and optional TLS transfer. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0053\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: FTP client and optional TLS transfer\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: FTP client and optional TLS transfer\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: ftp, ext/ftp\nConditional downstream consequence: A matching response-parser, connection or TLS flaw could affect the PHP client process, its outbound credentials or availability. Client-library presence does not make the remote service backend PHP-based.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ftp/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0054","name":"PHP GD","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"GD: Image decode, transform and encode. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0054\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Image decode, transform and encode\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Image decode, transform and encode\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: gd, ext/gd\nConditional downstream consequence: A matching image, MIME or metadata parser flaw could affect upload, thumbnail or file-classification workers. Native-code execution and exposure require a demonstrated matching build and reachable parser.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gd/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0055","name":"PHP Gettext","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Gettext: Translation catalogues and locale messages. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0055\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Translation catalogues and locale messages\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Translation catalogues and locale messages\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: gettext, ext/gettext\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gettext/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0056","name":"PHP GMP","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"GMP: Multiple-precision arithmetic bridge. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0056\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Multiple-precision arithmetic bridge\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Multiple-precision arithmetic bridge\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: gmp, ext/gmp\nConditional downstream consequence: A matching arithmetic or numeric-parser flaw could affect computed results or availability when an application passes attacker-controlled values. No defect or RCE is inferred.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/gmp/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0057","name":"PHP Hash","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Hash: Hashing and compatibility mhash APIs. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0057\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Hashing and compatibility mhash APIs\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Hashing and compatibility mhash APIs\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: hash, ext/hash, mhash compatibility API (within Hash)\nConditional downstream consequence: A matching PHP binding, cryptography or TLS flaw could affect confidentiality, integrity or worker availability. The exact PHP build and upstream crypto implementation must be distinguished.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/hash/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0058","name":"PHP Iconv","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Iconv: Character-set conversions. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0058\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Character-set conversions\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Character-set conversions\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: iconv, ext/iconv\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/iconv/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0059","name":"PHP Intl","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Intl: ICU-backed internationalization. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0059\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: ICU-backed internationalization\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: date\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: ICU-backed internationalization\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: intl, ext/intl\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/intl/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0060","name":"PHP JSON","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"JSON: JSON parsing and serialization. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0060\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: JSON parsing and serialization\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: JSON parsing and serialization\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: json, ext/json\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/json/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0061","name":"PHP LDAP","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"LDAP: LDAP directory client. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0061\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: LDAP directory client\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: LDAP directory client\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: ldap, ext/ldap\nConditional downstream consequence: A matching response-parser, connection or TLS flaw could affect the PHP client process, its outbound credentials or availability. Client-library presence does not make the remote service backend PHP-based.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/ldap/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0062","name":"PHP Lexbor support bridge","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Lexbor support bridge: Internal PHP glue for HTML and URL parsing. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0062\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Internal PHP glue for HTML and URL parsing\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified. This row covers PHP glue, not the upstream standalone Lexbor project.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Internal PHP glue for HTML and URL parsing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: lexbor, ext/lexbor\nConditional downstream consequence: A matching support-library flaw could propagate through its PHP HTML/URL consumers. The upstream native library is a dependency used by PHP, not a separate product that requires PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/config.w32","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/lexbor/php_lexbor.c"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0063","name":"PHP Libxml bridge","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Libxml bridge: PHP integration with libxml-based parsers. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0063\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP integration with libxml-based parsers\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: PHP integration with libxml-based parsers\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: libxml, ext/libxml\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config0.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/libxml/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0064","name":"PHP Mbstring","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Mbstring: Multibyte conversion and optional regex. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0064\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Multibyte conversion and optional regex\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pcre\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Multibyte conversion and optional regex\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: mbstring, ext/mbstring\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mbstring/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0065","name":"PHP MySQLi","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"MySQLi: MySQL client API through mysqlnd. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0065\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: MySQL client API through mysqlnd\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: mysqlnd, spl\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: MySQL client API through mysqlnd\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: mysqli, ext/mysqli\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqli/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0066","name":"PHP Mysqlnd","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Mysqlnd: PHP-native MySQL protocol client. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0066\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-native MySQL protocol client\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: hash\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: PHP-native MySQL protocol client\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: mysqlnd, ext/mysqlnd\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config9.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/mysqlnd/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0067","name":"PHP ODBC","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"ODBC: ODBC database client. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0067\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: ODBC database client\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: ODBC database client\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: odbc, ext/odbc\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/odbc/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0068","name":"PHP OPcache","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"OPcache: Bytecode caching and optimization. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0068\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bytecode caching and optimization\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: date, pcre\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified. PHP 8.5 always builds/loads OPcache; caching, CLI use and JIT remain configuration-dependent. Older shared-extension instructions are not valid for 8.5.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Bytecode caching and optimization\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: opcache, ext/opcache\nConditional downstream consequence: A matching engine, serialization, iterator or optimizer flaw could affect applications executing the relevant PHP operations; remote reachability depends on application data flow and worker privileges.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.w32","https://www.php.net/manual/en/migration85.incompatible.php#migration85.incompatible.opcache"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0069","name":"PHP OpenSSL extension","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"OpenSSL extension: Cryptography and TLS stream integration. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0069\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Cryptography and TLS stream integration\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Cryptography and TLS stream integration\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: openssl, ext/openssl\nConditional downstream consequence: A matching PHP binding, cryptography or TLS flaw could affect confidentiality, integrity or worker availability. The exact PHP build and upstream crypto implementation must be distinguished.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config0.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/openssl/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0070","name":"PHP PCNTL","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PCNTL: Process control for CLI and CGI jobs. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0070\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Process control for CLI and CGI jobs\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Process control for CLI and CGI jobs\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pcntl, ext/pcntl\nConditional downstream consequence: A matching OS/IPC binding flaw could affect job execution or local process isolation if reached. Intended process-control functions and IPC access are not vulnerabilities themselves.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcntl/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0071","name":"PHP PCRE","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PCRE: Regular expressions and PCRE2 integration. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0071\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Regular expressions and PCRE2 integration\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Regular expressions and PCRE2 integration\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pcre, ext/pcre\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config0.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pcre/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0072","name":"PHP PDO","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO: Database API and driver abstraction. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0072\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Database API and driver abstraction\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: spl\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Database API and driver abstraction\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo, ext/pdo\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0073","name":"PHP PDO_DBLIB","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO_DBLIB: FreeTDS/DB-Library database client for PDO. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0073\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: FreeTDS/DB-Library database client for PDO\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pdo\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: FreeTDS/DB-Library database client for PDO\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo_dblib, ext/pdo_dblib\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_dblib/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0074","name":"PHP PDO_FIREBIRD","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO_FIREBIRD: Firebird client for PDO. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0074\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Firebird client for PDO\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pdo\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Firebird client for PDO\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo_firebird, ext/pdo_firebird\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_firebird/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0075","name":"PHP PDO_MYSQL","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO_MYSQL: MySQL client for PDO. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0075\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: MySQL client for PDO\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pdo; conditional mysqlnd: Built with default/mysqlnd backend; external libmysqlclient is an alternative\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: MySQL client for PDO\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo_mysql, ext/pdo_mysql\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_mysql/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0076","name":"PHP PDO_ODBC","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO_ODBC: ODBC client for PDO. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0076\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: ODBC client for PDO\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pdo\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: ODBC client for PDO\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo_odbc, ext/pdo_odbc\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_odbc/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0077","name":"PHP PDO_PGSQL","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO_PGSQL: PostgreSQL client for PDO. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0077\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PostgreSQL client for PDO\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pdo\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: PostgreSQL client for PDO\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo_pgsql, ext/pdo_pgsql\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_pgsql/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0078","name":"PHP PDO_SQLITE","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PDO_SQLITE: SQLite-backed database operations for PDO. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0078\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: SQLite-backed database operations for PDO\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pdo\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: SQLite-backed database operations for PDO\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pdo_sqlite, ext/pdo_sqlite\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pdo_sqlite/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0079","name":"PHP PostgreSQL extension","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"PostgreSQL extension: PostgreSQL client API. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0079\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PostgreSQL client API\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pcre\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: PostgreSQL client API\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: pgsql, ext/pgsql\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/pgsql/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0080","name":"PHP Phar","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Phar: Executable and data archive handling. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0080\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Executable and data archive handling\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: hash, spl\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Executable and data archive handling\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: phar, ext/phar\nConditional downstream consequence: If a matching flaw is reached through an untrusted archive or compressed stream, file-processing workers could suffer DoS, disclosure or integrity impact; native code execution requires separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/phar/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0081","name":"PHP POSIX","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"POSIX: POSIX identity, process and resource APIs. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0081\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: POSIX identity, process and resource APIs\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: POSIX identity, process and resource APIs\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: posix, ext/posix\nConditional downstream consequence: A matching OS/IPC binding flaw could affect job execution or local process isolation if reached. Intended process-control functions and IPC access are not vulnerabilities themselves.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/posix/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0082","name":"PHP Random","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Random: Random-number generation APIs. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0082\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Random-number generation APIs\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Random-number generation APIs\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: random, ext/random\nConditional downstream consequence: A matching PHP binding, cryptography or TLS flaw could affect confidentiality, integrity or worker availability. The exact PHP build and upstream crypto implementation must be distinguished.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/random/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0083","name":"PHP Readline","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Readline: Interactive command-line input. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0083\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Interactive command-line input\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Interactive command-line input\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: readline, ext/readline\nConditional downstream consequence: A matching line-input/parser flaw would affect interactive PHP or associated developer tooling. This does not by itself create a remotely reachable web endpoint.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/readline/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0084","name":"PHP Reflection","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Reflection: Runtime type and symbol inspection. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0084\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Runtime type and symbol inspection\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Runtime type and symbol inspection\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: reflection, ext/reflection\nConditional downstream consequence: A matching engine, serialization, iterator or optimizer flaw could affect applications executing the relevant PHP operations; remote reachability depends on application data flow and worker privileges.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/reflection/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0085","name":"PHP Session","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Session: Session identifiers, serialization and storage handlers. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0085\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Session identifiers, serialization and storage handlers\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: date; optional: spl\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Session identifiers, serialization and storage handlers\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: session, ext/session\nConditional downstream consequence: A matching session-ID, deserialization or session-handler flaw could affect authentication state or session data if the application uses the affected path. Backend, configuration and request flow must match.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/session/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0086","name":"PHP Shmop","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Shmop: Shared-memory segment access. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0086\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Shared-memory segment access\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Shared-memory segment access\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: shmop, ext/shmop\nConditional downstream consequence: A matching OS/IPC binding flaw could affect job execution or local process isolation if reached. Intended process-control functions and IPC access are not vulnerabilities themselves.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/shmop/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0087","name":"PHP SimpleXML","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"SimpleXML: XML document access. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0087\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: XML document access\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: libxml, spl\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: XML document access\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: simplexml, ext/simplexml\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/simplexml/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0088","name":"PHP SNMP","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"SNMP: Network-management protocol client. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0088\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Network-management protocol client\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: spl\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Network-management protocol client\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: snmp, ext/snmp\nConditional downstream consequence: A matching response-parser, connection or TLS flaw could affect the PHP client process, its outbound credentials or availability. Client-library presence does not make the remote service backend PHP-based.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/snmp/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0089","name":"PHP SOAP","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"SOAP: SOAP client/server and XML message processing. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0089\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: SOAP client/server and XML message processing\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: date, hash, libxml; optional: session\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: SOAP client/server and XML message processing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: soap, ext/soap\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/soap/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0090","name":"PHP Sockets","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Sockets: Low-level socket API. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0090\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Low-level socket API\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Low-level socket API\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: sockets, ext/sockets\nConditional downstream consequence: A matching response-parser, connection or TLS flaw could affect the PHP client process, its outbound credentials or availability. Client-library presence does not make the remote service backend PHP-based.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sockets/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0091","name":"PHP Sodium","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Sodium: Libsodium cryptography APIs. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0091\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Libsodium cryptography APIs\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Libsodium cryptography APIs\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: sodium, ext/sodium\nConditional downstream consequence: A matching PHP binding, cryptography or TLS flaw could affect confidentiality, integrity or worker availability. The exact PHP build and upstream crypto implementation must be distinguished.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sodium/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0092","name":"PHP SPL","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"SPL: Standard PHP Library objects and iterators. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0092\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Standard PHP Library objects and iterators\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: json; optional: pcre, standard\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Standard PHP Library objects and iterators\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: spl, ext/spl\nConditional downstream consequence: A matching engine, serialization, iterator or optimizer flaw could affect applications executing the relevant PHP operations; remote reachability depends on application data flow and worker privileges.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/spl/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0093","name":"PHP SQLite3","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"SQLite3: SQLite database access. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0093\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: SQLite database access\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: SQLite database access\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: sqlite3, ext/sqlite3\nConditional downstream consequence: A matching database-client or local-database flaw could affect the PHP worker and its database credentials when crafted replies or database files reach the affected API. The database server does not thereby depend on PHP.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config0.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sqlite3/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0094","name":"PHP Standard functions","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Standard functions: Core strings, files, streams, URLs and serialization functions. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0094\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Core strings, files, streams, URLs and serialization functions\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Core strings, files, streams, URLs and serialization functions\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: standard, ext/standard\nConditional downstream consequence: A matching engine, serialization, iterator or optimizer flaw could affect applications executing the relevant PHP operations; remote reachability depends on application data flow and worker privileges.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/standard/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0095","name":"PHP Sysvmsg","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Sysvmsg: System V message queues. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0095\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: System V message queues\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: System V message queues\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: sysvmsg, ext/sysvmsg\nConditional downstream consequence: A matching OS/IPC binding flaw could affect job execution or local process isolation if reached. Intended process-control functions and IPC access are not vulnerabilities themselves.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvmsg/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0096","name":"PHP Sysvsem","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Sysvsem: System V semaphores. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0096\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: System V semaphores\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: System V semaphores\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: sysvsem, ext/sysvsem\nConditional downstream consequence: A matching OS/IPC binding flaw could affect job execution or local process isolation if reached. Intended process-control functions and IPC access are not vulnerabilities themselves.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvsem/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0097","name":"PHP Sysvshm","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Sysvshm: System V shared memory. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0097\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: System V shared memory\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: System V shared memory\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: sysvshm, ext/sysvshm\nConditional downstream consequence: A matching OS/IPC binding flaw could affect job execution or local process isolation if reached. Intended process-control functions and IPC access are not vulnerabilities themselves.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/sysvshm/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0098","name":"PHP Tidy","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Tidy: HTML repair and parsing bridge. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0098\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: HTML repair and parsing bridge\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: HTML repair and parsing bridge\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: tidy, ext/tidy\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tidy/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0099","name":"PHP Tokenizer","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Tokenizer: PHP source tokenization. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0099\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP source tokenization\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: PHP source tokenization\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: tokenizer, ext/tokenizer\nConditional downstream consequence: A matching engine, serialization, iterator or optimizer flaw could affect applications executing the relevant PHP operations; remote reachability depends on application data flow and worker privileges.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/tokenizer/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0100","name":"PHP URI","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"URI: RFC 3986 and WHATWG URL parsing. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0100\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: RFC 3986 and WHATWG URL parsing\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: lexbor\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Presence does not imply the affected operation is used. No affected build or reachable PHP flaw has been identified. New in PHP 8.5; do not project this component onto PHP 8.4 or older.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: RFC 3986 and WHATWG URL parsing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: uri, ext/uri\nConditional downstream consequence: A matching parser/conversion flaw could affect integrity, disclosure or availability if external text, locale, URL or regex input reaches the relevant API. Memory-corruption RCE would need separate proof.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/uri/config.w32","https://www.php.net/releases/8.5/en.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0101","name":"PHP XML parser","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"XML parser: Event-based XML parsing. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0101\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Event-based XML parsing\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest; conditional libxml: Default parser backend; --with-expat selects an alternative\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Event-based XML parsing\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: xml, ext/xml\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xml/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0102","name":"PHP XMLReader","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"XMLReader: Streaming XML reader. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0102\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Streaming XML reader\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: libxml; optional: dom\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Streaming XML reader\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: xmlreader, ext/xmlreader\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlreader/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0103","name":"PHP XMLWriter","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"XMLWriter: XML output generation. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0103\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: XML output generation\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: libxml\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: XML output generation\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: xmlwriter, ext/xmlwriter\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xmlwriter/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0104","name":"PHP XSL","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"XSL: XML stylesheet transformation. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0104\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: XML stylesheet transformation\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: libxml, dom\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: XML stylesheet transformation\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: xsl, ext/xsl\nConditional downstream consequence: A matching XML/HTML/message parser flaw could affect document-processing or SOAP endpoints. Input paths, parser options and native-library versions determine DoS, disclosure or integrity impact.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/xsl/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0105","name":"PHP zend_test","vendor":"The PHP Group","category":"Development and build","version":"Not specified","summary":"zend_test: Zend Engine test hooks and fixtures. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0105\nCategory: Development and build\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP test build; Zend Engine test hooks and fixtures\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Optional PHP source test fixture. Do not infer installed production code, a web listener or a current vulnerability.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Zend Engine test hooks and fixtures\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: zend_test, ext/zend_test\nConditional downstream consequence: Relevant to developer or CI binaries only when the test component was built and attacker-controlled test input reaches it. Source inclusion is not evidence of a production service.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zend_test/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0106","name":"PHP Zip","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Zip: Zip archive parsing and creation. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0106\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Zip archive parsing and creation\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Required PHP components: pcre\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Zip archive parsing and creation\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: zip, ext/zip\nConditional downstream consequence: If a matching flaw is reached through an untrusted archive or compressed stream, file-processing workers could suffer DoS, disclosure or integrity impact; native code execution requires separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zip/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0107","name":"PHP Zlib extension","vendor":"The PHP Group","category":"PHP bundled modules","version":"Not specified","summary":"Zlib extension: Compressed streams and filters. The released build manifest declares this PHP component.","scope":"Inventory record: PHP-0107\nCategory: PHP bundled modules\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Compressed streams and filters\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: No separate PHP-extension prerequisite declared in inspected Unix manifest\nLimitations: Part of the parent PHP runtime, not a separate application or installation. Bundled source does not prove the module is installed or enabled. No affected build or reachable PHP flaw has been identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Compressed streams and filters\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: zlib, ext/zlib\nConditional downstream consequence: If a matching flaw is reached through an untrusted archive or compressed stream, file-processing workers could suffer DoS, disclosure or integrity impact; native code execution requires separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config0.m4","https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/zlib/config.w32"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0108","name":"PHP Embed SAPI","vendor":"The PHP Group","category":"Embedded runtimes","version":"Not specified","summary":"The released embed build manifest creates a shared or static PHP library for use inside a host application.","scope":"Inventory record: PHP-0108\nCategory: Embedded runtimes\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: libphp shared or static library\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Build-specific core and extension set\nLimitations: Only host applications that actually link this library inherit it. Static hosts may require a rebuilt binary; replacing a system PHP executable may leave embedded copies unchanged.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: libphp shared or static library\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: embed, sapi/embed\nConditional downstream consequence: A matching reachable PHP flaw can affect the embedding host process and its credentials or privileges. No particular embedding product or tenant escape is established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/embed/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0109","name":"PHP LiteSpeed SAPI","vendor":"The PHP Group","category":"Runtime interfaces","version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","summary":"The released source contains an LSAPI SAPI, and the PHP manual identifies LiteSpeed integration as bundled PHP.","scope":"Inventory record: PHP-0109\nCategory: Runtime interfaces\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: LiteSpeed Server API (LSAPI)\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Build-specific core and extension set\nLimitations: A web server supporting LSAPI need not have PHP installed. This records the PHP-side SAPI, not a PHP implementation of the web-server control plane.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: LiteSpeed Server API (LSAPI)\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: litespeed, sapi/litespeed\nConditional downstream consequence: A matching PHP or LSAPI request-handling flaw could affect PHP workers reached through that interface. Server configuration and tenant isolation remain separate evidence requirements.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/litespeed/config.m4","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."}}},{"id":"PHP-0110","name":"PHP phpdbg","vendor":"The PHP Group","category":"Runtime interfaces","version":"Not specified","summary":"The released phpdbg manifest declares a debugger SAPI; the manual documents PHP debugging and optional remote-console controls.","scope":"Inventory record: PHP-0110\nCategory: Runtime interfaces\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Interactive debugger SAPI\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Build-specific core and extension set\nLimitations: Development/debugger presence does not imply a public service. Any console must be assessed separately; no exposed debugger is identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Interactive debugger SAPI\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: phpdbg, sapi/phpdbg\nConditional downstream consequence: A matching flaw in debugger execution or input handling could affect developer or CI processes when untrusted inputs reach them. Powerful intended debugger features are not themselves a PHP vulnerability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/phpdbg/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0111","name":"PHP Clang fuzzer SAPI","vendor":"The PHP Group","category":"Development and build","version":"Not specified","summary":"The released fuzzer manifest declares developer harnesses for PHP parser, execution, JIT, serialization and selected extensions.","scope":"Inventory record: PHP-0111\nCategory: Development and build\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Clang/libFuzzer test harness\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Build-specific core and extension set\nLimitations: A developer harness is not a normal production web SAPI. No fuzzing, compilation or test execution was performed.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Clang/libFuzzer test harness\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: fuzzer, sapi/fuzzer\nConditional downstream consequence: Only a built and used test harness inherits matching PHP flaws in its own process; no production exposure or exploitability is inferred.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/fuzzer/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0112","name":"PHP built-in development web server","vendor":"The PHP Group","category":"Runtime interfaces","version":"Not specified","summary":"The official manual documents the CLI SAPI built-in HTTP server and says it is for controlled development/testing use. The server implementation is present in the pinned CLI source.","scope":"Inventory record: PHP-0112\nCategory: Runtime interfaces\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0004\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: CLI SAPI HTTP server mode\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Shares the CLI binary extension configuration\nLimitations: This is a mode of the existing PHP CLI, not an additional standalone deployment. No listening or internet-exposed server is identified.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Development preview HTTP requests\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: cli-server, php -S\nConditional downstream consequence: A matching server/request parser flaw would matter only where this development server is actually running and reachable. It is not evidence of production exposure.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/sapi/cli/php_cli_server.c","https://www.php.net/manual/en/features.commandline.webserver.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0113","name":"PHP OPcache JIT","vendor":"The PHP Group","category":"PHP core","version":"Not specified","summary":"The pinned OPcache manifest has a separate JIT build switch and compiles JIT sources conditionally. The runtime manual exposes opcache.jit controls.","scope":"Inventory record: PHP-0113\nCategory: PHP core\nOriginal relationship: component\nRelationship direction: part_of_php\nParent component: PHP-0068\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Machine-code JIT path within OPcache\nPHP version scope: Source-confirmed in PHP 8.5.10; other branches need their own manifest comparison\nExtensions: Parent OPcache; JIT build support and runtime configuration must both permit it\nLimitations: OPcache being loaded in PHP 8.5 does not establish JIT execution. This child overlaps the OPcache row and does not add a unique application or installation.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: JIT-compiled PHP code in supported processes\nRelease pin: php-8.5.10, commit 34308a6666b2d489c509541ea9befea9e2b42348\nSource accessed: 2026-10-16\nAliases: Zend JIT, opcache-jit\nConditional downstream consequence: A JIT-specific flaw could affect workers only when its trigger is compiled/executed by the enabled JIT path. It must not be generalized to all PHP or all OPcache workloads.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://raw.githubusercontent.com/php/php-src/34308a6666b2d489c509541ea9befea9e2b42348/ext/opcache/config.m4","https://www.php.net/manual/en/opcache.configuration.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0114","name":"PHP IMAP extension","vendor":"The PHP Group","category":"PHP external extensions","version":"Not specified","summary":"Selected release notes build fixes for PHP 8.4; package minimum is 8.3.0.","scope":"Inventory record: PHP-0114\nCategory: PHP external extensions\nOriginal relationship: optional extension\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: IMAP/POP/NNTP mail client APIs\nPHP version scope: Bundled before PHP 8.4; separate PECL lifecycle from PHP 8.4 onward. Selected PECL 1.0.3 declares PHP >=8.3.0. Package minimum is distinct from the externalization date.\nExtensions: Additional ext-* requirements not exhaustively enumerated; UW IMAP c-client remains a separate native dependency.\nLimitations: Do not infer this extension from PHP 8.4+ presence or assume a core PHP update replaces it. No installed extension or reachable defect is measured. The manual additionally says this extension is not thread-safe and should not be used with ZTS builds. The selected release declaration is now read; archive/source bytes, actual ABI and deployed build are still unverified. PHP minimum and lifecycle/packaging transition must not be conflated.\nPatch owner: Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate\nDownstream surface: IMAP/POP/NNTP mail client APIs\nRelease pin: PECL selected release 1.0.3; versioned declaration, no independently verified archive/source digest\nSource accessed: 2026-10-18\nAliases: imap\nConditional downstream consequence: Only an installed matching extension and reachable affected API could propagate a relevant PHP/extension flaw to the calling application. Separately distributed packages require their own patch tracking.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate","links":["https://pecl.php.net/package/imap/1.0.3","https://www.php.net/manual/en/migration84.removed-extensions.php","https://www.php.net/manual/en/imap.installation.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0115","name":"PHP OCI8 extension","vendor":"The PHP Group","category":"PHP external extensions","version":"Not specified","summary":"Release states testing with PHP 8.2–8.5 and requires Oracle Client 11.2+.","scope":"Inventory record: PHP-0115\nCategory: PHP external extensions\nOriginal relationship: optional extension\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Oracle database client APIs\nPHP version scope: Bundled before PHP 8.4; separate PECL lifecycle from PHP 8.4 onward. Selected PECL 3.4.1 declares PHP >=8.2.0. Package minimum is distinct from the externalization date.\nExtensions: Oracle Client/Instant Client 11.2+ native libraries required for this selected release; not an ext-* package requirement.\nLimitations: Do not infer this extension from PHP 8.4+ presence or assume a core PHP update replaces it. No installed extension or reachable defect is measured. Oracle client libraries and their version compatibility are separate prerequisites. The selected release declaration is now read; archive/source bytes, actual ABI and deployed build are still unverified. PHP minimum and lifecycle/packaging transition must not be conflated.\nPatch owner: Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate\nDownstream surface: Oracle database client APIs\nRelease pin: PECL selected release 3.4.1; versioned declaration, no independently verified archive/source digest\nSource accessed: 2026-10-18\nAliases: oci8\nConditional downstream consequence: Only an installed matching extension and reachable affected API could propagate a relevant PHP/extension flaw to the calling application. Separately distributed packages require their own patch tracking.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate","links":["https://pecl.php.net/package/oci8/3.4.1","https://www.php.net/manual/en/migration84.removed-extensions.php","https://www.php.net/manual/en/oci8.installation.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0116","name":"PHP PDO_OCI extension","vendor":"The PHP Group","category":"PHP external extensions","version":"Not specified","summary":"The selected release uses PDO APIs and Oracle Client 11.2+ libraries.","scope":"Inventory record: PHP-0116\nCategory: PHP external extensions\nOriginal relationship: optional extension\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Oracle database client through PDO\nPHP version scope: Bundled before PHP 8.4; separate PECL lifecycle from PHP 8.4 onward. Selected PECL 1.2.0 declares PHP >=8.3.0. Package minimum is distinct from the externalization date.\nExtensions: PDO PHP interface retained; Oracle Client/Instant Client 11.2+ is a separate native dependency.\nLimitations: Do not infer this extension from PHP 8.4+ presence or assume a core PHP update replaces it. No installed extension or reachable defect is measured. The PECL catalogue documents Oracle client libraries and PDO prerequisites; no Oracle server PHP dependency is inferred. The selected release declaration is now read; archive/source bytes, actual ABI and deployed build are still unverified. PHP minimum and lifecycle/packaging transition must not be conflated.\nPatch owner: Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate\nDownstream surface: Oracle database client through PDO\nRelease pin: PECL selected release 1.2.0; versioned declaration, no independently verified archive/source digest\nSource accessed: 2026-10-18\nAliases: pdo_oci\nConditional downstream consequence: Only an installed matching extension and reachable affected API could propagate a relevant PHP/extension flaw to the calling application. Separately distributed packages require their own patch tracking.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate","links":["https://pecl.php.net/package/PDO_OCI/1.2.0","https://www.php.net/manual/en/migration84.removed-extensions.php","https://pecl.php.net/package/PDO_OCI"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0117","name":"PHP Pspell extension","vendor":"The PHP Group","category":"PHP external extensions","version":"Not specified","summary":"Selected PECL release minimum is separate from the PHP 8.4 packaging transition.","scope":"Inventory record: PHP-0117\nCategory: PHP external extensions\nOriginal relationship: optional extension\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Aspell/Pspell spell-checking bridge\nPHP version scope: Bundled before PHP 8.4; separate PECL lifecycle from PHP 8.4 onward. Selected PECL 1.0.1 declares PHP >=8.1.0. Package minimum is distinct from the externalization date.\nExtensions: Aspell native dependency retained from earlier manual evidence; full selected ext-* prerequisites unknown.\nLimitations: Do not infer this extension from PHP 8.4+ presence or assume a core PHP update replaces it. No installed extension or reachable defect is measured. Aspell libraries are upstream dependencies used by the extension. The selected release declaration is now read; archive/source bytes, actual ABI and deployed build are still unverified. PHP minimum and lifecycle/packaging transition must not be conflated.\nPatch owner: Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate\nDownstream surface: Aspell/Pspell spell-checking bridge\nRelease pin: PECL selected release 1.0.1; versioned declaration, no independently verified archive/source digest\nSource accessed: 2026-10-18\nAliases: pspell\nConditional downstream consequence: Only an installed matching extension and reachable affected API could propagate a relevant PHP/extension flaw to the calling application. Separately distributed packages require their own patch tracking.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension package maintainer, binary/image/distribution publisher, and operator; PHP engine patches remain separate","links":["https://pecl.php.net/package/pspell/1.0.1","https://www.php.net/manual/en/migration84.removed-extensions.php","https://www.php.net/manual/en/pspell.installation.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0118","name":"Craft CMS","vendor":"Craft CMS / Pixel & Tonic","category":"CMS and publishing","version":"Not specified","summary":"Craft identifies itself as a PHP application and gives PHP 8.2+ and extension requirements for its 5.x line.","scope":"Inventory record: PHP-0118\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Craft 5.x documentation: PHP 8.2+; GD requirement is marked 5.9.0+\nExtensions: Required: bcmath, ctype, curl, iconv, intl, json, mbstring, openssl, pcre, pdo, reflection, spl, zip, dom. optional/recommended: imagick, pcntl. Conditional: gd; pdo_mysql or pdo_pgsql\nLimitations: ImageMagick is preferred when available; this does not remove the documented 5.9+ GD requirement. Exact plugin/minor-version constraints still require release manifests. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Craft, craftcms/cms\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://craftcms.com/docs/5.x/requirements.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0119","name":"October CMS","vendor":"October CMS project","category":"CMS and publishing","version":"Not specified","summary":"The 4.x guide explicitly calls October a PHP web application and requires PHP 8.2 with named modules.","scope":"Inventory record: PHP-0119\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 4.x installation documentation: PHP 8.2.0+\nExtensions: Required: pdo, curl, openssl, mbstring, zip, gd, simplexml. Conditional: pdo_mysql, pdo_pgsql, pdo_sqlite\nLimitations: Current 4.x requirements are not historical October 1.x requirements. Browser and JavaScript assets do not replace the PHP application server. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: October, october/october\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.octobercms.com/4.x/setup/installation.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0120","name":"Grav CMS","vendor":"Grav project","category":"CMS and publishing","version":"Not specified","summary":"The current 2.x guide requires PHP 8.3.11+ and describes flat-file storage without a database.","scope":"Inventory record: PHP-0120\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 2.x stable docs: PHP 8.3.11+; legacy 1.7 docs: PHP 7.3.6+\nExtensions: Required: curl, ctype, dom, gd, json, libxml, mbstring, openssl, session, simplexml, zip. optional/recommended: fileinfo, intl, exif, apcu, opcache, yaml, xdebug\nLimitations: The extension list in this row is from 2.x. Flat-file storage still requires PHP for the application, admin and applicable processing tasks; it is not evidence of a PHP-free static host. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Grav, getgrav/grav\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://learn.getgrav.org/2/basics/requirements","https://learn.getgrav.org/17/basics/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0121","name":"ProcessWire CMS","vendor":"ProcessWire project","category":"CMS and publishing","version":"Not specified","summary":"Official requirements list PHP 8.x as recommended, PHP 7.x compatibility, and image-processing support.","scope":"Inventory record: PHP-0121\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Official requirements recommend PHP 8.x and say PHP 7.x is supported; exact release minimum not pinned\nExtensions: Exact required extension set not enumerated. optional/recommended: mbstring. Conditional: gd or imagick. List is partial or inherited; see scope limits\nLimitations: Do not translate a recommendation into a measured deployment or an exact minimum. Current PHP database-driver requirements and newer database-backend support need a released manifest. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: ProcessWire, processwire/processwire\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://processwire.com/about/requirements/","https://processwire.com/docs/front-end/include/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0122","name":"Concrete CMS","vendor":"Concrete CMS / PortlandLabs","category":"CMS and publishing","version":"Not specified","summary":"Concrete states that it is primarily written in PHP and gives a per-release PHP compatibility table.","scope":"Inventory record: PHP-0122\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 9.0 documentation: PHP 7.3+; PHP 8.4 support listed for 9.4+, PHP 8.5 for 9.5+; legacy 8.x has a different matrix\nExtensions: Required: pdo, pdo_mysql, dom, simplexml, iconv, gd, fileinfo, mbstring, curl. Conditional: zip; FreeType in GD\nLimitations: A minimum for Concrete 9.0 is not a guarantee for every later 9.x release. Concrete 8 and 9 overlap as product lineage, not additional installations. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Concrete, concrete5\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://documentation.concretecms.org/9-x/developers/introduction/system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0123","name":"Contao CMS","vendor":"Contao project","category":"CMS and publishing","version":"Not specified","summary":"The 5.x manual lists PHP requirements by Contao minor version and separates required and image-related extensions.","scope":"Inventory record: PHP-0123\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 5.0+: PHP 8.1+; 5.5+: PHP 8.2+; 5.7+: PHP 8.3+; docs recommend PHP 8.4+\nExtensions: Required: dom, pcre, intl, pdo, zlib, json, curl, mbstring, gd, fileinfo. optional/recommended: imagick, gmagick. Conditional: sodium\nLimitations: The optional Contao Manager is a separate operations tool. The CMS does not require that management interface to remain deployed. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Contao, contao/managed-edition\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.contao.org/5.x/manual/en/installation/system-requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0124","name":"Silverstripe CMS","vendor":"Silverstripe CMS project","category":"CMS and publishing","version":"Not specified","summary":"The 6.x manual requires a PHP web server, PHP 8.3–8.5 and specific extensions.","scope":"Inventory record: PHP-0124\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Current 6.x server-requirements documentation: PHP 8.3–8.5; minor-version support still matters\nExtensions: Required: ctype, dom, fileinfo, hash, intl, mbstring, session, simplexml, tokenizer, xml. Conditional: gd or imagick; Database connector\nLimitations: The content-author browser GUI is a client of the PHP service. Database integrations and minor releases can change the resolved module set. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: SilverStripe, silverstripe/cms\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.silverstripe.org/en/6/getting_started/server_requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0125","name":"Kirby CMS","vendor":"Kirby CMS project","category":"CMS and publishing","version":"Not specified","summary":"Kirby provides version-specific PHP support and required, recommended and optional extension lists.","scope":"Inventory record: PHP-0125\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Kirby ^5.2.1 table: PHP 8.2–8.5; ^5.0.0 table lists PHP 8.2–8.4\nExtensions: Required: ctype, curl, dom, filter, hash, iconv, json, libxml, mbstring, openssl, simplexml. optional/recommended: exif, fileinfo, intl, apcu, memcached, pdo, zip, zlib. Conditional: gd or native ImageMagick convert executable\nLimitations: The documented ImageMagick alternative is an external convert executable, not proof that ext-imagick is installed. Database access is optional; a database-free CMS can still execute PHP. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Kirby, getkirby/cms\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://getkirby.com/docs/reference/system/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0126","name":"Statamic CMS","vendor":"Statamic project","category":"CMS and publishing","version":"Not specified","summary":"Statamic describes itself as a PHP application installed as a Laravel package and lists PHP 8.3+ requirements.","scope":"Inventory record: PHP-0126\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Statamic 6 documentation: PHP 8.3+\nExtensions: Required: bcmath, ctype, exif, json, mbstring, openssl, pdo, tokenizer, xml. Conditional: GD or ImageMagick\nLimitations: The ordinary application server uses PHP. Its optional static exporter is recorded separately; published static output alone does not prove request-time PHP execution. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Statamic, statamic/cms\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://statamic.dev/getting-started/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0127","name":"Ibexa DXP","vendor":"Ibexa","category":"CMS and publishing","version":"Not specified","summary":"The versioned requirements page lists PHP 8.3/8.4 for DXP 5.0, PHP CLI/FPM packages and runtime extensions.","scope":"Inventory record: PHP-0127\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Documented PHP-FPM web service and PHP CLI\nPHP version scope: 5.0 requirements tab: PHP 8.3 or 8.4; the same page also contains different 4.6 requirements\nExtensions: Required: xml, mbstring, intl, curl, sodium, bcmath. optional/recommended: redis. Conditional: gd or imagick; Database driver; redis\nLimitations: The 5.0 and 4.6 tabs must not be merged into one PHP support range. Node.js/yarn build tooling and browser assets are separate from the PHP service. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Ibexa Digital Experience Platform, Ibexa DXP 5.0\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://doc.ibexa.co/en/5.0/getting_started/requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0128","name":"MODX Revolution","vendor":"MODX project","category":"CMS and publishing","version":"Not specified","summary":"The guide says MODX is written in PHP and lists the 3.2+ PHP 8.1 floor and required modules.","scope":"Inventory record: PHP-0128\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Current 3.x (3.2+) requirements: PHP 8.1+; the guide distinguishes older 3.0 requirements\nExtensions: Required: curl, dom, fileinfo, gd, json, pdo, simplexml, xml, xmlwriter, zip, zlib. optional/recommended: mbstring, iconv, imagick, intl. Conditional: pdo_mysql\nLimitations: A retained older 3.x installer check is not a substitute for the current release manifest. Extras can add extension requirements beyond the core list. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: MODX, modxcms/revolution\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.modx.com/3.x/en/getting-started/server-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0129","name":"Bolt CMS","vendor":"Bolt CMS project","category":"CMS and publishing","version":"Not specified","summary":"Bolt 5.2 documentation explicitly requires PHP and lists core and optional PHP modules.","scope":"Inventory record: PHP-0129\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Versioned 5.2 documentation lists PHP 7.2.9+; actual tagged Composer constraint not independently verified\nExtensions: Required: pdo, openssl, curl, gd, dom, json, posix, xml, simplexml, tokenizer, fileinfo, exif, zip. optional/recommended: intl, mbstring, opcache. Conditional: mysqlnd\nLimitations: The page includes legacy compatibility guidance. The relationship is confirmed, but its lower PHP bound must be checked against an actual released composer.lock before matching a vulnerability. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Bolt, bolt/core\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.boltcms.io/5.2/getting-started/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0130","name":"Neos CMS","vendor":"Neos project","category":"CMS and publishing","version":"Not specified","summary":"Neos publishes a Neos/Flow/PHP matrix and requires matching web and CLI PHP versions for class precompilation.","scope":"Inventory record: PHP-0130\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and corresponding CLI\nPHP version scope: 9.0–9.1 matrix: PHP 8.2–8.5; the page gives separate older-branch and 9.2 requirements\nExtensions: Required: mbstring, tokenizer, xml, pdo_mysql. optional/recommended: vips, imagick, gmagick. Conditional: gd\nLimitations: Do not use an older Neos/Flow row for a newer branch. CLI build/cache processes also inherit PHP; native image executables/libraries are upstream dependencies, not PHP-dependent products. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Neos, neos/neos\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.neos.io/guide/installation-development-setup/system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0131","name":"Sulu CMS","vendor":"Sulu project","category":"CMS and publishing","version":"Not specified","summary":"The Sulu 3.x requirements explicitly require PHP 8.2+ and DOM/XML extensions.","scope":"Inventory record: PHP-0131\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 3.x versioned requirements: PHP 8.2+\nExtensions: Required: dom, xml. Conditional: gd or imagick or vips. List is partial or inherited; see scope limits\nLimitations: The named extensions are the list inspected on the requirements page, not a full resolved dependency tree for every installed bundle or database connector. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Sulu, sulu/sulu\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.sulu.io/3.x/reference/requirements.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0132","name":"Pimcore Platform","vendor":"Pimcore project","category":"CMS and publishing","version":"Not specified","summary":"Versioned platform requirements list PHP 8.5+ for 2026.2; the 2025.1 page specifies PHP 8.3/8.4.","scope":"Inventory record: PHP-0132\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 2026.2 docs: PHP 8.5+; 2025.1 docs: PHP 8.3 or 8.4\nExtensions: Required: pdo_mysql, gd, fileinfo, mbstring, zlib, zip, intl, curl. optional/recommended: imagick, mysqli. List is partial or inherited; see scope limits\nLimitations: The array is a documented subset of the platform module list. Optional bundles, images and executables need their own version checks; a permissive optional-bundle PHP constraint cannot replace the core platform requirement. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Pimcore, Pimcore Core\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.pimcore.com/platform/2026.2/Getting_Started/Installation/System_Requirements/","https://docs.pimcore.com/platform/2025.1/Pimcore/Installation_and_Upgrade/System_Requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0133","name":"ExpressionEngine","vendor":"ExpressionEngine project","category":"CMS and publishing","version":"Not specified","summary":"The official 7.x requirements identify a PHP/MySQL CMS, required PHP modules and optional PHP-FPM integration.","scope":"Inventory record: PHP-0133\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 7.x requirements text confirms PHP 8.3 and mentions a PHP 7.2.5+ fallback; full per-release compatibility matrix not reliably extracted\nExtensions: Required: gd, fileinfo, iconv. optional/recommended: intl. Conditional: PHP-FPM. List is partial or inherited; see scope limits\nLimitations: The support matrix uses visual/image indicators that were not reliably available as text. Do not infer all PHP 8.4/8.5 compatibility from the column labels or treat historical recommendations as current deployment evidence. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: EE, ExpressionEngine 7\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.expressionengine.com/latest/installation/requirements.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0134","name":"Textpattern CMS","vendor":"Textpattern project","category":"CMS and publishing","version":"Not specified","summary":"Textpattern lists PHP, MySQL and required/optional PHP modules for its 4.9 line.","scope":"Inventory record: PHP-0134\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 4.9 requirements: PHP 5.6.0+; PHP 8.4/8.5 recommended\nExtensions: Required: mysqli, xml, simplexml, json. optional/recommended: exif, intl, mbstring, zip, zlib\nLimitations: A low compatibility floor does not mean a deployment uses old PHP, or that upstream PHP support exists for that old branch. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Textpattern, textpattern/textpattern\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://textpattern.com/about/system-requirements","https://textpattern.com/weblog/textpattern-490-released-php-85-mysql-84-features-fixes-fine-tuning-and-much-more"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0135","name":"Serendipity Blog System","vendor":"Serendipity project","category":"CMS and publishing","version":"Not specified","summary":"The project calls Serendipity a PHP web application and specifies PHP 7.3+, cookie/session support and extensions.","scope":"Inventory record: PHP-0135\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Official installation guide: PHP 7.3+; PHP 8.x compatibility is stated without a full patch-level matrix\nExtensions: Required: session, pcre, xml. optional/recommended: gd, iconv, zlib, mbstring, opcache. Conditional: mysqli or pgsql or SQLite driver\nLimitations: Parts of this guide refer to removed historical PHP settings. Those passages were not used to infer modern runtime defaults or a security configuration. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Serendipity, s9y\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.s9y.org/docs/users/getting-started/fresh-installation.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0136","name":"SPIP","vendor":"SPIP project","category":"CMS and publishing","version":"Not specified","summary":"The official configuration table gives PHP compatibility and extension requirements separately for SPIP 4.4, 4.3 and 4.2.","scope":"Inventory record: PHP-0136\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 4.4 table: PHP 7.4–8.5; 4.3: 7.4–8.4; 4.2: 7.4–8.3\nExtensions: Required: curl, xml, gd, sodium, zip, zlib, phar. Conditional: mysqli or pdo plus pdo_sqlite\nLimitations: These are product-branch compatibility ranges. Plugin requirements and actual packaged PHP builds remain separate. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: SPIP publishing system\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://www.spip.net/en_article6659.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0137","name":"PluXml 5.8 documented branch","vendor":"PluXml project","category":"CMS and publishing","version":"Not specified","summary":"The PluXml 5.8 installation guide requires a PHP interpreter and GD for images.","scope":"Inventory record: PHP-0137\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Versioned 5.8 guide: PHP 5.6+ and PHP 7.4 recommended; current release/compatibility not independently verified\nExtensions: Required: gd. List is partial or inherited; see scope limits\nLimitations: This row is explicitly scoped to 5.8 documentation. The old recommendation is not current security advice and does not establish a deployed PHP version; current-release verification remains open. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: PluXml\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://wiki.pluxml.org/docs/install/install.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0138","name":"ClassicPress","vendor":"ClassicPress project","category":"CMS and publishing","version":"Not specified","summary":"The official 2.x requirements specify PHP; the migration guide describes replacement of WordPress core files.","scope":"Inventory record: PHP-0138\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0006\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 2.x official requirements: PHP 7.4 minimum; PHP 8.3/8.4 recommended\nExtensions: Exact required extension set not enumerated. List is partial or inherited; see scope limits\nLimitations: Shared plugin/theme history does not establish universal compatibility. WordPress and ClassicPress relationship counts must not be added as distinct deployments of one migrated site. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: ClassicPress 2\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://www.classicpress.net/requirements/","https://docs.classicpress.net/user-guides/installing-classicpress/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0139","name":"Backdrop CMS","vendor":"Backdrop CMS project","category":"CMS and publishing","version":"Not specified","summary":"Backdrop requires PHP and documents a Drupal 7 upgrade path; OpenSSL is recommended and required by Update Manager.","scope":"Inventory record: PHP-0139\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Requirements state PHP 7.1+ as of Backdrop 1.31.0; a supported PHP version is recommended\nExtensions: Exact required extension set not enumerated. optional/recommended: openssl. Conditional: openssl. List is partial or inherited; see scope limits\nLimitations: Other contributed-module and release-specific extension requirements are not exhaustively resolved. Legacy ancestry is not proof that current Drupal and Backdrop share the same vulnerability conditions. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Backdrop\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.backdropcms.org/documentation/system-requirements","https://backdropcms.org/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0140","name":"Winter CMS","vendor":"Winter CMS project","category":"CMS and publishing","version":"Not specified","summary":"The 1.2 installation guide requires PHP and named extensions. The project describes its Laravel foundation and historical October fork.","scope":"Inventory record: PHP-0140\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0119\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: 1.2 versioned docs: PHP 8.1+; PHP 8.2+ recommended\nExtensions: Required: curl, gd, mbstring, openssl, pdo, simplexml, zip. optional/recommended: pdo_sqlite\nLimitations: The fork has its own release and patch lifecycle. Do not treat current October requirements or vulnerabilities as automatically applicable to Winter. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Winter, wintercms/winter\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://wintercms.com/docs/v1.2/docs/setup/installation","https://wintercms.com/en/","https://wintercms.com/blog/post/we-have-forked-october-cms"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0141","name":"Thunder Drupal distribution","vendor":"Thunder project","category":"CMS and publishing","version":"Not specified","summary":"The official FAQ defines Thunder as a Drupal distribution for professional publishers, inheriting the PHP application runtime.","scope":"Inventory record: PHP-0141\nCategory: CMS and publishing\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Official distribution relationship confirmed; exact Thunder/Drupal/PHP release tuple not pinned\nExtensions: Exact required extension set not enumerated. List is partial or inherited; see scope limits\nLimitations: The distribution and its Drupal parent overlap in one installation. Resolve the actual Drupal core, selected modules and PHP image before assessing a flaw. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Thunder CMS, drupal/thunder\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://www.thunder.org/frequently-asked-questions"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0142","name":"Varbase Drupal distribution","vendor":"Vardot / Varbase project","category":"CMS and publishing","version":"Not specified","summary":"The guide uses PHP/Composer in DDEV and describes automatic Drupal installation and recipe application.","scope":"Inventory record: PHP-0142\nCategory: CMS and publishing\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Current installation guide shows a Drupal 11 DDEV project with PHP 8.4; minimum and release tuple remain unpinned\nExtensions: Exact required extension set not enumerated. List is partial or inherited; see scope limits\nLimitations: PHP 8.4 is an example configuration in the inspected guide, not a measured deployment or proven minimum. The linked detailed requirements page was unavailable. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Varbase, Vardot/varbase-project\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.varbase.vardot.com/developers/installing-varbase"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0143","name":"Open Social Drupal installation profile","vendor":"Open Social project","category":"CMS and publishing","version":"Not specified","summary":"The official repository manifest identifies a drupal-profile and explicitly declares PHP ^8.3 and Drupal core dependencies.","scope":"Inventory record: PHP-0143\nCategory: CMS and publishing\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; SAPI depends on deployment\nPHP version scope: Moving main-branch composer.json requires PHP ^8.3 and Drupal core ^10.5.6; release pin pending\nExtensions: Exact required extension set not enumerated. List is partial or inherited; see scope limits\nLimitations: This evidence describes the public install profile branch. It does not prove the current runtime or internals of any proprietary Open Social SaaS service. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Content, admin/API requests and enabled media/document processing\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: Open Social community distribution, goalgorilla/open_social\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer DoS or disclosure. Proven code execution could affect CMS content and its database/API credentials within that account. Root privileges, tenant escape and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://github.com/goalgorilla/open_social/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0144","name":"Contao Manager","vendor":"Contao project","category":"Development and build","version":"Not specified","summary":"Contao Manager is an optional PHP PHAR web interface that invokes PHP/Composer background processes to manage a Contao installation.","scope":"Inventory record: PHP-0144\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0123\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web PHAR plus CLI background processes\nPHP version scope: Current Manager documentation: PHP 8.1+; older PHP can bootstrap an older compatible Manager version\nExtensions: Required: intl, openssl\nLimitations: The CMS can run without the Manager. The documented proc_open/proc_close and allow_url_fopen requirements concern administration capabilities, not proof of a current vulnerability. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Optional package-management interface and PHP background jobs\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: contao-manager.phar.php, contao/contao-manager\nConditional downstream consequence: A matching reachable PHP flaw in a deployed Manager process could affect its package-management and filesystem permissions. The tool is optional; a Contao site does not prove this management endpoint is present or exposed.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://docs.contao.org/5.x/manual/en/installation/contao-manager/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0145","name":"Statamic static-site generator","vendor":"Statamic project","category":"Development and build","version":"Not specified","summary":"The official guide installs statamic/ssg, invokes PHP/Artisan during the build and publishes storage/app/static.","scope":"Inventory record: PHP-0145\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0126\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI in the build/authoring environment\nPHP version scope: Inherits the PHP/Statamic constraints of the selected project; exact SSG release not pinned\nExtensions: Exact required extension set not enumerated. List is partial or inherited; see scope limits\nLimitations: The generated static output does not establish a request-time PHP runtime on the published site. The authoring/control-panel environment and build process still require their own assessment. PHP presence does not establish a vulnerable build or a reachable affected path.\nPatch owner: PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code\nDownstream surface: Authoring/CI environment and generated public content\nRelease pin: Version-scoped official documentation; immutable source/artifact pin pending\nSource accessed: 2026-10-16\nAliases: statamic/ssg, Statamic SSG\nConditional downstream consequence: A matching PHP flaw reached during generation could affect build credentials or generated-content integrity. Serving the exported static files alone does not expose a PHP request handler.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP binary/image/distribution publisher and operator for runtime fixes; application maintainer/operator for application code","links":["https://statamic.dev/getting-started/deploying/netlify"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0146","name":"PrestaShop","vendor":"PrestaShop project","category":"Commerce","version":"Not specified","summary":"The version-9 requirements identify PHP, required modules and separate compatibility bands for 9.0 and 9.1.","scope":"Inventory record: PHP-0146\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: 9.0 documentation: PHP 8.1–8.4; 9.1 documentation: 8.1–8.5. Release state of each matrix column is not independently established.\nExtensions: Required (documented scope): curl, dom, fileinfo, gd, iconv, intl, json, mbstring, openssl, pdo, pdo_mysql, simplexml, zip\nLimitations: The page recommendation is PHP 8.5, but its 9.0 matrix explicitly excludes 8.5. The legacy php_mysql.dll example is not treated as a modern extension requirement. Node.js is an asset-build dependency, not a replacement PHP runtime. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: prestashop/prestashop\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://devdocs.prestashop-project.org/9/basics/installation/system-requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0147","name":"Shopware 6","vendor":"shopware AG","category":"Commerce","version":"Not specified","summary":"The official 6.7 update guide requires PHP 8.2/8.3/8.4 and separately describes the Vue/Vite administration frontend.","scope":"Inventory record: PHP-0147\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: 6.7 update guide: PHP 8.2, 8.3 and 8.4. The inspected v6.6 requirements remain a separate older documentation scope.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: Exact 6.7 release manifests, extension set, commercial extensions and SaaS deployments remain unpinned. CLI and FPM configurations may differ. Older v6.6 extension requirements are not silently applied to 6.7. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Store API, storefront backend, administration API and applicable queues\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: shopware/core, Shopware Community Edition 6\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.shopware.com/en/shopware-6-en/update-guides/update-guide-shopware-67","https://developer.shopware.com/docs/v6.6/guides/installation/requirements.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0148","name":"Shopware 5","vendor":"Shopware 5 project / shopware AG lineage","category":"Commerce","version":"Not specified","summary":"The v5.7.20 package declares PHP and its extension requirements. The project README says active maintenance is no longer guaranteed.","scope":"Inventory record: PHP-0148\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Publisher package metadata v5.7.20, dated 5 June 2025: ~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0.\nExtensions: Required (documented scope): ctype, curl, date, dom, filter, gd, hash, iconv, intl, json, mbstring, openssl, pdo, pdo_mysql, session, simplexml, xml, zip, zlib\nLimitations: This legacy line is separate from Shopware 6. The named Safefive continuation is an unverified follow-up lead, not an assumed installed backport. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: v5.7.20; registry-advertised source reference d126ee7e557be60567a00853e33c7dd291e5336a\nSource accessed: 2026-10-17\nAliases: shopware/shopware, Shopware 5.7\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://packagist.org/packages/shopware/shopware"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0149","name":"OpenCart","vendor":"OpenCart project","category":"Commerce","version":"Not specified","summary":"Publisher package metadata for 4.1.0.4 explicitly requires PHP >=8.1.0. The official repository describes the PHP server and runtime modules.","scope":"Inventory record: PHP-0149\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Released registry sample 4.1.0.4: PHP >=8.1.0. Moving master requirements say 8.0+; that lower floor is not applied to 4.1.0.4.\nExtensions: Required (documented scope): curl, gd, iconv, mbstring, openssl, zip, zlib. Conditional/alternatives: MySQLi or the selected PDO/PostgreSQL database driver; exact release choice unresolved. Partial or inherited list; see version/extension limitations\nLimitations: Module list is from moving documentation rather than the released manifest. That document also contains obsolete PHP directives; these are recorded as a documentation-quality gap, not recommended configuration. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: 4.1.0.4; registry-advertised source reference 3b0597ec91cae3de040a63fee3834a6d910372ea\nSource accessed: 2026-10-17\nAliases: opencart/opencart\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://packagist.org/packages/opencart/opencart","https://github.com/opencart/opencart/blob/master/docs/getting-started/system-requirements.md"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0150","name":"Sylius","vendor":"Sylius project","category":"Commerce","version":"Not specified","summary":"The official prerequisites require PHP 8.2+ and five named extensions for the Symfony-based commerce application.","scope":"Inventory record: PHP-0150\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Inspected moving getting-started requirements: PHP >=8.2; exact application release and Plus-edition additions not pinned.\nExtensions: Required (documented scope): gd, exif, fileinfo, intl, sodium. Partial or inherited list; see version/extension limitations\nLimitations: This introductory extension list is not a complete Composer-resolved dependency inventory. JavaScript tooling and optional frontend clients do not replace the PHP backend. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: sylius/sylius\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.sylius.com/public/getting-started/before-you-begin"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0151","name":"Bagisto","vendor":"Webkul","category":"Commerce","version":"Not specified","summary":"The guide separates manifest, web-installer and transitive extension requirements, and distinguishes Bagisto 2.4 from 2.5.","scope":"Inventory record: PHP-0151\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: 2.4 documentation: PHP 8.3 or 8.4 / Laravel 12. 2.5 documentation and prerelease examples: PHP ^8.4 / Laravel 13.\nExtensions: Required (documented scope): calendar, curl, intl, mbstring, openssl, pdo, pdo_mysql, tokenizer, ctype, dom, fileinfo, filter, gd, hash, json, pcre, session, xml, bcmath, iconv, libxml, simplexml, xmlreader, xmlwriter, zip, zlib. Conditional/alternatives: pdo_pgsql for PostgreSQL on the 2.5 line; imagick when IMAGE_DRIVER=imagick; redis when REDIS_CLIENT=phpredis; Predis is the documented library alternative\nLimitations: The flat extension list here is from the 2.5 documentation; it is not an exact 2.4 extension manifest. The current installation guide still calls latest a stable 2.4 image and gives 2.5.0-beta6 as a prerelease example. Do not treat moving 2.5 guidance as proof of the deployed stable release or image contents. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Storefront/admin/API backend, indexers and applicable jobs\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: bagisto/bagisto\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://devdocs.bagisto.com/getting-started/before-you-start.html","https://devdocs.bagisto.com/getting-started/installation"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0152","name":"Zen Cart","vendor":"Zen Cart project","category":"Commerce","version":"Not specified","summary":"Official requirements distinguish core release compatibility, the 1.5.8 installer exception and extension introduction dates.","scope":"Inventory record: PHP-0152\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: 2.2.x core: PHP 8.2–8.5. 2.1/2.0: 8.0–8.3. Legacy 1.5.8: 7.3–8.3, but installer requires <=8.2.\nExtensions: Required (documented scope): bcmath, ctype, curl, openssl, fileinfo, gd, iconv, intl, json, mbstring, mysqli, pdo_mysql, pcre, zip, zlib. Optional/recommended: pcntl, pdo_sqlite\nLimitations: Required list here is scoped to 2.2.x: intl became required in 2.0 and mbstring in 2.2. The 3.0 line is explicitly in development. Plugins may narrow compatibility. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: zencart/zencart\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.zen-cart.com/user/first_steps/server_requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0153","name":"osCommerce 4","vendor":"osCommerce","category":"Commerce","version":"Not specified","summary":"The vendor explicitly states that its V4 commerce platform uses PHP 8.3 and also supports older PHP from 7.4.","scope":"Inventory record: PHP-0153\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Current vendor product page: PHP 8.3 with support claimed from 7.4; exact 4.x patch release not pinned.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: A marketing compatibility statement is not a resolved manifest or an observation of hosted customer builds. Required extensions and exact deployment model remain unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: osCommerce V4\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://www.oscommerce.com/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0154","name":"osCommerce Online Merchant 2.3","vendor":"osCommerce legacy project","category":"Commerce","version":"Not specified","summary":"The archived v2.3 manual requires a PHP-enabled web server and describes compatibility with PHP 4/5.","scope":"Inventory record: PHP-0154\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Archived v2.3 requirements: compatible with PHP 4 and PHP 5; historical documentation only.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: This is evidence for a historical branch, not current maintenance, modern compatibility or a measured surviving installation. Do not transfer the V4 PHP range to this lineage. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: Legacy operator/maintainer or migration owner; current vendor support not established\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: osCommerce 2.3, osCommerce Online Merchant v2.3\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy operator/maintainer or migration owner; current vendor support not established","links":["https://library.oscommerce.com/Online&en&oscom_2_3&getting_started&requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0155","name":"OXID eShop","vendor":"OXID eSales","category":"Commerce","version":"Not specified","summary":"The 7.3 vendor requirements name PHP 8.2–8.4 and required modules for the documented eShop editions.","scope":"Inventory record: PHP-0155\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Versioned 7.3 requirements: PHP 8.2–8.4. Newer 7.5 navigation exists but its detailed requirements were not retrieved.\nExtensions: Required (documented scope): gd, pdo_mysql, bcmath, json, iconv, tokenizer, mbstring, curl, soap, dom\nLimitations: Edition names share this family record; installations are not additive. Composer is required for installation/autoload changes, not as a request-time service. Web, CLI and a spawned default PHP executable can differ. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: OXID eShop Community Edition, OXID eShop Professional Edition, OXID eShop Enterprise Edition\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.oxid-esales.com/eshop/de/7.3/installation/neu-installation/server-und-systemvoraussetzungen.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0156","name":"CS-Cart and Multi-Vendor","vendor":"CS-Cart","category":"Commerce","version":"Not specified","summary":"The common vendor requirements explicitly identify PHP mod_php, FPM and FastCGI for both CS-Cart and Multi-Vendor.","scope":"Inventory record: PHP-0156\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: mod_php, PHP-FPM or FastCGI as explicitly documented\nPHP version scope: Inspected latest page labelled 4.21.x: PHP >=7.4; 8.3 support starts at 4.19.1. No higher-version support inferred.\nExtensions: Required (documented scope): curl, sockets, exif, json, xml, libxml, simplexml, dom, xmlreader, xmlwriter, soap, mbstring, iconv, ctype, phar, zip, fileinfo, openssl. Optional/recommended: opcache. Conditional/alternatives: mysqli OR pdo_mysql; imagick OR gd for product-image processing; ftp for install/update permission workflow; redis/sqlite3/xcache/apcu/apc according to selected cache/session backend\nLimitations: One record preserves the shared PHP platform and distinct product names. Optional cache backends are alternatives, not simultaneously required modules. Marketplace functionality does not itself establish weak tenant isolation. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce/marketplace storefront, administration, shipping and payment integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: CS-Cart, CS-Cart Multi-Vendor, Multi-Vendor\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.cs-cart.com/latest/install/system_requirements.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0157","name":"X-Cart 5","vendor":"X-Cart","category":"Commerce","version":"Not specified","summary":"The versioned developer page requires PHP 8.3–8.4, lists runtime extensions and separately recommends Xdebug for development.","scope":"Inventory record: PHP-0157\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Documentation labelled X-Cart 5.6.0: PHP 8.3–8.4. Older 5.5/5.4 requirements are separate.\nExtensions: Required (documented scope): amqp, ctype, curl, date, filter, hash, iconv, intl, json, libxml, mbstring, openssl, pcre, pdo, redis, simplexml, soap, sockets, sodium, spl, tokenizer, xml, xmlwriter. Optional/recommended: xdebug (development only)\nLimitations: libvips is an external image-processing dependency and is not labelled a PHP extension here. Older X-Cart help pages must not supply the 5.6 minimum. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: X-Cart 5.6\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://developer.x-cart.com/getting_started/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0158","name":"OroCommerce","vendor":"Oro Inc.","category":"Commerce","version":"Not specified","summary":"The vendor separates server PHP/CLI and extension requirements from client-side browsers, cookies and JavaScript.","scope":"Inventory record: PHP-0158\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Current system-requirements page labelled 7.0: PHP >=8.5, matching web and CLI versions; exact release artifact not pinned.\nExtensions: Required (documented scope): ctype, curl, fileinfo, gd, intl, json, mbstring, sodium, openssl, pgsql, pcre, simplexml, tokenizer, xml, zip, imap, soap, bcmath, ldap. Optional/recommended: tidy. Conditional/alternatives: mongodb >=2.0 for OroGridFSConfigBundle\nLimitations: This evidence is scoped to the displayed 7.0 documentation and does not establish that any browser/mobile client contains PHP. Other Oro products and older releases need separate validation. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: B2B storefront, administration, integrations and asynchronous application processes\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: orocommerce, OroCommerce Community Edition, OroCommerce Enterprise Edition\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://doc.oroinc.com/backend/setup/system-requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0159","name":"Spryker Commerce OS","vendor":"Spryker Systems GmbH","category":"Commerce","version":"Not specified","summary":"The vendor documents PHP-backed commerce and marketplace applications; its upgrade guide distinguishes the 8.3 floor from the 8.5 recommendation.","scope":"Inventory record: PHP-0159\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: System requirements displayed as 202608.0, updated 31 August 2026: PHP >=8.3; 3 September upgrade guide recommends 8.5.\nExtensions: Required (documented scope): curl, json, gd, intl, xml, mbstring. Partial or inherited list; see version/extension limitations\nLimitations: The extension table mixes modern and legacy/ambiguous names, including mysql and twig. Only an explicit subset is normalized here; exact resolved project/image requirements remain unknown. Modular apps and marketplace variants overlap. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Storefront/API, privileged back office, imports, queues and jobs\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Spryker, SCOS, Spryker Marketplace\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.spryker.com/docs/dg/dev/system-requirements/latest/system-requirements.html","https://docs.spryker.com/docs/dg/dev/upgrade-and-migrate/upgrade-to-php-85"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0160","name":"OpenMage","vendor":"OpenMage project","category":"Commerce","version":"Not specified","summary":"Official requirements establish PHP and intl. Publisher registry metadata separately identifies OpenMage as a Magento-1 fork.","scope":"Inventory record: PHP-0160\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Current requirements: PHP 8.1+ since 20.14.0; 8.4/8.5 may emit warnings. Separate registry beta sample has different bounds.\nExtensions: Required (documented scope): intl. Partial or inherited list; see version/extension limitations\nLimitations: Do not infer dependency on Magento 2 or Adobe Commerce. The registry default v21.0.0-beta2 (PHP >=7.4 <8.5) is not used as a current stable 20.x requirement. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: openmage/magento-lts, Magento LTS\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://docs.openmage.org/users/requirements/","https://packagist.org/packages/openmage/magento-lts"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0161","name":"Mage-OS","vendor":"Mage-OS project","category":"Commerce","version":"Not specified","summary":"The official page lists PHP runtime requirements and identifies the Magento base for Mage-OS release families.","scope":"Inventory record: PHP-0161\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0011\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Fetched requirements body labelled Mage-OS 3.5.0: PHP 8.3–8.5, with 8.5 recommended; component table separately shows 8.4.\nExtensions: Required (documented scope): bcmath, ctype, curl, dom, fileinfo, gd, hash, iconv, intl, json, libxml, mbstring, openssl, pcntl, pcre, pdo_mysql, simplexml, soap, sockets, sodium, xml, xsl, zip, zlib\nLimitations: The fetched body is 3.5.0 even though discovery snippets mentioned 3.6.0. The prose PHP range and release component table are retained as distinct scope signals. No current Magento/Adobe support entitlement is inherited. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: mage-os/project-community-edition, MageOS\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://mage-os.org/get-started/system-requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0162","name":"thirty bees","vendor":"thirty development llc / thirty bees project","category":"Commerce","version":"Not specified","summary":"The release/download page gives a PHP-specific build selection and runtime requirements; the repository identifies its PrestaShop 1.6.1.11 fork point.","scope":"Inventory record: PHP-0162\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0146\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Vendor download page: 1.7.0 released 13 July 2026; PHP 7.4–8.3, with builds selected for the PHP version.\nExtensions: Required (documented scope): gd, bcmath, simplexml, dom, json, zip, pdo_mysql. Optional/recommended: imap, curl, mbstring, opcache, soap. Conditional/alternatives: apcu/redis/memcached according to selected optional cache backend\nLimitations: The historical fork edge does not require current PrestaShop 9. XML/DOM and PDO MySQL class names were normalized to PHP extension names. Specific release artifact and loaded modules were not verified. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: thirtybees/thirtybees, ThirtyBees\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://thirtybees.com/download/","https://github.com/thirtybees/thirtybees/blob/main/README.md"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0163","name":"EC-CUBE","vendor":"EC-CUBE project","category":"Commerce","version":"Not specified","summary":"The publisher registry provides PHP and direct runtime extension requirements for the explicitly alpha 4.4 sample.","scope":"Inventory record: PHP-0163\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry sample 4.4.0-alpha-1 dated 25 September 2026: PHP ^8.2; moving 4.4 README lists PHP 8.2–8.5.\nExtensions: Required (documented scope): curl, filter, gd, intl, json, mbstring, openssl, tokenizer, xml, zip, zlib. Partial or inherited list; see version/extension limitations\nLimitations: The default registry version is an alpha; stable 4.3.x constraints were not resolved. Direct requirements do not enumerate all transitive/runtime database extensions. Browser JavaScript is a separate client surface. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: 4.4.0-alpha-1; registry-advertised source reference 7de702fac5e5b32a666eac3db480d5ecd11f8b1f\nSource accessed: 2026-10-17\nAliases: ec-cube/ec-cube\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://packagist.org/packages/ec-cube/ec-cube","https://github.com/EC-CUBE/ec-cube"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0164","name":"Aimeos Laravel package","vendor":"Aimeos project","category":"Commerce","version":"Not specified","summary":"The official package README requires PHP and adds shop/admin routes and PHP Artisan setup/jobs to Laravel.","scope":"Inventory record: PHP-0164\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Inspected README: PHP >=8.1; 2025.10 LTS supports Laravel 10/11/12, with 2024.10 as older LTS.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: The module floor is not the full Laravel application floor; the selected framework and packages can narrow compatibility. Aimeos frontend/headless distributions overlap with this engine and are not counted as unique installations. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce routes, administration, setup and applicable scheduled Artisan jobs\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: aimeos/aimeos-laravel, Aimeos for Laravel\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://github.com/aimeos/aimeos-laravel/blob/master/README.md"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0165","name":"Aimeos TYPO3 extension","vendor":"Aimeos project","category":"Commerce","version":"Not specified","summary":"The official 2025.x installation guide requires PHP for its TYPO3 commerce extension.","scope":"Inventory record: PHP-0165\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0009\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Versioned 2025.x setup documentation: extension requires PHP >=8.1; the selected TYPO3 version can require a higher PHP minimum.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: This independently identifiable integration shares Aimeos functionality and TYPO3 installations. It does not prove that the whole selected TYPO3 application runs on PHP 8.1 or adds a separate installation. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: TYPO3 commerce frontend/admin and configured shop tasks\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: aimeos/aimeos-typo3, Aimeos for TYPO3\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://aimeos.org/docs/2025.x/typo3/setup/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0166","name":"Drupal Commerce","vendor":"Drupal Commerce / Centarro","category":"Commerce","version":"Not specified","summary":"The official module project explicitly depends on Drupal, separates 3.x/2.x/1.x core lineages and lists its current release.","scope":"Inventory record: PHP-0166\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Commerce 3.x supports Drupal ^10.3 || ^11; project lists 3.3.12 released 16 October 2026. PHP floor inherited from the selected core and resolved packages.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: Release 3.3.12 detail page was unavailable, so immutable composer/source requirements and extension list remain unresolved. Drupal reported usage was not adopted as a unique installation total. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Project-listed release 3.3.12 (16 October 2026); immutable source pin pending\nSource accessed: 2026-10-17\nAliases: drupal/commerce, Commerce Core\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://www.drupal.org/project/commerce"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0167","name":"Lunar commerce core","vendor":"Lunar project","category":"Commerce","version":"Not specified","summary":"Publisher metadata declares PHP, three direct extensions and Laravel for the headless commerce core.","scope":"Inventory record: PHP-0167\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry sample 2.0.0-alpha.6: PHP ^8.4, Laravel ^12.0|^13.0. Stable 1.x exact requirements unresolved.\nExtensions: Required (documented scope): bcmath, exif, intl. Partial or inherited list; see version/extension limitations\nLimitations: This is an explicitly alpha sample; transitive extensions and stable 1.x requirements are not fully enumerated. A headless storefront can be a separate non-PHP client. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: 2.0.0-alpha.6; registry-advertised source reference 4447e91ab35969ba3707d15ff32bdfbb340736d3\nSource accessed: 2026-10-17\nAliases: lunarphp/core, LunarPHP core\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://packagist.org/packages/lunarphp/core"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0168","name":"Lunar administration panel","vendor":"Lunar project","category":"Commerce","version":"Not specified","summary":"Publisher package metadata identifies an admin panel and requires its exact commerce-core and Filament component versions.","scope":"Inventory record: PHP-0168\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0167\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry sample 2.0.0-alpha.6 requires lunarphp/core exactly 2.0.0-alpha.6, inheriting PHP ^8.4; additional Filament constraints may narrow the resolved application.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: The admin panel and core overlap within a project. A pure storefront client does not imply this privileged PHP administration surface is installed or public. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Privileged product, order and customer administration\nRelease pin: 2.0.0-alpha.6; registry-advertised source reference 5b4c6bb573f1ecde97e4689becc70563248d7463\nSource accessed: 2026-10-17\nAliases: lunarphp/lunar, LunarPHP admin\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://packagist.org/packages/lunarphp/lunar"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0169","name":"Thelia","vendor":"Thelia project","category":"Commerce","version":"Not specified","summary":"The official 3.0 guide requires PHP and modules; migration notes distinguish the root application from the lower-level core package floor.","scope":"Inventory record: PHP-0169\nCategory: Commerce\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Versioned 3.0 installation: PHP 8.3/8.4/8.5. Migration guide distinguishes project >=8.3 from the core library declared >=8.2.\nExtensions: Required (documented scope): pdo_mysql, openssl, intl, gd, curl, dom. Partial or inherited list; see version/extension limitations\nLimitations: A component lower bound cannot override the root project requirements. Exact release state/artifact is not established merely by a versioned documentation path. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: thelia/thelia, thelia/thelia-project, thelia/core\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://doc.thelia.net/docs/3.0/getting-started/installation","https://doc.thelia.net/docs/3.0/upgrading/migrate"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0170","name":"VirtueMart","vendor":"VirtueMart project","category":"Commerce","version":"Not specified","summary":"The official description states that Joomla and VirtueMart are PHP applications and distinguishes the component from a preinstalled Joomla bundle.","scope":"Inventory record: PHP-0170\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0008\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Official product architecture confirms PHP through Joomla; exact current VirtueMart/Joomla/PHP release matrix not pinned.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: The Joomla parent is a family lineage edge, not a claim of compatibility with the parent record’s current Joomla 6 scope. The preinstalled bundle and component must not be summed as separate deployments. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: com_virtuemart, VirtueMart Joomla component\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://virtuemart.net/component/content/article/what-is-virtuemart?Itemid=144&catid=159"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0171","name":"HikaShop Joomla component","vendor":"HikaShop project","category":"Commerce","version":"Not specified","summary":"The official guide describes PHP installation scripts inside the Joomla administrator component and PHP configuration handling.","scope":"Inventory record: PHP-0171\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0008\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Inspected Joomla installation/administration documentation; exact HikaShop/Joomla/PHP release matrix unresolved.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: This record is scoped to the Joomla component. The page also mentions a WordPress edition, which needs separate release/manifest validation. Essential/Business edition feature differences and exact extensions remain unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Commerce storefront, checkout, catalog/admin and enabled integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: com_hikashop, HikaShop for Joomla\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://www.hikashop.com/support/documentation/hikashop/installation-configuration"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0172","name":"WooCommerce Stripe Payment Gateway","vendor":"WooCommerce","category":"Commerce","version":"Not specified","summary":"The publisher-controlled plugin listing explicitly requires PHP for the WooCommerce Stripe integration.","scope":"Inventory record: PHP-0172\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0012\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry listing version 11.1.1: PHP >=7.4; effective installation requirements also include the selected WordPress/WooCommerce versions.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: PHP runs in the merchant plugin/backend. This does not establish that Stripe’s remote service backend or browser payment fields run PHP. Raw card-data handling depends on the actual integration and was not assessed. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Merchant checkout, payment callbacks, order state and plugin administration\nRelease pin: Registry-listed 11.1.1; immutable plugin artifact/hash pending\nSource accessed: 2026-10-17\nAliases: woocommerce-gateway-stripe, Stripe for WooCommerce\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://wordpress.org/plugins/woocommerce-gateway-stripe/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0173","name":"WooCommerce PayPal Payments","vendor":"WooCommerce","category":"Commerce","version":"Not specified","summary":"The official plugin listing requires installed WooCommerce and PHP to connect a merchant store to PayPal.","scope":"Inventory record: PHP-0173\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0012\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry listing version 4.1.3 and installation text both require PHP >=7.4; WordPress minimum text differs (6.3 versus metadata 6.5).\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: The merchant plugin is the confirmed PHP component. PayPal service internals remain unknown from this evidence. Resolve exact release manifests for the conflicting WordPress minimum. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Merchant checkout, PayPal callbacks, refunds, order state and plugin administration\nRelease pin: Registry-listed 4.1.3; immutable plugin artifact/hash pending\nSource accessed: 2026-10-17\nAliases: woocommerce-paypal-payments, PayPal Payments for WooCommerce\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://wordpress.org/plugins/woocommerce-paypal-payments/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0174","name":"Mollie Payments for WooCommerce","vendor":"Mollie","category":"Commerce","version":"Not specified","summary":"The publisher’s listing requires PHP, cURL and JSON and documents merchant API keys and payment-status webhooks.","scope":"Inventory record: PHP-0174\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0012\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry listing version 8.1.11: PHP >=7.4; WordPress/WooCommerce must independently meet their own release requirements.\nExtensions: Required (documented scope): curl, json. Partial or inherited list; see version/extension limitations\nLimitations: This PHP relationship is on the merchant’s WordPress server. It does not establish PHP inside Mollie’s remote service. Inherited WordPress modules and all enabled gateways remain unenumerated. PHP presence does not establish an affected build, reachable flaw or exploitation. Installations and enabled integrations were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Merchant checkout, webhook endpoint, API-key configuration and payment/order status\nRelease pin: Registry-listed 8.1.11; immutable plugin artifact/hash pending\nSource accessed: 2026-10-17\nAliases: mollie-payments-for-woocommerce, Mollie WooCommerce plugin\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://wordpress.org/plugins/mollie-payments-for-woocommerce/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0175","name":"WooPayments merchant plugin","vendor":"WooCommerce","category":"Commerce","version":"Not specified","summary":"The official develop header labels version 11.2.0 and declares PHP 7.4, alongside separate WooCommerce and WordPress prerequisites. This corroborates registry metadata, not a verified release archive.","scope":"Inventory record: PHP-0175\nCategory: Commerce\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0012\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; CLI where separately documented; exact SAPI deployment-dependent\nPHP version scope: Registry-listed 11.2.0 metadata and the moving develop plugin header/readme declare PHP >=7.4; the listing getting-started text still says >=7.3. Released tag/archive not read successfully.\nExtensions: Exact required extension set not enumerated. Partial or inherited list; see version/extension limitations\nLimitations: The 7.3 prose is not substituted for the 7.4 declaration. Moving develop and a version label are not an immutable release pin; selected host, artifact and effective compatibility remain unverified. No PHP inference for remote payment services or mobile clients; no affected build, exposure or installation count measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates\nDownstream surface: Merchant checkout, payment events, disputes, payouts display and plugin administration\nRelease pin: develop header/readme display 11.2.0; tag/archive retrieval failed; no immutable commit or archive digest verified\nSource accessed: 2026-10-18\nAliases: woocommerce-payments, WooCommerce Payments, WooPayments WordPress plugin\nConditional downstream consequence: A matching PHP memory-safety or parser flaw reached through store requests, imports or media handling could cause denial of service, disclosure or code execution in the PHP worker. Code execution could expose configured commerce/payment credentials or alter orders and content. Provider compromise, tenant escape and lateral movement would require additional permissions or flaws.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime; application/plugin maintainer and merchant for application updates","links":["https://github.com/Automattic/woocommerce-payments/blob/develop/woocommerce-payments.php","https://wordpress.org/plugins/woocommerce-payments/","https://github.com/Automattic/woocommerce-payments/blob/develop/readme.txt"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0176","name":"Totara","vendor":"Totara","category":"Education and knowledge","version":"Not specified","summary":"The vendor requires a PHP server and separates supported PHP branches, mandatory modules and recommended modules.","scope":"Inventory record: PHP-0176\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Moving server-requirements page: PHP 8.2, 8.3 and 8.4 supported; 8.3 recommended; <=8.1 and >=8.5 explicitly unsupported. Exact Totara release unresolved.\nExtensions: Required in stated documentation/manifest: ctype, curl, date, dom, fileinfo, gd, hash, iconv, intl, json, libxml, mbstring, openssl, pcre, session, simplexml, sodium, spl, xml, xmlreader, zip, zlib. Optional/recommended: tokenizer, xmlrpc, soap, opcache, exif\nLimitations: The public moving page is not a per-release manifest; the distributed README is needed for an exact installed release. OpenSSL appears in both lists and is retained as required. XML-RPC availability is a separate packaging question. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Learning, talent and performance portals, course uploads and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Totara Learn, Totara Talent Experience Platform\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://totara.help/docs/server-system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0177","name":"ILIAS","vendor":"ILIAS Society / ILIAS project","category":"Education and knowledge","version":"Not specified","summary":"The official release-branch guide documents mod_php, FCGI/PHP-FPM and PHP CLI setup and cron, with separate required and feature-dependent modules.","scope":"Inventory record: PHP-0177\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache mod_php, FCGI/PHP-FPM; PHP CLI setup, updates and cron\nPHP version scope: release_11 installation guide: ILIAS 11.x supports PHP 8.3.x/8.4.x; 10.x 8.2/8.3; 9.x 8.1/8.2. Release listing shows v11.5 dated 6 October 2026; requirements file itself is a moving branch.\nExtensions: Required in stated documentation/manifest: gd, dom, xsl, pdo, pdo_mysql, curl, json, simplexml, libxml, xml, zip, imagick, mbstring. Conditional: soap for SOAP user administration; ldap for LDAP authentication\nLimitations: Use the vendor-built ILIAS archive for bundled Composer dependencies; GitHub automatic Source Code archives are a different build boundary. PHP must have Argon2 password support. Exact v11.5 source/build pin and installed configuration remain unverified. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Learning content, assessments, uploads, search integration and privileged CLI setup\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: ILIAS-eLearning/ILIAS\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/ILIAS-eLearning/ILIAS/blob/release_11/docs/configuration/install.md","https://github.com/ILIAS-eLearning/ILIAS/releases"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0178","name":"Chamilo","vendor":"Chamilo Association / Chamilo project","category":"Education and knowledge","version":"Not specified","summary":"The 3.0 server guide lists PHP and native modules; LDAP is required even when unused, while APCu is checked but not enforced.","scope":"Inventory record: PHP-0178\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Administration guide explicitly for Chamilo 3.0: minimum PHP 8.3, recommended 8.5. The documentation does not independently prove release availability or deployed version.\nExtensions: Required in stated documentation/manifest: bcmath, ctype, curl, dom, libxml, simplexml, xml, xmlreader, exif, fileinfo, gd, iconv, intl, json, ldap, mbstring, openssl, pdo, soap, zip, zlib. Optional/recommended: apcu. Conditional: pdo_mysql OR pdo_pgsql matching the selected database\nLimitations: Version-scoped documentation is retained without claiming that 3.0 is the latest stable product. APCu is recommended, despite placement in the required-extensions table. Older Chamilo release requirements need separate validation. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Course delivery, SCORM/archive handling, assessment and LMS integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Chamilo LMS, chamilo/chamilo-lms\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.chamilo.org/administration-guide/admin-guide/installation/server-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0179","name":"Mahara","vendor":"Catalyst IT / Mahara project","category":"Education and knowledge","version":"Not specified","summary":"The 26.04 manual documents server config.php, PHP configuration variables and calls into PHP functions; the project support reply supplies a dated compatibility statement.","scope":"Inventory record: PHP-0179\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: 26.04 public manual confirms server-side PHP configuration. Official project support reply dated 21 April 2026 states 26.04 is compatible with PHP 8.2 and describes PHP 8.3 support as future work; exact current patch floor unknown.\nExtensions: Complete required extension set unknown\nLimitations: Linked installation/requirements wiki redirected to sign-in. No private material was accessed. The April reply does not establish whether its planned 8.3 support later shipped. Exact required modules and patch-level requirements remain unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Private/shared portfolios, uploads, groups and LMS submission integration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Mahara ePortfolio\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://manual.mahara.org/en/26.04/administration/config_php.html","https://mahara.org/interaction/forum/topic.php?id=10051&post38023="],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0180","name":"Forma LMS","vendor":"Forma LMS project","category":"Education and knowledge","version":"Not specified","summary":"The project mirror README explicitly lists a PHP server, required extensions and web-based installation.","scope":"Inventory record: PHP-0180\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Official project mirror README inspected: PHP 8.0.0–8.1.x. Mirror branch/release alignment and newer 4.2 requirements were not independently established.\nExtensions: Required in stated documentation/manifest: openssl, pdo, gd, curl, xml, zip. Conditional: MySQL/MariaDB PHP database support; exact native driver not named\nLimitations: The mirror can lag newer releases; a newer 4.2/PHP 8.2 discovery lead could not be read and is not adopted as fact. An old Composer comment about PHP 5.5 is not treated as the runtime requirement. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Training courses, learner records, media and LMS administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: forma.lms, formalms/formalms\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/formalms/formalms"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0181","name":"Open eClass","vendor":"Open eClass project / GUnet","category":"Education and knowledge","version":"Not specified","summary":"The 4.1 installation page requires PHP and names modules; it explicitly says the current package does not include phpMyAdmin.","scope":"Inventory record: PHP-0181\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: 4.1 installation manual: PHP >=8.2. Some module names and example configuration are obsolete; exact released manifest pending.\nExtensions: Required in stated documentation/manifest: zlib, pcre, mbstring, intl, gd. Conditional: ldap when LDAP authentication is used; Selected MySQL/MariaDB driver unresolved; manual says mysql, not a verified modern ext-mysql requirement\nLimitations: Legacy mysql naming, a php5-FPM socket and removed configuration directives coexist with the PHP 8.2 minimum. These examples are not recommended settings or proof of PHP 5 compatibility. Exact database-driver/module manifest remains unresolved. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Education portals, course uploads, authentication and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Open eClass 4.1, openeclass\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by course imports, uploads or web requests could cause denial of service, disclosure or code execution within the PHP worker. Its configured permissions could then expose learning records, authentication secrets or change course content. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.openeclass.org/en/4.1/install"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0182","name":"DokuWiki","vendor":"DokuWiki project / splitbrain","category":"Education and knowledge","version":"Not specified","summary":"The official manifest requires PHP and suggests mbstring for performance and intl for locale-aware sorting.","scope":"Inventory record: PHP-0182\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected master composer.json: PHP >=8.2. This moving development constraint is not automatically the requirement of every stable DokuWiki release.\nExtensions: Complete required extension set unknown. Optional/recommended: mbstring, intl\nLimitations: The public requirements page failed retrieval. Stable-release minima, complete transitive/native requirements and Docker image contents are not pinned. Suggested extensions are not mandatory in this manifest. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Wiki content, media, authentication and installed plugins\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: dokuwiki/dokuwiki\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/dokuwiki/dokuwiki/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0183","name":"BookStack","vendor":"BookStack project","category":"Education and knowledge","version":"Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0183\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI for installation/maintenance; web SAPI deployment-dependent\nPHP version scope: Moving installation documentation: PHP >=8.2. Exact application release/framework lock not pinned.\nExtensions: Required in stated documentation/manifest: curl, dom, gd, iconv, mbstring, mysqlnd, openssl, pdo, pdo_mysql, tokenizer, xml, zip. Conditional: ldap for LDAP authentication; exif for automatic image rotation\nLimitations: mysqlnd and pdo_mysql are separate listed requirements. The application’s Laravel version is not inferred from a different current Laravel record. Automatic installation scripts were only read as documentation and were not run. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Knowledge-base documents, uploads, access control and authentication configuration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: BookStackApp/BookStack\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.bookstackapp.com/blog/php-security-release-critical/\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://www.bookstackapp.com/docs/admin/installation/","https://www.bookstackapp.com/blog/php-security-release-critical/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStack code alone is insufficient.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.bookstackapp.com/blog/php-security-release-critical/\nAction statement: Install the confirmed PHP update for the actual hosting environment and restart the serving runtime; do not assume the documented Docker variants are fixed."},"CVE-2026-109619":{"status":"Fix","notes":"BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStack code alone is insufficient.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.bookstackapp.com/blog/php-security-release-critical/\nAction statement: Install the confirmed PHP update for the actual hosting environment and restart the serving runtime; do not assume the documented Docker variants are fixed."}}},{"id":"PHP-0184","name":"PmWiki","vendor":"PmWiki project","category":"Education and knowledge","version":"Not specified","summary":"The project requires PHP on the web server and describes its PHP compatibility range.","scope":"Inventory record: PHP-0184\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Current requirements page: PHP >=7.0; page says tested through PHP 8.5. Exact PmWiki release not pinned.\nExtensions: Complete required extension set unknown\nLimitations: The generic page does not enumerate a complete extension set or prove installed PHP 7 systems. Recipes and skins can narrow compatibility. Version compatibility is distinct from PHP security support. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Wiki editing, content rendering and locally installed recipes\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: PmWiki wiki\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://www.pmwiki.org/wiki/PmWiki/Requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0185","name":"Tiki Wiki CMS Groupware","vendor":"Tiki Software Community Association / Tiki project","category":"Education and knowledge","version":"Not specified","summary":"The project documents a PHP 7.4-to-8.1 migration boundary and PHP-dependent Composer libraries.","scope":"Inventory record: PHP-0185\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Official PHP-8 migration page: PHP 8.1 minimum from Tiki 26; Tiki 24 LTS uses PHP 7.4. Statements about Tiki 27 support are plans in an older migration narrative, not a current release matrix.\nExtensions: Complete required extension set unknown\nLimitations: The main requirements page and machine-readable requirements YAML could not be retrieved. Exact Tiki 27–30 compatibility, full extensions and release pins remain unresolved; search snippets were not promoted to verified requirements. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Wiki/CMS/groupware content, files, user records and installed features\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Tiki, TikiWiki\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://doc.tiki.org/PHP-8"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0186","name":"Semantic MediaWiki","vendor":"Semantic MediaWiki project","category":"Education and knowledge","version":"Not specified","summary":"The publisher manifest declares PHP and mbstring and explicitly requires MediaWiki and its dependencies.","scope":"Inventory record: PHP-0186\nCategory: Education and knowledge\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0014\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Publisher registry 7.3.1, dated 28 September 2026: PHP >=8.1 and native mbstring; selected MediaWiki core can impose a higher PHP floor.\nExtensions: Required in stated documentation/manifest: mbstring\nLimitations: This optional semantic-data extension overlaps its MediaWiki installation. Its PHP 8.1 component minimum cannot lower the core requirement. The complete compatibility matrix and resolved dependency modules remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Semantic annotations, query results, data export and wiki extension administration\nRelease pin: 7.3.1; registry-advertised source reference 60637e855c294f3d223ddeef57af24338def7a8a\nSource accessed: 2026-10-17\nAliases: mediawiki/semantic-media-wiki, SMW\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://packagist.org/packages/mediawiki/semantic-media-wiki"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0187","name":"Parsoid PHP","vendor":"Wikimedia / MediaWiki project","category":"Education and knowledge","version":"Not specified","summary":"Parsoid is a PHP library converting wikitext and HTML; the older JavaScript implementation is explicitly historical.","scope":"Inventory record: PHP-0187\nCategory: Education and knowledge\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0014\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Official project page identifies the PHP implementation and bundling with MediaWiki since 1.35. Exact Parsoid package/PHP floor depends on the selected MediaWiki release.\nExtensions: Complete required extension set unknown\nLimitations: The PHP library is a named bundled component, not a native PHP extension or another installation. A planned default-parser change for MediaWiki 1.47 is not treated as current default behavior. Exact enabled features, Composer version and module set remain unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Wikitext/HTML parsing, editing and MediaWiki content transformation\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Parsoid, wikimedia/parsoid\nConditional downstream consequence: A matching flaw in the PHP runtime or a loaded parser reached by document, media or request processing could cause denial of service, information disclosure or worker-level code execution. Resulting access could affect wiki content, private documents or configured credentials; host/tenant boundaries require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://www.mediawiki.org/wiki/Parsoid"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0188","name":"phpBB","vendor":"phpBB Limited / phpBB project","category":"Education and knowledge","version":"Not specified","summary":"The publisher package declares PHP and direct extensions for its displayed 4.0 alpha release, with separate runtime and development dependencies.","scope":"Inventory record: PHP-0188\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Default publisher registry selected 4.0.0-a2 (27 April 2026), requiring PHP ^8.2. This is an alpha sample; stable 3.3.19 is listed but its exact requirements were not retrieved.\nExtensions: Required in stated documentation/manifest: pdo, sodium, zip, zlib\nLimitations: Stable 3.3 documentation returned HTTP 403. Alpha requirements do not establish stable 3.3 requirements. The direct Composer subset is not the complete resolved native/module set; no present product vulnerability is inferred from registry advisory counts. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Forum posts, attachments, private messages, authentication and moderation\nRelease pin: 4.0.0-a2; registry-advertised source reference 4c80bc220953ed13e04e6c2e24e9feb98cdd2216\nSource accessed: 2026-10-17\nAliases: phpbb/phpbb, phpbb/phpbb-app\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://packagist.org/packages/phpbb/phpbb"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0189","name":"MyBB","vendor":"MyBB Group","category":"Education and knowledge","version":"Not specified","summary":"The official MyBB 1.8 installation requirements identify PHP and three named extensions plus a selected database driver.","scope":"Inventory record: PHP-0189\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: 1.8 requirements manual states PHP >=5.2 and recommends the latest PHP. This broad historical minimum is not verified against the latest 1.8 patch manifest.\nExtensions: Required in stated documentation/manifest: simplexml, mbstring, gd. Conditional: Vendor-specific PHP database extension matching MariaDB/MySQL, PostgreSQL or SQLite\nLimitations: A legacy compatibility floor does not prove any old deployment or complete compatibility with every newer PHP release. Exact current patch constraints and plugins remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Forum posts, attachments, private messages and forum administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: MyBulletinBoard, MyBB 1.8\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.mybb.com/1.8/install/requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0190","name":"MyBB Merge System","vendor":"MyBB Group","category":"Education and knowledge","version":"Not specified","summary":"The official requirements name Merge System separately from the running MyBB forum and require PHP for the migration tool.","scope":"Inventory record: PHP-0190\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0189\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: The shared 1.8 manual explicitly includes Merge System 1.8 in PHP >=5.2 requirements. Current migration-tool release and source-platform adapters unresolved.\nExtensions: Required in stated documentation/manifest: simplexml, mbstring, gd. Conditional: Selected source/target database PHP drivers\nLimitations: This optional one-time migration path overlaps a target forum and must not be counted as another installation. Its legacy minimum is documentation scope, not an installed runtime measurement. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Imported forum databases, credentials supplied for migration and target content\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: MyBB Merge System 1.8\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.mybb.com/1.8/install/requirements/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0191","name":"Flarum","vendor":"Flarum project / Flarum Foundation","category":"Education and knowledge","version":"Not specified","summary":"Official 2.x documentation distinguishes PHP, database drivers and CLI/Composer maintenance; 1.x has a separate compatibility scope.","scope":"Inventory record: PHP-0191\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime; CLI/Composer for applicable installation and maintenance\nPHP version scope: 2.x installation docs: PHP >=8.3, with 2.0.1 prebuilt archives labelled PHP 8.3/8.4/8.5. Separate 1.x docs require >=7.3 and describe compatibility through 8.5 on an older framework stack.\nExtensions: Required in stated documentation/manifest: curl, dom, fileinfo, gd, json, mbstring, openssl, tokenizer, zip, session. Conditional: pdo_mysql for MySQL/MariaDB OR pdo_sqlite for SQLite OR pdo_pgsql for PostgreSQL; Before 2.0.2 the installer also requires pdo_mysql regardless of selected database\nLimitations: The moving guide lists 2.0.1 archives while discussing a before-2.0.2 installer exception. Archive contents/digests are unverified. A PHP 7.4 socket in a web-server example is not a 2.x compatibility claim. Extension Manager is privileged optional functionality. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Forum posts, media, authentication, extensions and extension installation administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: flarum/core, flarum/flarum\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.flarum.org/install/","https://docs.flarum.org/1.x/install/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0192","name":"Simple Machines Forum","vendor":"Simple Machines / SMF project","category":"Education and knowledge","version":"Not specified","summary":"The official application manifest declares a PHP runtime constraint separately from PHP-CS-Fixer and PHPUnit development dependencies.","scope":"Inventory record: PHP-0192\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected release-3.0 composer.json requires PHP >=8.4. Moving branch, not proof that 3.0 is released/stable or that 2.1 has the same minimum.\nExtensions: Complete required extension set unknown\nLimitations: Current stable 2.1 constraints and complete native module requirements remain unresolved. The Composer platform sample 8.4.1 is not an independently measured installed version. No project scripts or tests were run. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Forum requests, content, attachments and administrator/moderator functions\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: SMF, simplemachines/smf\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/SimpleMachines/SMF/blob/release-3.0/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0193","name":"XenForo","vendor":"XenForo Ltd","category":"Education and knowledge","version":"Not specified","summary":"Vendor documentation identifies PHP web-server requirements, GD JPEG support and a PHP CLI command interface.","scope":"Inventory record: PHP-0193\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and PHP CLI cmd.php; exact web SAPI deployment-dependent\nPHP version scope: Official developer documentation lists PHP >=7.2 with PHP 8.4 recommended; exact XenForo product release/edition not labelled in the inspected requirements.\nExtensions: Required in stated documentation/manifest: mysqli, gd, pcre, curl, spl, simplexml, dom, json, iconv, ctype\nLimitations: The generic developer page is not an exact licensed release manifest. Cloud-hosted PHP build/version and optional add-on requirements remain unknown; PHP 8.4 is a recommendation, not an observed runtime. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Forum posts, attachments, user records, add-ons and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: XenForo self-hosted forum\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.xenforo.com/devs"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0194","name":"Invision Community Classic","vendor":"Invision Community / Invision Power Services","category":"Education and knowledge","version":"Not specified","summary":"The vendor explicitly describes PHP requirements for the self-hosted Classic product and customer responsibility for server security patches and version upgrades.","scope":"Inventory record: PHP-0194\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Current self-hosted vendor page requires a web server supporting secure PHP, GD, mbstring and default modules; exact numeric PHP/release requirement not public on this page.\nExtensions: Required in stated documentation/manifest: gd, mbstring\nLimitations: Classic is separated from the vendor’s Cloud offering. No PHP version or runtime implementation is inferred for a particular Cloud tenant. Default extensions are not enumerated by the page; licensed release manifests were not accessed. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Self-hosted community pages, messages, media, user data and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Invision Community self-hosted, IPS Community Suite Classic\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://invisioncommunity.com/buy/self-hosted/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0195","name":"WoltLab Suite","vendor":"WoltLab GmbH","category":"Education and knowledge","version":"Not specified","summary":"Official requirements separate the PHP-capable server and extensions from ordinary browser clients; a companion matrix binds PHP ranges to Suite releases.","scope":"Inventory record: PHP-0195\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: 6.2 compatibility matrix: PHP 8.1.2–8.4.x (64-bit). 6.1/6.0: 8.1.2–8.3.x; 5.5: 7.4.21–8.1.x. Requirements page itself is moving.\nExtensions: Required in stated documentation/manifest: ctype, dom, exif, fileinfo, gmp, intl, libxml, mbstring, openssl, pdo, pdo_mysql, zlib. Conditional: gd OR imagick, with WebP support\nLimitations: One suite-family record covers its shared runtime; separately named apps do not imply distinct deployments. Exact released package modules and commercial apps remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Forum/community content, files, shared suite core and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: WoltLab Suite Core, WoltLab Suite Forum, WoltLab Burning Board lineage\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://manual.woltlab.com/en/requirements/","https://manual.woltlab.com/en/php-compatibility/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0196","name":"Open Journal Systems","vendor":"Public Knowledge Project (PKP)","category":"Education and knowledge","version":"Not specified","summary":"The official OJS README requires PHP and supplies a platform-check example while warning that its sample version numbers are not minimum versions.","scope":"Inventory record: PHP-0196\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main README: PHP >=8.2. Exact released OJS manifest and patch version pending.\nExtensions: Main-branch platform-check example lists bcmath, curl, dom, fileinfo, filter, ftp, gd, hash, intl, json, libxml, openssl, pcre, phar, session, simplexml, spl, tokenizer, xml, xmlwriter, zip, zlib. ctype/mbstring are polyfilled in that example; database driver and release-resolved modules remain unknown. Sample version numbers are not minimums.\nLimitations: Shared PKP library lineage and features overlap; CLI and web PHP configurations can differ. Native ctype/mbstring are not unconditionally required by the supplied polyfill example. Exact release modules and plugins remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Journal submissions, peer review, editorial decisions and publication management\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: OJS, pkp/ojs\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/pkp/ojs/blob/main/README.md"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0197","name":"Open Monograph Press","vendor":"Public Knowledge Project (PKP)","category":"Education and knowledge","version":"Not specified","summary":"The official OMP README requires PHP and distinguishes PHP platform requirements from illustrative module version numbers.","scope":"Inventory record: PHP-0197\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected default-branch README: PHP >=8.2. Exact released OMP manifest and patch version pending.\nExtensions: Main-branch platform-check example lists bcmath, curl, dom, fileinfo, filter, ftp, gd, hash, intl, json, libxml, openssl, pcre, phar, session, simplexml, spl, tokenizer, xml, xmlwriter, zip, zlib. ctype/mbstring are polyfilled in that example; database driver and release-resolved modules remain unknown. Sample version numbers are not minimums.\nLimitations: Shared PKP library lineage and features overlap; CLI and web PHP configurations can differ. Native ctype/mbstring are not unconditionally required by the supplied polyfill example. Exact release modules and plugins remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Scholarly book submissions, review, press management and publishing\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: OMP, pkp/omp\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/pkp/omp"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0198","name":"Open Preprint Systems","vendor":"Public Knowledge Project (PKP)","category":"Education and knowledge","version":"Not specified","summary":"The official OPS README requires PHP for the preprint server and identifies web-versus-CLI configuration differences.","scope":"Inventory record: PHP-0198\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected default-branch README: PHP >=8.2. Exact released OPS manifest and patch version pending.\nExtensions: Main-branch platform-check example lists bcmath, curl, dom, fileinfo, filter, ftp, gd, hash, intl, json, libxml, openssl, pcre, phar, session, simplexml, spl, tokenizer, xml, xmlwriter, zip, zlib. ctype/mbstring are polyfilled in that example; database driver and release-resolved modules remain unknown. Sample version numbers are not minimums.\nLimitations: Shared PKP library lineage and features overlap; CLI and web PHP configurations can differ. Native ctype/mbstring are not unconditionally required by the supplied polyfill example. Exact release modules and plugins remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Preprint submissions, moderation, publication and author accounts\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: OPS, pkp/ops\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/pkp/ops"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0199","name":"Omeka Classic","vendor":"Corporation for Digital Scholarship / Omeka project","category":"Education and knowledge","version":"Not specified","summary":"The project provides version-specific PHP requirements and separately requires ImageMagick for image resizing.","scope":"Inventory record: PHP-0199\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: 3.2 requires PHP >=7.1; 3.2.1 documented compatible through PHP 8.5. Older 3.1 requirements differ and are not current deployment evidence.\nExtensions: Required in stated documentation/manifest: mysqli, exif\nLimitations: External ImageMagick does not establish the PHP imagick extension. Omeka Classic and Omeka S are separate applications; themes/plugins can add requirements. Exact release artifact not pinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Digital collections, uploaded objects, metadata, exhibits and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Omeka, Omeka Classic 3\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://omeka.org/classic/docs/Installation/System_Requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0200","name":"Omeka S","vendor":"Corporation for Digital Scholarship / Omeka project","category":"Education and knowledge","version":"Not specified","summary":"The 4.2 manual requires PHP for the server and PHP CLI for background jobs, with alternative image-processing backends.","scope":"Inventory record: PHP-0200\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and PHP CLI background jobs\nPHP version scope: Installation manual labelled latest 4.2: PHP >=8.1; PHP 8.4 supported from 4.2, not 4.1 or older.\nExtensions: Required in stated documentation/manifest: pdo, pdo_mysql, mbstring, xml. Conditional: Thumbnailing uses external ImageMagick OR PHP imagick OR PHP gd\nLimitations: The automatically detected CLI binary may differ from web PHP. Site modules, exact release artifact and enabled image backend remain unverified; no assumption that all alternatives are installed. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Linked-data collections, public sites, media, background jobs and administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Omeka S 4\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://omeka.org/s/docs/user-manual/install/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0201","name":"VuFind","vendor":"VuFind project / Villanova University","category":"Education and knowledge","version":"Not specified","summary":"The official dev manifest declares PHP and application/autoload namespaces, including web APIs and console components.","scope":"Inventory record: PHP-0201\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected dev composer.json requires PHP >=8.2; config.platform.php=8.2 is a dependency-resolution setting, not a deployment measurement.\nExtensions: Complete required extension set unknown\nLimitations: Composer provide entries for memcached, oci8, soap and sodium are not require entries and do not prove loaded extensions. Full native/transitive requirements and stable-release constraints remain unknown; the requirements wiki could not be fetched. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Library discovery, search APIs, user accounts and configured library-system integrations\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: vufind-org/vufind\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://github.com/vufind-org/vufind/blob/dev/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0202","name":"CollectiveAccess Providence","vendor":"Whirl-i-Gig / CollectiveAccess project","category":"Education and knowledge","version":"Not specified","summary":"The vendor requires PHP and PHP CLI, lists required distro packages and distinguishes optional native image/cache adapters from external tools.","scope":"Inventory record: PHP-0202\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and PHP CLI; exact web SAPI deployment-dependent\nPHP version scope: Moving system requirements: PHP >=8.2, recommended 8.4/8.5. Exact Providence release unresolved.\nExtensions: Required in stated documentation/manifest: gd, curl, zip, mbstring, intl, bcmath, gmp, opcache. Optional/recommended: posix. Conditional: Selected modules supplied by php-mysql and php-xml OS packages; exact module breakdown unresolved; gmagick with GraphicsMagick OR imagick with ImageMagick; external CLI alternatives exist; redis for configured Redis caching; memcached for configured Memcached caching\nLimitations: php-cli is a SAPI/package, not an extension; php-process is a distro-dependent package group. php-mysql/php-xml are not treated as exact native extension identities. Pawtucket is a separate optional front-end; its PHP requirement was not yet independently verified. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Collections cataloguing, metadata/media import, access controls and processing jobs\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Providence, CollectiveAccess cataloguing backend\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://docs.collectiveaccess.org/providence/user/setup/systemReq"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0203","name":"AtoM","vendor":"Artefactual Systems / AtoM project","category":"Education and knowledge","version":"Not specified","summary":"The 2.9 manual requires PHP for archival description software and distinguishes PHP modules from Elasticsearch, ImageMagick and other external services/tools.","scope":"Inventory record: PHP-0203\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: 2.9 requirements documentation: PHP 8.1/8.2/8.3 supported; note says 2.9.1 requires PHP >=8.0 and no PHP 7. Exact released constraints pending.\nExtensions: Required in stated documentation/manifest: curl, json, pdo, pdo_mysql, xsl. Optional/recommended: readline, memcache. Conditional: Documentation additionally names APC with apcu-bc; compatibility with the stated PHP 8 build is unresolved\nLimitations: The APC/apcu-bc entry is a documentation ambiguity, not proof that those modules are installed or compatible. Optional memcache is explicitly different from memcached. A 2.10 documentation navigation link is not a release requirement. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Archival descriptions, user access, imports, digital objects and search/index jobs\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Access to Memory, AtoM 2\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://accesstomemory.org/en/docs/2.9/admin-manual/installation/requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0204","name":"LimeSurvey Community Edition","vendor":"LimeSurvey GmbH / LimeSurvey project","category":"Education and knowledge","version":"Not specified","summary":"The CE installation manual binds PHP bands to major LS versions and separates conditional survey, mail, directory and archive features.","scope":"Inventory record: PHP-0204\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Manual revision 385498: LS 7.x PHP >=8.1.29, tested through 8.4; 6.x 8.1–8.3; 5.x 7.2.5–8.0; 3.x 5.5.9–7.4. Release state of each major line not independently verified.\nExtensions: Required in stated documentation/manifest: mbstring, curl. Conditional: Selected PDO database driver: pdo_mysql, pdo_pgsql, pdo_sqlsrv or pdo_dblib; manual also contains an unresolved invalid pdo_mysqli token; gd with FreeType for captcha/charts/editor images; imap for bounce tracking; ldap for participant import; zip for template/archive import and spreadsheet export; zlib for ComfortUpdate\nLimitations: The manual’s pdo_mysqli token is not adopted as a real PHP extension name. Default-module assumptions and legacy configuration advice are not a complete release manifest. The separate Cloud offering’s build/version is unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Survey responses, participant records, uploads, authentication and administration\nRelease pin: Official wiki page revision oldid=385498; immutable application source/artifact pin pending\nSource accessed: 2026-10-17\nAliases: LimeSurvey CE, LS CE\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://www.limesurvey.org/manual/Installation_-_LimeSurvey_CE","https://www.limesurvey.org/manual/index.php?title=Installation_-_LimeSurvey_CE&oldid=385498"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0205","name":"REDCap","vendor":"Vanderbilt University / REDCap Consortium","category":"Education and knowledge","version":"Not specified","summary":"Official requirements identify PHP on the institution-managed server and PHP SMTP configuration; browser users are separate clients.","scope":"Inventory record: PHP-0205\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Public technical requirements: PHP >=8.0.0 on Apache or IIS. Exact licensed application release/build and full module set unavailable in the public overview.\nExtensions: Complete required extension set unknown\nLimitations: The public requirements establish a runtime relationship, not a particular institution’s deployed build, health-data contents or compliance status. Licensed/internal community material was not accessed. On-premises versus cloud placement does not identify a provider PHP build. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Research data capture, survey/participant information, exports and privileged project administration\nRelease pin: Version-scoped/moving official documentation; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Research Electronic Data Capture\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached through publication, collection or survey imports, uploads or web requests could cause denial of service, disclosure or worker-level code execution. Confidential research responses, unpublished material and configured database credentials could be affected according to permissions. Isolation failure requires additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://projectredcap.org/software/requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0206","name":"bbPress","vendor":"bbPress community / WordPress project","category":"Education and knowledge","version":"Not specified","summary":"The official plugin listing gives PHP and WordPress requirements for the optional server-side forum plugin.","scope":"Inventory record: PHP-0206\nCategory: Education and knowledge\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0006\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Official registry version 2.6.20: PHP >=7.2 and WordPress >=6.0. Selected WordPress can require a higher effective floor.\nExtensions: Complete required extension set unknown\nLimitations: Plugin, WordPress and theme requirements overlap within the same server. Exact extension inheritance and release bytes are not verified; public installation counters were not collected. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: WordPress-hosted forum posts, users and moderator administration\nRelease pin: Registry-listed 2.6.20; immutable plugin artifact/hash pending\nSource accessed: 2026-10-17\nAliases: bbpress WordPress plugin\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://wordpress.org/plugins/bbpress/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0207","name":"BuddyPress","vendor":"BuddyPress community / WordPress project","category":"Education and knowledge","version":"Not specified","summary":"Trac r14231 bumps the 14.0 branch to 14.5.2 while retaining the PHP 5.6 declaration. The current plugin listing frames 7.4 as a hosting recommendation, clarifying the earlier apparent floor conflict.","scope":"Inventory record: PHP-0207\nCategory: Education and knowledge\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0006\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: BuddyPress 14.5.2 header at immutable SVN r14231 declares Requires PHP 5.6 and WordPress 6.1. Current installation prose RECOMMENDS PHP >=7.4; a recommendation is not the same hard minimum. Host WordPress adds independent requirements.\nExtensions: Complete required extension set unknown\nLimitations: Source revision pins a declaration, not tested effective compatibility or verified plugin archive bytes. No recommendation to deploy end-of-life PHP 5.6. Selected WordPress, dependencies and security maintenance remain separate. Multisite is not tenant-escape evidence. No browser PHP, deployed build, exploitation or installation count inferred.\nPatch owner: PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates\nDownstream surface: Community profiles, activity, groups, private messages and WordPress integration\nRelease pin: Immutable BuddyPress SVN revision 14231 on branches/14.0, 14.5.2 version bump dated 29 July 2026; archive bytes/signatures unverified\nSource accessed: 2026-10-18\nAliases: buddypress WordPress plugin\nConditional downstream consequence: If a matching PHP flaw is reachable through forum requests, attachments or import operations, consequences could include denial of service, disclosure or worker-level code execution. Access to messages, account data, moderation functions or credentials depends on actual permissions. This is not a confirmed product vulnerability or tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for the runtime; application/component maintainer and deploying institution/operator for application updates","links":["https://buddypress.trac.wordpress.org/changeset/14231","https://wordpress.org/plugins/buddypress/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0208","name":"ownCloud Server 10","vendor":"ownCloud / Kiteworks","category":"Collaboration and storage","version":"Not specified","summary":"The versioned vendor requirements identify PHP 7.4 for the classic server branch.","scope":"Inventory record: PHP-0208\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache 2.4 prefork/mod_php in the documented environment; alternate deployed SAPIs not measured\nPHP version scope: 10.16 system requirements explicitly list PHP 7.4 and Apache 2.4 prefork/mod_php; separate from the Docker-only Classic 11 line.\nExtensions: Full required extension set unknown\nLimitations: This records a relevant legacy runtime boundary, not an observed PHP 7.4 installation or an upstream PHP security-support claim. Classic 10 and 11 migrations overlap installations; Infinite Scale has a different implementation. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: File access/sharing, authentication, server apps and management\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: ownCloud Classic 10, ownCloud Server 10.16\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://doc.owncloud.com/server/10.16/admin_manual/installation/system_requirements.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0209","name":"Pydio 8 Enterprise Distribution","vendor":"Pydio","category":"Collaboration and storage","version":"Not specified","summary":"The vendor’s legacy Enterprise guide explicitly requires PHP, modules and ionCube, and recommends a PHP CLI path.","scope":"Inventory record: PHP-0209\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: PHP web runtime; PHP CLI recommended for background commands; ionCube loaded as zend_extension for the Enterprise edition\nPHP version scope: Version-8 Enterprise documentation: PHP >=5.6, recommended 7.0; this is the legacy PHP line, not current Pydio Cells.\nExtensions: Required in stated source scope: mbstring, gd, intl, ionCube Loader. Optional/recommended: apc, apcu. Conditional/ambiguous: DOM/XML support documented as dom-xml; precise module/package naming unresolved; MySQL, PostgreSQL or SQLite PHP driver matching the selected database; openssl OR legacy mcrypt for this old scope; opcache OR equivalent opcode cache\nLimitations: The edition-specific 5.6 floor is not asserted for every historical community release. Pydio Cells is a Go rewrite. Historical-only describes the evidence/product line, not proof that legacy deployments disappeared. No old configuration is recommended. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Legacy enterprise file sharing, plugins and background commands\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Pydio Enterprise Distribution 8, Legacy PHP Pydio\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://docs.pydio.com/pydio-v8/admin-guide/installation-guide/pydio-requirements/","https://github.com/pydio/cells"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0210","name":"FileRun","vendor":"FileRun","category":"Collaboration and storage","version":"Not specified","summary":"The vendor identifies FileRun as PHP software and separates installation-blocking modules from feature-dependent additions.","scope":"Inventory record: PHP-0210\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Moving requirements: PHP 8.3/8.4/8.5 on 64-bit systems; 8.4/8.5 preferred. ionCube >=14.4 for PHP 8.3/8.4 and >=15.5.0 for PHP 8.5.\nExtensions: Required in stated source scope: pdo_mysql, openssl, mbstring, ionCube Loader. Optional/recommended: zip, curl, exif, imagick, opcache. Conditional/ambiguous: xml OR xmlwriter for WebDAV and desktop/mobile sync; proc_open function for external ImageMagick/FFmpeg/LibreOffice; these programs are not PHP extensions\nLimitations: Exact FileRun release and encoded build remain unpinned. Loader compatibility is part of the runtime boundary. Browser/sync clients do not thereby embed PHP; external preview programs remain separate. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Private files, shares, WebDAV, online-editor integrations and previews\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: FileRun self-hosted file manager\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://docs.filerun.com/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0211","name":"FileCloud Server PHP installation and maintenance","vendor":"FileCloud","category":"Collaboration and storage","version":"Not specified","summary":"Official upgrade instructions invoke the XAMPP php.exe post-upgrade script and identify PHP web-install and multi-tenant administration files.","scope":"Inventory record: PHP-0211\nCategory: Collaboration and storage\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled Windows PHP CLI for fcpostupgrade.php; web installation/admin PHP scripts; exact production web SAPI unresolved\nPHP version scope: Current Windows upgrade guide explicitly uses bundled XAMPP PHP CLI, php.ini and PHP web-install paths. Exact FileCloud release and PHP build/version not identified.\nExtensions: Full required extension set unknown\nLimitations: The evidence is confined to named server installation/maintenance components. It does not establish the implementation of every FileCloud backend, native client, Online tenant or current build. Multi-tenancy documentation is not proof of tenant escape. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: FileCloud for supplied server/PHP bundles and maintenance code; deploying operator for applying and restarting updated components\nDownstream surface: Server installation, post-upgrade maintenance and multi-tenant administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: FileCloud Server PHP components, FileCloud Windows server installation\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"FileCloud for supplied server/PHP bundles and maintenance code; deploying operator for applying and restarting updated components","links":["https://docs.filecloud.com/fcdoc/latest/server/upgrade-filecloud/upgrade-using-update-tool-windows-only"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0212","name":"FileSender","vendor":"FileSender project","category":"Collaboration and storage","version":"Not specified","summary":"The 3.x installation guide requires PHP, identifies web/CLI paths and a separately installed SimpleSAMLphp authentication dependency.","scope":"Inventory record: PHP-0212\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache PHP module or nginx PHP-FPM (fpm-fcgi); PHP CLI database upgrades/maintenance\nPHP version scope: Moving 3.x Linux installation guide: PHP >=8.4; SimpleSAMLphp >=2.4.9. Exact released application constraint and older 2.x bands remain unpinned.\nExtensions: Required in stated source scope: mbstring, xml, json, intl. Conditional/ambiguous: Database connector for PostgreSQL or MySQL/MariaDB; distro packages differ\nLimitations: The guide contains old PHP-path examples, which are not compatibility claims. SimpleSAMLphp has its own patch/requirements boundary. Release artifacts, all native modules and specific research-network deployments were not verified. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Large-file uploads/download links, recipient metadata, federation and maintenance\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: filesender/filesender, FileSender 3\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://docs.filesender.org/filesender/v3.0/install/","https://filesender.org/software/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0213","name":"ProjectSend","vendor":"ProjectSend project","category":"Collaboration and storage","version":"Not specified","summary":"The current source installation guide lists PHP web/CLI requirements; LDAP is required even without configured LDAP use.","scope":"Inventory record: PHP-0213\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-FPM and PHP CLI, both >=8.4 in inspected main guide\nPHP version scope: Inspected main INSTALL.md: PHP >=8.4 for CLI and FPM. Older public requirements guide says >=8.1; these are separate unresolved release/branch scopes.\nExtensions: Required in stated source scope: bcmath, ctype, curl, dom, fileinfo, filter, gd, iconv, intl, json, ldap, mbstring, openssl, pcntl, pdo_mysql, session, simplexml, tokenizer, zip\nLimitations: The newer source guide is not treated as proof of a released stable build. Its PHP floor differs from the older site guide. Web-server download offload still follows a PHP permission check; it does not remove the application runtime. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Client file exchange, uploads, permissions, downloads, queues and scheduled tasks\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: projectsend/projectsend\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/projectsend/projectsend/blob/main/INSTALL.md","https://docs.projectsend.org/about/installation/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0214","name":"FileGator","vendor":"FileGator project","category":"Collaboration and storage","version":"Not specified","summary":"The project requires a PHP web server and ZIP; its sample distro installation also installs mbstring, DOM and XML packages.","scope":"Inventory record: PHP-0214\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Moving installation documentation: PHP >=8.1 with ZIP. Exact application release and full resolved modules unpinned.\nExtensions: Required in stated source scope: zip\nLimitations: Sample OS package commands are not treated as a complete mandatory module manifest. The web document root and Docker build are separately configured; no image or installation script was executed. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Web file management, uploads, archive handling and account permissions\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: filegator/filegator\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://docs.filegator.io/install.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0215","name":"ResourceSpace","vendor":"Montala / ResourceSpace","category":"Collaboration and storage","version":"Not specified","summary":"The vendor identifies PHP as the server language, gives per-release bands and required distro packages, and separates external media tools.","scope":"Inventory record: PHP-0215\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and PHP CLI; exact web SAPI deployment-dependent\nPHP version scope: Requirements matrix: <=10.5 lists PHP 7.4–8.3; 10.6/10.7 list 8.1–8.4; from 11 lists 8.2–8.5. Matrix columns are not installed-build measurements.\nExtensions: Required in stated source scope: mysqli, curl, dom, gd, intl, mbstring, xml, zip, ldap, imap, json, apcu\nLimitations: php-cli is a SAPI/package, not a native extension. From v11, released vendor trees and source Composer installs differ. Exact release pin, extension packaging and activated external conversions remain unresolved. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Digital assets, metadata, uploads, previews, shared content and administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: ResourceSpace DAM\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://www.resourcespace.com/knowledge-base/systemadmin/general_requirements?from_rs=true"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0216","name":"SeedDMS","vendor":"Uwe Steinmann / SeedDMS project","category":"Collaboration and storage","version":"Not specified","summary":"The project identifies a PHP-based document-management application with MySQL, SQLite or PostgreSQL and separately publishes two branch families.","scope":"Inventory record: PHP-0216\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Official About page confirms PHP; download page advertises 6.0.41 and 5.1.48 in two maintained branch families. Exact PHP/module minima for those releases unknown.\nExtensions: Full required extension set unknown\nLimitations: No numeric PHP minimum is inferred from third-party mirrors or old manuals. The two branches overlap a product family and are not separate installation totals. Released quickstart contents and extension requirements remain unpinned. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Documents, versioning/workflows, metadata, access control and optional extensions\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: SeedDMS 6.0, SeedDMS 5.1\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://www.seeddms.org/about/","https://www.seeddms.org/download/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0217","name":"OpenDocMan","vendor":"OpenDocMan project","category":"Collaboration and storage","version":"Not specified","summary":"The source manifest requires PHP, while official README and website requirements show different generations of guidance.","scope":"Inventory record: PHP-0217\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and documented PHP CLI migration entry point; exact web SAPI deployment-dependent\nPHP version scope: Inspected master composer.json: PHP >=8.4. Repository README says 8.2; old website documentation says PHP 5. Exact released floor unresolved.\nExtensions: Full required extension set unknown\nLimitations: Use the inspected branch constraint only for that source scope. Neither the old PHP 5 website text nor README 8.2 establishes the current released minimum. Compliance-oriented product wording is not proof of any deployment’s certification. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Controlled documents, access/workflow, upload/review and database migrations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: opendocman/opendocman\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/opendocman/opendocman/blob/master/composer.json","https://github.com/opendocman/opendocman","https://www.opendocman.com/documentation/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0218","name":"EGroupware","vendor":"EGroupware GmbH / EGroupware project","category":"Collaboration and storage","version":"Not specified","summary":"The publisher manifest declares PHP, runtime extensions, optional modules and separately versioned suite packages.","scope":"Inventory record: PHP-0218\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and PHP CLI installation/setup tools; exact web SAPI deployment-dependent\nPHP version scope: Publisher registry 26.10.20261016.2, dated 16 October 2026 15:33 UTC: literal PHP >=8.2,<=8.5. Master manifest agrees; exact range semantics retained literally.\nExtensions: Required in stated source scope: gd, json, mysqli, openssl, pdo, session, xml, xsl. Optional/recommended: apcu, bz2, mbstring, opcache, tidy, zip. Conditional/ambiguous: ldap for LDAP/Active Directory access; Legacy mhash capability is suggested by metadata; separate native module presence/availability is unresolved\nLimitations: Direct module declarations are not a complete transitive inventory. The suite’s Collabora and Rocket.Chat integration packages do not prove PHP in those remote server cores. Suite components and deployed instances overlap. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Mail, contacts, calendars, shared files, authentication and groupware administration\nRelease pin: 26.10.20261016.2; registry-advertised source reference ffd0d43b484847b8d66450fcedf6a82b92d7c246\nSource accessed: 2026-10-17\nAliases: egroupware/egroupware, EGroupware 26\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://packagist.org/packages/egroupware/egroupware","https://github.com/EGroupware/egroupware/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0219","name":"tine groupware","vendor":"Metaways / tine project","category":"Collaboration and storage","version":"Not specified","summary":"The project requires PHP for the groupware server and lists mandatory and optional modules separately from browser/native clients.","scope":"Inventory record: PHP-0219\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Moving main requirements page: from 2023.11 PHP >=8.0; same page suggests 8.0–8.1 and generically claims support for officially supported PHP. Current exact release matrix unresolved.\nExtensions: Required in stated source scope: json, gd, date, spl, simplexml, ctype, dom, openssl, iconv, zip, xml, hash, mbstring, bcmath, intl. Optional/recommended: redis, ldap, memcache\nLimitations: The page mixes old fixed suggestions with a broad support statement; neither proves compatibility with every current PHP branch. Container contents, current released minima and the MySQL/MariaDB connector remain unverified. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Mail/calendar/contacts, shared records, integrations and server administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Tine 2.0, tine-groupware/tine\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://docs.tine-groupware.de/main/operators/System_Requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0220","name":"Kopano WebApp","vendor":"Kopano / Kopano-dev","category":"Collaboration and storage","version":"Not specified","summary":"The official WebApp mirror explicitly lists PHP server dependencies and a separate native MAPI interface.","scope":"Inventory record: PHP-0220\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Official read-only mirror README requires PHP, json/xml/gettext and php-mapi; exact PHP version and current WebApp release unpinned.\nExtensions: Required in stated source scope: json, xml, gettext, mapi. Conditional/ambiguous: gd for image-related functions\nLimitations: This identifies the PHP web application, not the whole native Kopano server or DeskApp client. The mirror can lag upstream release artifacts; PHP floor and exact module ABI remain unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Webmail, contacts/calendar, MAPI access and applicable image handling\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: kopano-webapp, Zarafa WebApp lineage\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/Kopano-dev/kopano-webapp"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0221","name":"grommunio Web","vendor":"grommunio GmbH","category":"Collaboration and storage","version":"Not specified","summary":"The project separates its PHP server from JavaScript/CSS, requires the Gromox MAPI extension and says released packages contain a built tree.","scope":"Inventory record: PHP-0221\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime, preferably PHP-FPM in the official README; PHP also used for source builds\nPHP version scope: Inspected master README: PHP >=8.2 and mapi extension provided by Gromox. Exact released PHP/MAPI ABI unpinned.\nExtensions: Required in stated source scope: mapi\nLimitations: Only the Web subsystem is established as PHP. The Gromox native server, administration interfaces and Desktop shell require separate evidence. Public SBOM files are advertised but were not fully inventoried in this pass. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Webmail, shared calendars/contacts, attachments, plugins and MAPI-connected user data\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: grommunio-web\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/grommunio/grommunio-web"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0222","name":"Horde Groupware Webmail Edition 5","vendor":"Horde Project","category":"Collaboration and storage","version":"Not specified","summary":"The official legacy Webmail manifest identifies the PHP groupware/webmail bundle and its Horde dependency.","scope":"Inventory record: PHP-0222\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected master legacy webmail manifest declares literal PHP ^5.3 and Horde ^5.1.5. This is not Horde 6 documentation or modern PHP compatibility proof.\nExtensions: Full required extension set unknown\nLimitations: Current Horde 6 documentation and package-registry pages could not be retrieved. A legacy master branch is not assumed to describe current releases. Historical-only does not mean no old deployments remain; full extensions and exact 5.x release pins are unknown. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Legacy webmail, calendar, contacts, tasks and groupware authentication\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: horde/webmail legacy, Horde Webmail 5\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/horde/webmail/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0223","name":"PrivateBin","vendor":"PrivateBin project","category":"Collaboration and storage","version":"Not specified","summary":"The official manifest requires PHP; the project separately states that paste encryption/decryption occurs in the browser.","scope":"Inventory record: PHP-0223\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected master composer.json: literal PHP ^7.4 || ^8.0. Exact release and complete native-module requirements unpinned.\nExtensions: Full required extension set unknown\nLimitations: Browser encryption is not PHP inside the browser. Reading stored ciphertext alone does not automatically reveal paste plaintext. Runtime, delivered JavaScript and future client visits are distinct trust boundaries. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Encrypted-paste storage, access metadata and JavaScript served to browser clients\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: PrivateBin/PrivateBin\nConditional downstream consequence: A matching reachable PHP flaw could disrupt the service, expose metadata/ciphertext or permit tampering with responses. As the project warns, a compromised server can send malicious JavaScript to capture keys when users subsequently open paste URLs. PHP compromise alone does not establish decryption of every stored paste.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/PrivateBin/PrivateBin/blob/master/composer.json","https://github.com/PrivateBin/PrivateBin"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0224","name":"Passbolt API server","vendor":"Passbolt SA","category":"Collaboration and storage","version":"Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0224\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime / PHP-FPM as documented; PHP CLI installation/maintenance\nPHP version scope: Public source-install guide: PHP >=8.2.0. Exact Passbolt release/build, edition differences and resolved extension constraints remain unpinned.\nExtensions: Required in stated source scope: gnupg, intl, mbstring, simplexml, mysqlnd, pdo, pdo_mysql, xsl, phar, posix, xml, zlib, ctype, curl, json. Conditional/ambiguous: gd OR imagick for image manipulation; ldap is listed in the guide without a feature condition; edition/feature necessity unresolved; Configured session-cache extension if selected\nLimitations: The source-install guide is not an installed API build. Native GnuPG and the PHP binding have separate versions. Browser-extension/client key handling constrains plaintext-secret consequences; hosted Passbolt Cloud internals are not inferred. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Credential-sharing API, authentication, server OpenPGP key material and administrative configuration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Passbolt Community Edition server, passbolt/passbolt_api\nConditional downstream consequence: A matching reachable PHP flaw could cause denial of service, disclose metadata or server-side configuration/key material, or permit tampering with application responses. Disclosure of plaintext vault contents depends on the actual key handling, authentication and client trust boundaries; encryption does not make all stored plaintext automatically available to a compromised worker.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://www.passbolt.com/docs/hosting/install/ce/from-source/","https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in progress.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2\nAction statement: Pull and redeploy the patched image, or update the existing instance's PHP packages and restart PHP services. Verify the actual deployment, not just the Passbolt application version."},"CVE-2026-109619":{"status":"Fix","notes":"Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in progress.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.passbolt.com/incidents/critical-php-vulnerabilities-cvss-9-2\nAction statement: Pull and redeploy the patched image, or update the existing instance's PHP packages and restart PHP services. Verify the actual deployment, not just the Passbolt application version."}}},{"id":"PHP-0225","name":"TeamPass","vendor":"TeamPass project","category":"Collaboration and storage","version":"Not specified","summary":"The project identifies a PHP/MySQL credential vault, lists native modules and separates the server from a browser extension.","scope":"Inventory record: PHP-0225\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Current project README and master manifest: PHP >=8.2; README says tested against 8.3. Exact release tag/build unpinned.\nExtensions: Required in stated source scope: openssl, mysqli, mbstring, bcmath, iconv, xml, gd, curl, gmp. Conditional/ambiguous: ldap for LDAP/Active Directory\nLimitations: Native modules are from the README plus a direct manifest subset, not a complete locked dependency graph. Per-user encryption/key distribution means server-worker access is not automatically proof that every plaintext secret can be decrypted. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Collaborative secrets, key distribution, authentication, audit records and administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Teampass, nilsteampassnet/TeamPass\nConditional downstream consequence: A matching reachable PHP flaw could cause denial of service, disclose metadata or server-side configuration/key material, or permit tampering with application responses. Disclosure of plaintext vault contents depends on the actual key handling, authentication and client trust boundaries; encryption does not make all stored plaintext automatically available to a compromised worker.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nilsteampassnet/TeamPass","https://github.com/nilsteampassnet/TeamPass/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0226","name":"AfterLogic WebMail Lite PHP","vendor":"AfterLogic","category":"Collaboration and storage","version":"Not specified","summary":"The vendor requirements were re-read: PHP >=7.4 and mysqlnd-backed database access apply to the Lite PHP webmail application, separately from its mail services and other editions.","scope":"Inventory record: PHP-0226\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Moving WebMail Lite PHP requirements: PHP >=7.4; mysqlnd database driver. Exact release and full extension list unknown.\nExtensions: Required in stated source scope: mysqlnd\nLimitations: This record is the PHP product, not the separately named ASP.NET edition or every AfterLogic service. The page still names old operating systems; numeric PHP compatibility is not an assertion of upstream security support. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Webmail authentication, messages, attachments and IMAP/SMTP credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: WebMail Lite PHP, Afterlogic Aurora WebMail Lite, afterlogic/webmail-lite\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://afterlogic.com/docs/webmail-lite/system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0227","name":"Shaarli","vendor":"Shaarli community","category":"Collaboration and storage","version":"Shaarli Docker distribution awaiting a patched Alpine base at review time","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0227\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected master manifest: PHP >=7.4, json and zlib. Exact current release/upper compatibility unpinned.\nExtensions: Required in stated source scope: json, zlib. Optional/recommended: curl, gd, gettext, intl, mbstring\nLimitations: The Composer resolution setting php=8.2 is not a deployed version or the declared runtime minimum. Optional thumbnail/fetching features are not automatically enabled; shared bookmarks can contain private data despite public-service use. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Private/shared bookmarks, thumbnails, feeds and authentication\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: shaarli/Shaarli\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by requests or content processing could cause denial of service, disclosure or worker-level code execution and alter stored/shared content within its permissions. Desktop/mobile compromise, host privilege and tenant escape require additional evidence.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/shaarli/Shaarli/blob/master/composer.json","https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Shaarli's maintainer confirms that its Docker distribution needs the Alpine PHP security fix and that a new release is pending. This finding is scoped to the container runtime, not a Shaarli application-code defect.","action":"Apply a vendor-confirmed patched runtime or rebuilt Shaarli image when available; restrict exposure until then.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435"},"CVE-2026-109619":{"status":"Vulnerable","notes":"Shaarli's maintainer confirms that its Docker distribution needs the Alpine PHP security fix and that a new release is pending. This finding is scoped to the container runtime, not a Shaarli application-code defect.","action":"Apply a vendor-confirmed patched runtime or rebuilt Shaarli image when available; restrict exposure until then.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/shaarli/Shaarli/issues/2297#issuecomment-6320488435"}}},{"id":"PHP-0228","name":"Nextcloud Talk server app","vendor":"Nextcloud","category":"Collaboration and storage","version":"Not specified","summary":"The official application manifest contains a production PHP namespace/autoload tree and runtime dependencies, distinct from development tools.","scope":"Inventory record: PHP-0228\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main manifest autoloads OCA\\Talk PHP classes and runtime packages. config.platform.php=8.3 is a resolution target, not an independently verified PHP minimum; selected Nextcloud/Talk releases determine effective requirements.\nExtensions: Full required extension set unknown\nLimitations: The PHP app is separate from signaling/high-performance backends, TURN/media services and native/mobile clients. Neither their implementation nor a combined PHP minimum is inferred from the app’s Composer platform setting. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Chat/call application state, rooms, messages, authentication and integration secrets\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: spreed, nextcloud/spreed\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/spreed/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0229","name":"Nextcloud Calendar server app","vendor":"Nextcloud Calendar project","category":"Collaboration and storage","version":"Not specified","summary":"The prior release-publisher version pin is retained. A dated official FreeBSD ports commit independently records Calendar 6.6.2 and its advertised source-archive checksum; it does not supply the missing app/core PHP compatibility pair.","scope":"Inventory record: PHP-0229\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main composer require.php is literally >= 8.1 <=8.5. Exact Calendar/Nextcloud release pairing and patch-level upper-bound interpretation unpinned. Release-publisher commit confirms Calendar 6.6.2 version/date, not its PHP/Nextcloud compatibility pair.\nExtensions: Full required extension set unknown\nLimitations: The component cannot lower Nextcloud core’s floor. An app version bump and packaging checksum do not establish a supported Calendar/Nextcloud pair. App-store reads timed out and the full pinned appinfo manifest remains unread. Keep Nextcloud Calendar, ext/calendar and core CalDAV separate. No installed build, loaded modules, affected flaw or deployment total measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Calendar web app, scheduling data, DAV-backed integrations and shared calendars\nRelease pin: Calendar 6.6.2 publisher version commit 1b34383d4cb89ae1f2312caad20677e5c7797285 retained. FreeBSD packaging commit e5604070f028f20fc50d9fac7862af54d5691c1d, 1 October 2026; archive bytes unverified.\nSource accessed: 2026-10-19\nAliases: calendar, nextcloud/calendar\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://lists.freebsd.org/archives/dev-commits-ports-main/2026-October/215291.html","https://github.com/nextcloud/calendar/blob/main/composer.json","https://github.com/nextcloud/calendar/blob/main/README.md","https://github.com/nextcloud-releases/calendar/releases","https://github.com/nextcloud-releases/calendar/commit/1b34383d4cb89ae1f2312caad20677e5c7797285","https://github.com/nextcloud/calendar/releases"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0230","name":"Nextcloud Contacts server app","vendor":"Nextcloud Contacts project","category":"Collaboration and storage","version":"Not specified","summary":"The official app manifest declares its PHP runtime constraint separately from development dependencies and the Composer platform target.","scope":"Inventory record: PHP-0230\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main manifest require.php is literally >=8.1 <=8.4. Exact app/core release pairing remains unknown; retain the literal bound.\nExtensions: Full required extension set unknown\nLimitations: A stale or moving component upper bound is not a current Nextcloud-family support matrix. Core can require a higher floor, and independently paired versions must be checked. CardDAV/mobile clients are separate. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Address books, shared contacts and web/DAV-backed contact operations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: contacts, nextcloud/contacts\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/contacts/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0231","name":"Nextcloud Mail server app","vendor":"Nextcloud Mail project","category":"Collaboration and storage","version":"Not specified","summary":"The app manifest declares PHP and OpenSSL plus separate mail-processing libraries; its README requires a Nextcloud server and PHP dependency management.","scope":"Inventory record: PHP-0231\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main manifest: literal PHP >=8.1 <=8.4 and openssl; exact app/core versions and transitive module graph unpinned.\nExtensions: Required in stated source scope: openssl\nLimitations: This is a PHP webmail integration, not proof that its remote IMAP/SMTP/JMAP servers use PHP. Current Nextcloud core requirements can be stricter; the component’s moving upper bound is not generalized to all Mail releases. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Messages, attachments, mail credentials and webmail processing\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: mail, nextcloud/mail\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached by web/API, message or attachment processing could cause denial of service, disclosure or code execution within the PHP worker. Mail, contacts, calendar data and configured authentication/service credentials could then be affected according to permissions. Native mail servers, desktop clients and tenant boundaries are separate components.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/mail/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0232","name":"Nextcloud Deck","vendor":"Nextcloud Deck project","category":"Collaboration and storage","version":"Not specified","summary":"The official repository explicitly documents PHP dependency installation and PHP tooling for the Deck app.","scope":"Inventory record: PHP-0232\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI / Composer installation and lint/test tooling; deployed app web SAPI unverified\nPHP version scope: Main README instructs installation of PHP dependencies with --no-dev; Composer defines PHP lint/unit/integration tools and platform.php=8.3. That platform setting is not a runtime minimum.\nExtensions: Full required extension set unknown\nLimitations: Direct backend-controller reads failed. Record the observed PHP build/tooling phase without upgrading it to a verified server/runtime constraint or inferring PHP inside the separate Android client. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Application dependency/build/lint/test process and accessible development credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: deck, nextcloud/deck\nConditional downstream consequence: A matching PHP flaw reached during dependency resolution, linting or tests could affect the development/CI process and its accessible files or credentials. This phase evidence does not establish a deployed PHP service, request-time reachability or a production compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/deck","https://github.com/nextcloud/deck/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0233","name":"Nextcloud Office integration app","vendor":"Nextcloud","category":"Collaboration and storage","version":"Not specified","summary":"The official integration app has PHP runtime dependencies distinct from its development tools and the external document-editing server.","scope":"Inventory record: PHP-0233\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main richdocuments manifest requires json/simplexml and production PHP packages; platform.php=8.3 is not independently a runtime floor. Exact app/core pairing unresolved.\nExtensions: Required in stated source scope: json, simplexml\nLimitations: A PHP integration app does not establish PHP in Collabora Online’s document server, a bundled CODE service or browser editor. Exact WOPI-server implementation/build and app/runtime versions require separate evidence. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Document-editing integration, permissions, callbacks, document URLs and WOPI configuration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: richdocuments, Collabora Online for Nextcloud, Nextcloud Office PHP integration\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/richdocuments/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0234","name":"ONLYOFFICE integration for Nextcloud","vendor":"Ascensio System SIA / ONLYOFFICE","category":"Collaboration and storage","version":"Not specified","summary":"The vendor connector manifest requires PHP; the repository separately describes a required ONLYOFFICE Document Server.","scope":"Inventory record: PHP-0234\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected master connector manifest: PHP >=8.2 <8.6 and firebase/php-jwt. Exact connector/core/document-server versions unpinned.\nExtensions: Full required extension set unknown\nLimitations: This server-side connector is distinct from Document Server and JavaScript browser editors. No remote office-service backend PHP is inferred; core requirements can raise the effective PHP floor. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Office integration, signed tokens, document access and callbacks\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: onlyoffice-nextcloud, Nextcloud ONLYOFFICE connector\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reachable through requests, uploads, previews or archive handling could cause denial of service, disclosure or worker-level code execution. The worker’s actual file, database and configured-service permissions determine possible document loss, alteration or credential access. Host compromise, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/ONLYOFFICE/onlyoffice-nextcloud/blob/master/composer.json","https://github.com/ONLYOFFICE/onlyoffice-nextcloud"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0235","name":"Nextcloud Collectives server app","vendor":"Nextcloud Collectives project","category":"Collaboration and storage","version":"Not specified","summary":"The official manifest separates PHP runtime requirements and collaboration libraries from development-only DOM and test tools.","scope":"Inventory record: PHP-0235\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately documented\nPHP version scope: Inspected main runtime requirements: PHP ^8.2, json and pdo. DOM appears under require-dev, not in that direct runtime subset.\nExtensions: Required in stated source scope: json, pdo\nLimitations: Core and installed companion apps may add requirements. The direct manifest does not prove a native DOM runtime requirement for this app alone, nor a current deployed app/core version pair. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Collaboratively edited pages, shared knowledge, search/index metadata and access controls\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: collectives, nextcloud/collectives\nConditional downstream consequence: A matching PHP parser or memory-safety flaw reached by requests or content processing could cause denial of service, disclosure or worker-level code execution and alter stored/shared content within its permissions. Desktop/mobile compromise, host privilege and tenant escape require additional evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/collectives/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0236","name":"Nextcloud Notes","vendor":"Nextcloud Notes project","category":"Collaboration and storage","version":"Not specified","summary":"The official Notes manifest confirms PHP development tooling and distinguishes require-dev from a Composer resolution target.","scope":"Inventory record: PHP-0236\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI lint/test/static-analysis tooling (not run); production web SAPI unverified\nPHP version scope: Inspected main manifest contains PHP development packages/scripts and platform.php=8.2, but no direct runtime require.php. Exact deployed backend/runtime constraint unresolved.\nExtensions: Full required extension set unknown\nLimitations: Controller/source-tree retrieval failed. The App Store identifies Notes as an app but does not itself prove its backend implementation or PHP floor. Development evidence is not silently promoted to runtime evidence. PHP presence does not establish an affected build, reachable flaw or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes\nDownstream surface: Application PHP development/lint/test processes and accessible CI credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: notes, nextcloud/notes\nConditional downstream consequence: A matching PHP flaw reached during dependency resolution, linting or tests could affect the development/CI process and its accessible files or credentials. This phase evidence does not establish a deployed PHP service, request-time reachability or a production compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; component/app maintainer and deploying operator for application changes","links":["https://github.com/nextcloud/notes/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0237","name":"SuiteCRM","vendor":"SalesAgility / SuiteCRM project","category":"Business applications","version":"Not specified","summary":"Version-specific SuiteCRM 7 and 8 compatibility tables explicitly identify the PHP server runtime.","scope":"Inventory record: PHP-0237\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Official matrices: 7.15.x PHP 8.1/8.2/8.3/8.4; 7.14.x 8.1/8.2. For 8.10.x: 8.2/8.3/8.4; 8.8.x–8.9.x: 8.1/8.2/8.3. Other rows have separate older constraints.\nExtensions: Full required extension set unknown\nLimitations: One product-family relationship covers overlapping major lines, not separate installations. Angular/Node/yarn entries are frontend development requirements, not PHP inside the browser. Exact released modules and source pins remain open. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Customer records, workflows, imports, files and CRM administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: SuiteCRM 7, SuiteCRM 8\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://docs.suitecrm.com/8.x/admin/compatibility-matrix/","https://docs.suitecrm.com/admin/compatibility-matrix/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0238","name":"Sugar application server","vendor":"SugarAI / SugarCRM","category":"Business applications","version":"Not specified","summary":"The vendor’s supported-platforms page explicitly lists PHP among application server requirements, separately from end-user browser requirements.","scope":"Inventory record: PHP-0238\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache 2.4 or documented Windows/IIS server environment; exact PHP handler not specified\nPHP version scope: Vendor server matrices: Sugar 26.1.x supports PHP 8.4/8.5; 25.1.x supports 8.3/8.4. The same page identifies Enterprise-specific database choices.\nExtensions: Full required extension set unknown\nLimitations: Scope is the documented Sugar application/server matrix, including listed Enterprise server cases. It does not establish the backend of every SugarCloud, Discover, Insights or other vendor service. Exact licensed build, edition/module set and native extensions remain unknown. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: CRM data, application server administration, APIs and integrations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: SugarCRM application server, Sugar supported server platforms\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://support.sugarai.com/resources/supported_platforms/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0239","name":"EspoCRM","vendor":"EspoCRM project","category":"Business applications","version":"Not specified","summary":"The project explicitly requires PHP and distinguishes mandatory extensions, database alternatives and optional feature modules.","scope":"Inventory record: PHP-0239\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Moving server-configuration guide lists PHP 8.3–8.5; no immutable application release identified.\nExtensions: Required in stated source scope: gd (with FreeType), openssl, zip, mbstring, iconv, curl, xml, xmlwriter, exif, bcmath. Conditional/ambiguous: pdo_mysql OR pdo_pgsql, matching the selected database; zmq for WebSocket features; pcntl for parallel jobs/daemon on Unix; posix for Unix-related features; ldap for LDAP authentication; ev for high-connection WebSocket use\nLimitations: Feature-specific modules are not universally loaded. The moving guide is not an installed build measurement or a claim about separate mobile/browser clients. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: CRM records, attachments, automation, authentication and optional WebSocket service\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: EspoCRM self-hosted server\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://docs.espocrm.com/administration/server-configuration/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0240","name":"Dolibarr ERP CRM","vendor":"Dolibarr project","category":"Business applications","version":"Not specified","summary":"The official release compatibility table supplies version-specific PHP boundaries; the repository identifies a PHP web application with JavaScript enhancements.","scope":"Inventory record: PHP-0240\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Official release table: 24.0.0 (2026-08-20) PHP 7.2 minimum / 8.5 maximum; 23.0.0–23.0.3 PHP 7.2 / 8.4. These are documented compatibility endpoints, not security-support recommendations.\nExtensions: Full required extension set unknown\nLimitations: The versioned table does not pin immutable released bytes, native modules or every third-party module. Its disabled Composer manifest is not treated as proof that Composer installation is required. JS enhancements do not mean browser PHP. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: ERP, accounting, CRM, uploads, documents and application modules\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Dolibarr, Dolibarr 24\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://wiki.dolibarr.org/index.php/Releases","https://github.com/Dolibarr/dolibarr"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0241","name":"OroCRM Community Edition application","vendor":"Oro, Inc.","category":"Business applications","version":"Not specified","summary":"The product-specific package metadata confirms PHP for the CRM Community application and distinguishes it from Enterprise, Commerce and Platform distributions.","scope":"Inventory record: PHP-0241\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Publisher registry advertises 7.0.4 (2026-08-07): PHP ~8.5.0 and oro/crm 7.0.*. Inspected master instead selects oro/crm 7.1.* with PHP ~8.5.0; do not equate master with 7.0.4.\nExtensions: Full required extension set unknown\nLimitations: This resolves the product-specific relationship without borrowing OroCommerce’s PHP floor. Enterprise and Commerce-with-CRM distributions overlap but need their own manifests. Registry installs/dependents are not deployment counts. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: CRM application, APIs, customer data and optional integrations\nRelease pin: Registry-advertised 7.0.4, source reference a37584eabd25ab46fce869b7d2849f037b77a9ec; immutable manifest retrieval failed\nSource accessed: 2026-10-17\nAliases: oro/crm-application, oroinc/crm-application\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://packagist.org/packages/oro/crm-application","https://github.com/oroinc/crm-application/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0242","name":"YetiForce CRM","vendor":"YetiForce S.A.","category":"Business applications","version":"Not specified","summary":"The 7.x guide identifies PHP, mandatory modules and optional/integration-specific libraries.","scope":"Inventory record: PHP-0242\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-FPM configuration and separate CLI php.ini are documented; exact deployed SAPI unknown\nPHP version scope: Official English 7.x requirements list PHP 8.1, 8.2 and 8.3; recommend 8.3.x. This is the documented 7.x scope, not proof of current upstream PHP security support.\nExtensions: Required in stated source scope: imap, pdo, pdo_mysql, mysqlnd, openssl, curl, gd, pcre, xml, json, session, dom, zip, mbstring, soap, fileinfo, iconv, intl, spl, reflection, simplexml, bcmath, filter, ctype, hash. Optional/recommended: exif, opcache, apcu, imagick, mongodb. Conditional/ambiguous: ldap when LDAP/AD login is active; pdo_sqlsrv for Wapro ERP or Comarch integration\nLimitations: The old YetiForceCRM repository points to a new YetiForce repository that contains reports/discussions, not current source. Requirements come from the official version-scoped guide; current released bytes remain unpinned. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: CRM records, imports, mail, workflows, directory and ERP connectors\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: YetiForce, YetiForceCRM\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://doc.yetiforce.com/en/introduction/requirements/","https://github.com/YetiForceCompany/YetiForceCRM","https://github.com/YetiForceCompany/YetiForce"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0243","name":"CiviCRM","vendor":"CiviCRM project","category":"Business applications","version":"Not specified","summary":"Publisher 6.19.0 metadata supplies release-qualified PHP and nine direct runtime-extension declarations. Earlier guide-only conditional roles for curl, fileinfo and zip must not be treated as optional in this release’s direct manifest.","scope":"Inventory record: PHP-0243\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and PHP CLI; guide requires matching versions and loaded modules\nPHP version scope: Publisher registry 6.19.0 (7 Oct 2026) directly declares PHP ^8.1.2. The moving 6.16+ guide table allows 8.1, while its summary says minimum 8.2. Neither overrides selected CMS/root requirements or establishes installed compatibility.\nExtensions: 6.19.0 direct runtime require: bcmath, curl, fileinfo, intl, json, mbstring, mysqli, xml, zip. Other functional/CMS/test prerequisites are separate; direct list is not the complete resolved or loaded set.\nLimitations: The guide’s internal minimum disagreement is retained as documentation scope. A direct component declaration is not proof that every CMS/integration supports PHP 8.1 or that all requirements are resolved. Registry hash is advertised, not verified source bytes; tag manifest retrieval failed. No deployment, loaded modules, affected build or reachability established.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Constituent and donation records, cases, events, payments and CMS integration\nRelease pin: Publisher registry 6.19.0, advertised source 3b031427f1e5cbe3dedf5a7ba46ef59d6751d101; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: CiviCRM Standalone, CiviCRM CMS integration\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://packagist.org/packages/civicrm/civicrm-core","https://docs.civicrm.org/installation/en/latest/requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0244","name":"Vtiger CRM Open Source","vendor":"Vtiger","category":"Business applications","version":"Not specified","summary":"The vendor’s Open Source installation FAQ explicitly requires PHP and several modules.","scope":"Inventory record: PHP-0244\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Official Open Source FAQ lists PHP 5.2+, 7.0+ without binding that wording to a specific current release. This is retained as stale/ambiguous version guidance, not a verified modern compatibility range.\nExtensions: Required in stated source scope: imap, curl, xml\nLimitations: The PHP relationship is confirmed for the Open Source application. Its release-to-PHP matrix, full modules and exact build remain unresolved; PHP use is not inferred for the separate cloud service or mobile client. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Self-hosted CRM records, mail, workflows and server administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Vtiger Open Source, Vtiger CRM OSS\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://help.vtiger.com/article/158054339-Vtiger-Open-Source-FAQs"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0245","name":"iTop","vendor":"Combodo","category":"Business applications","version":"Not specified","summary":"The official application manifest declares a bounded PHP runtime requirement separately from development packages.","scope":"Inventory record: PHP-0245\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Inspected develop composer.json: PHP >=8.2.0 <8.5.0, with Symfony 6.4 package constraints. Develop is not assumed to be a stable release.\nExtensions: Required in stated source scope: ctype, dom, gd, iconv, json, mysqli, soap\nLimitations: The direct manifest is a subset of the complete resolved runtime/module graph; production builds, extensions and exact releases require separate pins. Native inventory agents are separate from the PHP web application. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: CMDB, service-management records, imports, authentication and management workflows\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Combodo iTop, Combodo/iTop\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/Combodo/iTop/blob/develop/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0246","name":"osTicket","vendor":"Enhancesoft / osTicket project","category":"Business applications","version":"Not specified","summary":"The project installation documentation requires a PHP-capable web server and explicitly lists compatible PHP versions.","scope":"Inventory record: PHP-0246\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Moving installation guide labelled 1.17.7 lists PHP 8.2–8.4 and recommends 8.4. Label/body alignment with exact released artifacts remains unverified.\nExtensions: Full required extension set unknown\nLimitations: Do not treat the documentation label or older installer references as an immutable release pin. Full extensions, plugin compatibility, hosted editions and external mail servers remain separate. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Support tickets, files, incoming/outgoing mail and staff administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: osTicket self-hosted helpdesk\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://docs.osticket.com/en/latest/Getting%20Started/Installation.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0247","name":"FreeScout","vendor":"FreeScout project","category":"Business applications","version":"Not specified","summary":"The project describes a PHP/Laravel helpdesk and documents both web and CLI requirements.","scope":"Inventory record: PHP-0247\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-FPM web runtime and PHP CLI Artisan/cron/queue workers; separate ini/module settings must be checked\nPHP version scope: Repository README says PHP 7.4–8.x. Installation guide specifically warns against PHP 8.1 parsing behavior and says 8.2+ is suitable; older 7.4/8.0 sample commands are not a current complete matrix.\nExtensions: Full required extension set unknown. Conditional/ambiguous: Guide sample packages include mysql, mbstring, xml, imap, zip, gd, curl and intl; complete release requirements not inferred from the sample\nLimitations: The guide/README PHP wording differs and old examples remain; no specific security flaw or CVE is inferred from the parsing warning. Dist archives contain dependencies; master/build and locked graph requirements are separate. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Shared mailboxes, tickets, attachments, queue processing and configured mail credentials\nRelease pin: Installation-guide wiki revision 393b7d2751835e7ef272f4b09ba5e38a14804ff0 read; application release and locked dependencies unpinned\nSource accessed: 2026-10-17\nAliases: freescout-help-desk/freescout, FreeScout shared mailbox\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide/393b7d2751835e7ef272f4b09ba5e38a14804ff0","https://github.com/freescout-help-desk/freescout/wiki/Installation-Guide","https://github.com/freescout-help-desk/freescout"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0248","name":"UVdesk Community Helpdesk","vendor":"Webkul / UVdesk","category":"Business applications","version":"Not specified","summary":"The Community repository documents a PHP/Symfony helpdesk, required mail extensions and console setup; its broad skeleton constraint differs from README guidance.","scope":"Inventory record: PHP-0248\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web application and bin/console CLI; Symfony backend with Backbone.js frontend\nPHP version scope: Repository README lists PHP 8.1. Its master skeleton manifest declares ^7.2.5 || ^8.0, while Flex-selected framework/packages can raise the effective floor. Exact released resolved graph is unpinned.\nExtensions: Required in stated source scope: imap, mailparse. Conditional/ambiguous: ctype and iconv required by inspected skeleton manifest; transitive bundle/Flex requirements not fully enumerated\nLimitations: Community skeleton, installed bundles and cloud/commercial services are distinct scopes. A skeleton constraint does not override higher resolved requirements or establish PHP inside browser clients. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Ticket handling, mail parsing, support center, APIs and console setup\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: uvdesk/community-skeleton, UVdesk Community Edition\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/uvdesk/community-skeleton","https://github.com/uvdesk/community-skeleton/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0249","name":"Faveo Helpdesk Community Edition","vendor":"Ladybird Web Solution / Faveo","category":"Business applications","version":"Not specified","summary":"Edition-labelled vendor installation instructions explicitly provision PHP for the Community helpdesk.","scope":"Inventory record: PHP-0249\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache PHP module plus FPM/CLI packages in the example; actual selected handler unresolved\nPHP version scope: Official Community Ubuntu/Apache installation example installs PHP 8.1, mod_php, FPM and CLI packages. It is an environment example, not a complete current compatibility matrix.\nExtensions: Full required extension set unknown. Conditional/ambiguous: Community example includes mysql, soap, gd, opcache, mbstring, zip, bcmath, intl, xml, curl, imap, ldap, gmp and redis packages; mandatory vs optional not established by those commands\nLimitations: The generic requirements page instead lists PHP 8.4.x and ionCube without an edition label. Those commercial/encoded requirements are not silently applied to Community. No installer or package was executed. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Community helpdesk, ticket mail, attachments and background processing\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Faveo Community, Faveo CE\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://docs.faveohelpdesk.com/docs/installation/providers/community/ubuntu-apache/","https://docs.faveohelpdesk.com/docs/system-requirement/requirement/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0250","name":"Hesk Free self-hosted helpdesk","vendor":"Klemen Stirn / Hesk","category":"Business applications","version":"Not specified","summary":"The vendor identifies Hesk Free as self-hosted PHP/MySQL software and publishes its version and PHP range.","scope":"Inventory record: PHP-0250\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Download page advertises 3.7.12, released 2026-09-03, and PHP 5.6–8.5. These are vendor compatibility claims, not recommendations to deploy old PHP.\nExtensions: Full required extension set unknown\nLimitations: The page separately offers Hesk Cloud with vendor maintenance and cloud-only features. This row does not infer the implementation or full module set of every hosted feature. Browser PHP is not established. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: Hesk for application releases; deploying operator/hosting provider for PHP and self-hosted updates\nDownstream surface: Self-hosted tickets, knowledge base, attachments and optional email fetching\nRelease pin: Vendor-advertised Hesk 3.7.12 (2026-09-03); exact release archive/hash and native modules unverified\nSource accessed: 2026-10-17\nAliases: HESK, Hesk Free\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Hesk for application releases; deploying operator/hosting provider for PHP and self-hosted updates","links":["https://www.hesk.com/download.php"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0251","name":"MantisBT","vendor":"MantisBT project","category":"Business applications","version":"Not specified","summary":"The project’s own installation requirements explicitly identify PHP for the bug tracker server.","scope":"Inventory record: PHP-0251\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Official repository README requires PHP >=8.1.0 and a PHP-capable web server. Exact released branch and full native extensions remain unpinned.\nExtensions: Full required extension set unknown\nLimitations: The primary manual site was inaccessible; the official repository supplies the bounded runtime evidence. Plugins, integrations, mail services and database drivers require their own configuration/build checks. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Issue records, attachments, users, notification credentials and administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Mantis Bug Tracker, mantisbt/mantisbt\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API requests, mail parsing or attachments could cause denial of service, disclosure or worker-level code execution. Ticket contents, attachments, mailbox credentials, directory integrations and service-management records could then be affected according to configured permissions. Agent/endpoint compromise, host privilege and tenant escape are separate conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/mantisbt/mantisbt"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0252","name":"Snipe-IT","vendor":"Grokability / Snipe-IT project","category":"Business applications","version":"Not specified","summary":"The vendor distinguishes required PHP extensions from LDAP and alternative image-processing requirements.","scope":"Inventory record: PHP-0252\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Moving requirements: PHP >=8.2.0 <8.6. No immutable application release or tested deployment identified.\nExtensions: Required in stated source scope: json, openssl, pdo, mbstring, tokenizer, curl, mysqli, zip, fileinfo, bcmath, xml, sodium, exif. Conditional/ambiguous: ldap only when LDAP integration is used; gd >=2.0 OR imagick >=6.3.8 for barcode generation and image resizing\nLimitations: The guide’s database/library requirements are not measurements of loaded modules. Separate mobile/browser/inventory clients do not inherit a PHP runtime from the server. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Asset assignments, inventory, uploads, barcodes and directory authentication\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: SnipeIT, Snipe-IT asset management\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://snipe-it.readme.io/docs/requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0253","name":"Invoice Ninja self-hosted server","vendor":"Invoice Ninja","category":"Business applications","version":"Not specified","summary":"The source manifest confirms the PHP server and direct extensions; the repository identifies a Laravel API/client-portal implementation.","scope":"Inventory record: PHP-0253\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web/API and client portal; PHP CLI Artisan, scheduler and queue operations\nPHP version scope: Inspected v5-stable manifest: require.php ^8.2|^8.3|^8.4|^8.5, Laravel ^12. The generic getting-started page still says >=8.1 while advertising download v5.13.19; release alignment is unresolved.\nExtensions: Required in stated source scope: bcmath, curl, dom, json, libxml, simplexml\nLimitations: The literal Composer union is not a strict upper limit at 8.5 and is not a tested PHP matrix. Generic landing requirements do not override the branch manifest or resolved dependencies. Payment SDKs prove client-side integration code, not PHP in remote payment services. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Invoices, clients, payment integration, documents, API and scheduled jobs\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Invoice Ninja v5, invoiceninja/invoiceninja\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/invoiceninja/invoiceninja/blob/v5-stable/composer.json","https://www.invoiceninja.org/getting-started/","https://github.com/invoiceninja/invoiceninja","https://invoiceninja.github.io/docs/self-host/self-host-installation"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0254","name":"InvoicePlane","vendor":"InvoicePlane project","category":"Business applications","version":"Not specified","summary":"The installation guide confirms PHP web/CLI use; the manifest identifies PHP libraries and a CodeIgniter 3.4 fork separately from development tools.","scope":"Inventory record: PHP-0254\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Develop installation guide says PHP >=8.2, supporting 8.3/8.4, and describes PHP-FPM 8.2 development containers. Older manual examples still install PHP 8.1; no direct require.php was found in the inspected root manifest.\nExtensions: Full required extension set unknown\nLimitations: The old 8.1 examples are retained as a documentation conflict, not a supported current floor. Develop is not an immutable release. Development phpMyAdmin services are separate components and do not prove it is bundled in every production archive. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Client records, invoices, templates, PDFs, payments and web administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: InvoicePlane/InvoicePlane\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/InvoicePlane/InvoicePlane/blob/develop/.github/docs/INSTALLATION.md","https://github.com/InvoicePlane/InvoicePlane/blob/develop/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0255","name":"Akaunting self-hosted application","vendor":"Akaunting","category":"Business applications","version":"Not specified","summary":"The application’s root runtime requirements explicitly declare PHP and thirteen extensions; README separates PHP from the Node asset pipeline.","scope":"Inventory record: PHP-0255\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web application and Artisan CLI; Laravel foundation; Node frontend asset build is separate\nPHP version scope: Inspected master root manifest requires PHP ^8.1; README says >=8.1. Native dependencies and modules/apps can raise effective requirements. Exact released build unpinned.\nExtensions: Required in stated source scope: bcmath, ctype, curl, dom, fileinfo, gd, intl, json, mbstring, openssl, tokenizer, xml, zip\nLimitations: Nested package definitions and Composer platform targets are not substitutes for the root requirement. This confirms self-hosted application PHP, not every hosted service or separately marketed app. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Accounting records, imports, documents, app modules and financial integrations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: akaunting/akaunting, Akaunting\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/akaunting/akaunting/blob/master/composer.json","https://github.com/akaunting/akaunting"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0256","name":"Kimai","vendor":"Kevin Papst / Kimai project","category":"Business applications","version":"Kimai 2.70.1 rebuilt supported Docker image tags","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0256\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and Symfony console CLI; FPM/Apache Docker options documented separately\nPHP version scope: Registry advertises 2.69.0 (2026-10-06), PHP >=8.2; main requirements mention support for 8.3/8.4/8.5. Main composer config.platform=8.2 is a resolution target, not the sole runtime evidence.\nExtensions: Required in stated source scope: gd, intl, json, mbstring, pdo, tokenizer, xml, xsl, zip\nLimitations: Registry events/installs are not installations. Cloud hosting, plugins, Synology/Docker packaging and a given release’s actual PHP build need separate evidence. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Timesheets, project rates, invoices, reports, authentication and plugins\nRelease pin: Registry-advertised 2.69.0, source reference 44d47d65ec9308d65da11ebb7648eaf945c04418; immutable manifest retrieval failed\nSource accessed: 2026-10-17\nAliases: kimai/kimai, Kimai 2\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://github.com/kimai/kimai/releases/tag/2.70.1; https://github.com/kimai/kimai/pull/6262#issuecomment-6322087754\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://packagist.org/packages/kimai/kimai","https://github.com/kimai/kimai","https://github.com/kimai/kimai/blob/main/composer.json","https://www.kimai.org/documentation/installation.html","https://github.com/kimai/kimai/releases/tag/2.70.1","https://github.com/kimai/kimai/pull/6262#issuecomment-6322087754"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP runtime update.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/kimai/kimai/releases/tag/2.70.1; https://github.com/kimai/kimai/pull/6262#issuecomment-6322087754\nAction statement: Pull and redeploy a supported Kimai 2.70.1 image tag; do not use a retired tag or assume upgrading application code patches system PHP."},"CVE-2026-109619":{"status":"Fix","notes":"Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP runtime update.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/kimai/kimai/releases/tag/2.70.1; https://github.com/kimai/kimai/pull/6262#issuecomment-6322087754\nAction statement: Pull and redeploy a supported Kimai 2.70.1 image tag; do not use a retired tag or assume upgrading application code patches system PHP."}}},{"id":"PHP-0257","name":"SolidInvoice application","vendor":"SolidWorx / SolidInvoice project","category":"Business applications","version":"Not specified","summary":"The official runtime manifest requires PHP and native extensions; source and binary installation methods have different packaging boundaries.","scope":"Inventory record: PHP-0257\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP/Symfony web runtime and console/Messenger workers; standalone binary recorded separately\nPHP version scope: Inspected 3.2.x root manifest requires PHP >=8.4.1; README says PHP 8.4+ and Symfony 7.1 while moving manifest constraints include newer framework/dev scopes. Released pair not verified.\nExtensions: Required in stated source scope: curl, gd, intl, json, openssl, pdo, soap, xsl\nLimitations: The manifest’s internal version string and branch name are not an immutable release pin. config.platform.php is separate from require.php. A self-contained binary is a derived overlapping distribution, not a second application installation. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Invoices, quotes, financial documents, payment integration and workers\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: SolidInvoice, SolidInvoice/SolidInvoice\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/SolidInvoice/SolidInvoice/blob/3.2.x/composer.json","https://github.com/SolidInvoice/SolidInvoice"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0258","name":"SolidInvoice self-contained binary","vendor":"SolidWorx / SolidInvoice project","category":"Embedded runtimes","version":"Not specified","summary":"The vendor explicitly documents a bundled PHP runtime and FrankenPHP worker controls; no separately installed host PHP is required.","scope":"Inventory record: PHP-0258\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0257\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled Caddy/FrankenPHP; optional persistent PHP worker mode and integrated background workers\nPHP version scope: Moving quick-install guide explicitly bundles SolidInvoice, PHP and a webserver into one Linux/macOS download. Exact binary release, embedded PHP patch/modules and architecture-specific hashes unknown.\nExtensions: Full required extension set unknown\nLimitations: Host PHP package updates need not change the embedded runtime. This distribution overlaps the application record; it is not an additional unique installation. No binary was downloaded or executed and no complete SBOM was read. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: SolidInvoice distribution maintainer for rebuilt embedded PHP/FrankenPHP/native components; operator for replacing/restarting the matching binary\nDownstream surface: Bundled invoice web service, optional persistent PHP workers and integrated async/scheduled work\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: SolidInvoice quick-install distribution, SolidInvoice bundled PHP binary\nConditional downstream consequence: A matching PHP or loaded-extension flaw reachable through the bundled web/worker interface could cause denial of service, disclosure, invoice/data alteration or process-level code execution within the binary’s permissions. The embedded PHP build must be matched to the flaw. Host PHP updates need not replace that binary; privilege and tenant escape require additional evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SolidInvoice distribution maintainer for rebuilt embedded PHP/FrankenPHP/native components; operator for replacing/restarting the matching binary","links":["https://solidinvoice.co/docs/installation-guide/quick-install/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0259","name":"FrontAccounting","vendor":"FrontAccounting project","category":"Business applications","version":"Not specified","summary":"The official project mirror explicitly requires PHP for the accounting application and explains PHP session/web-server configuration.","scope":"Inventory record: PHP-0259\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-capable HTTP server, including Apache mod_php, IIS or CGI discussed in README\nPHP version scope: Official mirror README lists PHP >=5.0 and recommends 5.6/7.x; old settings remain in the text. This confirms PHP use but does not verify a current release/PHP support matrix.\nExtensions: Full required extension set unknown\nLimitations: Legacy README recommendations and removed PHP settings are not adopted as current deployment advice or compatibility tests. Exact stable artifact, modern PHP floor and modules remain unresolved. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Accounting, financial records, reports and web administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: FrontAccountingERP/FA, FA accounting\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/FrontAccountingERP/FA"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0260","name":"webERP","vendor":"webERP project","category":"Business applications","version":"Not specified","summary":"The official versioned manual requires PHP and separates feature-dependent FTP, translations and graphing extensions.","scope":"Inventory record: PHP-0260\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Versioned manual 4.15.2, dated 2025-09-03, states PHP >5.1. This is the manual’s literal historical-style claim, not a verified current PHP compatibility or security-support range.\nExtensions: Full required extension set unknown. Conditional/ambiguous: ftp for EDI order transfer; gettext for translations; gd for graphing\nLimitations: The HTML requirements page and guessed official GitHub repository were inaccessible. The versioned PDF supplies bounded evidence; modern released manifests, database connectors and native modules remain open. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: ERP/accounting records, reports, graphs, translations and optional EDI\nRelease pin: Official manual file 4.15.2 dated 2025-09-03; source archive/hash and current release alignment unverified\nSource accessed: 2026-10-17\nAliases: webERP 4.15.2\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://www.weberp.org/downloads/webERP.Manual.4.15.2.2025-09-03.pdf"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0261","name":"OrangeHRM Starter","vendor":"OrangeHRM Inc.","category":"Business applications","version":"Not specified","summary":"The edition-labelled Starter repository links to vendor prerequisites that explicitly install the PHP web environment.","scope":"Inventory record: PHP-0261\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache libapache2-mod-php in the Linux guide; actual deployed handler unknown\nPHP version scope: Official Linux prerequisites instruct installation of Apache PHP modules and PHP 8.3 GD/MySQL packages. This proves a documented environment, not a complete supported version range.\nExtensions: Full required extension set unknown. Conditional/ambiguous: Guide packages include gd, mysql connector, mbstring, zip, json and curl; mandatory/feature split and complete native modules unresolved\nLimitations: Starter, commercial HR editions, separate mobile apps and managed tenants are distinct boundaries. The package example is not proof of every extension being mandatory or loaded. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Personnel/HR records, documents, employee self-service and administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: OrangeHRM open-source Starter, orangehrm/orangehrm\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://starterhelp.orangehrm.com/hc/en-us/articles/6187572000540-Prerequisites-for-installing-OrangeHRM-Starter-in-Linux","https://github.com/orangehrm/orangehrm"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0262","name":"Kanboard","vendor":"Kanboard project","category":"Business applications","version":"Not specified","summary":"The server-side requirements distinguish PHP versions and extensions from ordinary browser/device requirements.","scope":"Inventory record: PHP-0262\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Current requirements specify PHP >=8.1 since 1.2.46; earlier documented thresholds are >=7.4 since 1.2.22 and >=7.2 since 1.2.13.\nExtensions: Required in stated source scope: gd, mbstring, openssl, json, hash, ctype, session, filter, xml, simplexml, dom. Optional/recommended: curl. Conditional/ambiguous: pdo_sqlite OR pdo_mysql OR pdo_pgsql for the selected database; zip for web-UI plugin installation; ldap for LDAP integration\nLimitations: The guide also lists experimental SQL Server support without fully enumerating its driver requirements here. A modern browser does not thereby contain PHP. Exact release packages, plugins and loaded modules remain unpinned. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Project boards, tasks, attachments, users, plugins and directory integration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Kanboard 1.2\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://docs.kanboard.org/v1/admin/requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0263","name":"Leantime","vendor":"Leantime project","category":"Business applications","version":"Not specified","summary":"The root runtime manifest explicitly requires PHP and modules, including LDAP and process-control modules, separately from development tooling.","scope":"Inventory record: PHP-0263\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache/nginx PHP runtime; Windows IIS FastCGI and bin/leantime PHP CLI update path documented\nPHP version scope: Inspected master root manifest requires PHP ^8.2. README says PHP 8.2+ and enumerates further modules. These are moving source scopes, not verified released artifacts.\nExtensions: Required in stated source scope: ldap, mysqli, pdo, pdo_mysql, zip, mbstring, pcntl, posix, bcmath, simplexml, phar, openssl, gd, fileinfo, dom. Conditional/ambiguous: README additionally lists ctype, curl, exif, filter, hash, opcache, pcre, session and tokenizer; complete transitive graph unresolved\nLimitations: LDAP/pcntl/posix are direct manifest requirements here, not assumed optional because similar products treat them that way. Node/webpack and Docker development environments are separate phases; exact Windows/native-module parity unresolved. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Project plans, tasks, uploads, authentication, plugins and CLI maintenance\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Leantime/leantime\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/Leantime/leantime/blob/master/composer.json","https://github.com/Leantime/leantime"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0264","name":"Feng Office Community Edition","vendor":"Feng Office","category":"Business applications","version":"Not specified","summary":"The official Community repository explicitly requires a PHP/MySQL web-server environment and documents application installation/cron setup.","scope":"Inventory record: PHP-0264\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Community README says PHP >=5.0 and separately recommends PHP 7.1+. Its old configuration/XAMPP prose is not a verified current release matrix.\nExtensions: Full required extension set unknown\nLimitations: The linked requirements wiki was inaccessible. Community evidence is not applied to every commercial/cloud edition. README attribution to adapted ActiveCollab 0.7.1 code is historical lineage, not a dependency on current ActiveCollab. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Business/project records, collaboration files, users and scheduled tasks\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: fengoffice/fengoffice, Feng Office CE\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/fengoffice/fengoffice"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0265","name":"Part-DB server","vendor":"Part-DB project","category":"Business applications","version":"Not specified","summary":"The official server manifest declares PHP and direct native modules; README separates server execution from Node/yarn browser-asset building.","scope":"Inventory record: PHP-0265\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-capable Symfony web server and bin/console migrations/cache/admin CLI\nPHP version scope: Official README requires PHP >=8.2 / Symfony 7; inspected master root require.php is ^8.2. A nested ZipStream package entry instead says ^8.0 and must not replace the root floor.\nExtensions: Required in stated source scope: ctype, dom, gd, iconv, intl, json, mbstring, zip. Optional/recommended: bcmath, gmp\nLimitations: The named server, legacy pre-1.0 versions and Docker distribution have separate build scopes. Source prose about universities/companies is not a measured deployment total or a specific institution’s runtime. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Electronic-parts stock, pricing, files, shared inventory and administration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Part-DB, Part-DB/Part-DB-server\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through requests, imports, uploads or document processing could cause denial of service, disclosure or code execution within the PHP worker. Customer, personnel, financial or inventory data and configured credentials could be read or altered within that worker’s permissions. Host privilege, tenant escape and lateral movement require additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://github.com/Part-DB/Part-DB-server/blob/master/composer.json","https://github.com/Part-DB/Part-DB-server"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0266","name":"WHMCS self-hosted application","vendor":"WHMCS Ltd.","category":"Business applications","version":"Not specified","summary":"The vendor’s 9.0 and 8.13 matrices bind PHP and encoded-code loader versions to specific application branches.","scope":"Inventory record: PHP-0266\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP in supported Linux/Apache LAMP environment and PHP CLI system cron; versions must match\nPHP version scope: Versioned docs: 9.0 PHP 8.2/8.3 with ionCube >=13.0.2/14.4.0 respectively. 8.13 lists 7.2/7.3/7.4/8.1/8.2/8.3 with loader minima 10.2.0/10.3.1/10.4.3/12.0.1/13.0.2/14.4.0.\nExtensions: Required in stated source scope: curl (>=7.36 with SSL), gd, imap, ionCube Loader, json, pdo, pdo_mysql (mysqlnd), reflection, xml. Conditional/ambiguous: Vendor also requires default-compiled modules, mentioning mysqlnd, libxml, dom and fileinfo; no distro defaults inferred\nLimitations: One overlapping product-family record covers two branch scopes, not two installations. 9.1 beta was not adopted as stable. The vendor’s default-module wording is not a distribution build inventory, and cloud features have separate boundaries. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: WHMCS for application/encoded releases; ionCube for loader releases; PHP package/hosting provider and operator for installing the compatible runtime/loader/application combination\nDownstream surface: Billing/client records, payment modules, hosting provisioning and privileged integration credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: WHMCS 9.0, WHMCS 8.13\nConditional downstream consequence: A matching reachable flaw in PHP, a loaded extension or the relevant encoded-code loader could cause denial of service, disclosure, integrity loss or worker-level code execution. Billing records and configured payment/provisioning credentials could then be affected within actual permissions. Further management-plane actions require valid integration credentials/rights and reachable services; presence alone proves none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"WHMCS for application/encoded releases; ionCube for loader releases; PHP package/hosting provider and operator for installing the compatible runtime/loader/application combination","links":["https://docs.whmcs.com/9-0/installation-guide/system-requirements/","https://docs.whmcs.com/8-13/installation-guide/system-requirements/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtime upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"Primary research reviewed 2026-10-21. Calif confirms pre-auth RCE on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, MediaWiki 1.46.2, Laravel 13.11, Symfony 8.1, phpMyAdmin 5.2.3, Roundcube 1.7.4 and WHMCS. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0267","name":"Blesta billing platform","vendor":"Phillips Data / Blesta","category":"Business applications","version":"Not specified","summary":"Versioned vendor requirements explicitly identify PHP, encoded-code loader and native extensions for the billing platform.","scope":"Inventory record: PHP-0267\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web application and PHP CLI installation/cron; specific web handler deployment-dependent\nPHP version scope: Version-6 installation documentation: PHP 8.2/8.3/8.4, recommended 8.3; ionCube Loader >=15. Exact licensed application patch/build unverified.\nExtensions: Required in stated source scope: ionCube Loader (>=15), pdo, pdo_mysql, curl, openssl, gmp, imap, json, ldap, libxml, mailparse, iconv, mbstring, simplexml, soap, gd, zlib. Optional/recommended: fileinfo\nLimitations: Third-party extensions/themes can impose additional requirements. This is not a measurement of an installed loader or evidence that every integration is configured. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: Blesta for application/encoded releases; ionCube and PHP suppliers for loader/runtime; hosting provider/operator for deploying compatible updates\nDownstream surface: Billing accounts, payment data, automation, provisioning modules and configured credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: Blesta 6\nConditional downstream consequence: A matching reachable flaw in PHP, a loaded extension or the relevant encoded-code loader could cause denial of service, disclosure, integrity loss or worker-level code execution. Billing records and configured payment/provisioning credentials could then be affected within actual permissions. Further management-plane actions require valid integration credentials/rights and reachable services; presence alone proves none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Blesta for application/encoded releases; ionCube and PHP suppliers for loader/runtime; hosting provider/operator for deploying compatible updates","links":["https://docs.blesta.com/installation/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0268","name":"HostBill","vendor":"HostBill / HostBillApp","category":"Business applications","version":"Not specified","summary":"The vendor-hosted requirements distinguish mandatory PHP modules and ionCube from recommended/feature-specific additions.","scope":"Inventory record: PHP-0268\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Moving manual-installation requirements: minimum PHP 8.1, recommended 8.3, ionCube Loader >=14.x. No immutable HostBill build identified.\nExtensions: Required in stated source scope: curl (SSL), mbstring, bcmath, json, pdo, pdo_mysql, fileinfo, ionCube Loader (>=14.x). Optional/recommended: sodium, imap, posix, pcntl. Conditional/ambiguous: gd/GIF support for dynamically generated images\nLimitations: The Enterprise easy-install script is described as installing dependencies; its complete payload was not inspected or run. PHP-hosting control-panel support is not proof those control panels use PHP internally. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: HostBill for application/encoded builds; ionCube and PHP suppliers for loader/runtime; deploying operator/provider for the compatible combination\nDownstream surface: Billing, orders, automation, hosting management integrations and provisioner credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: HostBill billing and automation\nConditional downstream consequence: A matching reachable flaw in PHP, a loaded extension or the relevant encoded-code loader could cause denial of service, disclosure, integrity loss or worker-level code execution. Billing records and configured payment/provisioning credentials could then be affected within actual permissions. Further management-plane actions require valid integration credentials/rights and reachable services; presence alone proves none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"HostBill for application/encoded builds; ionCube and PHP suppliers for loader/runtime; deploying operator/provider for the compatible combination","links":["https://hostbill.atlassian.net/wiki/spaces/DOCS/pages/53745197/System%2Brequirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0269","name":"FOSSBilling","vendor":"FOSSBilling project","category":"Business applications","version":"Not specified","summary":"The current requirements identify PHP and distinguish mandatory modules, recommended media/cache support and the Plesk-only SimpleXML requirement.","scope":"Inventory record: PHP-0269\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Official requirements last updated 2026-10-16 list PHP 8.3/8.4/8.5. Exact application release, archive and PHP build remain unpinned.\nExtensions: Required in stated source scope: curl, dom, iconv, intl, json, openssl, pdo_mysql, xml, zlib. Optional/recommended: mbstring, opcache, imagick OR gd. Conditional/ambiguous: simplexml only for Plesk integration\nLimitations: FOSSBilling is a separately maintained fork of legacy BoxBilling; its current requirements do not retroactively apply to the archived ancestor. Packages, plugins and actual provider/tenant configuration remain unknown. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes\nDownstream surface: Billing/client data, modules, hosting provisioning and integration credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: FOSSBilling/FOSSBilling\nConditional downstream consequence: A matching reachable flaw in PHP, a loaded extension or the relevant encoded-code loader could cause denial of service, disclosure, integrity loss or worker-level code execution. Billing records and configured payment/provisioning credentials could then be affected within actual permissions. Further management-plane actions require valid integration credentials/rights and reachable services; presence alone proves none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP package/image/hosting provider and operator for runtime updates; application/component maintainer and deploying operator for application changes","links":["https://docs.fossbilling.org/getting-started/requirements/","https://github.com/boxbilling/boxbilling"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0270","name":"BoxBilling","vendor":"BoxBilling project","category":"Business applications","version":"Not specified","summary":"The archived project explicitly identifies PHP/MySQL runtime requirements and directs readers to the separately maintained FOSSBilling fork.","scope":"Inventory record: PHP-0270\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI deployment-dependent; CLI only where separately evidenced\nPHP version scope: Archived repository recommends PHP 8.0 and says 8.1 was not yet tested. README maintenance notice dated 2022-10-30; repository archived 2026-02-14.\nExtensions: Required in stated source scope: pdo_mysql, curl, zlib, gettext, openssl\nLimitations: Historical-only describes this source/product line; it does not prove old deployments disappeared. Legacy recommendations are not current security guidance, and no specific PHP CVE or affected installation is established. PHP presence does not establish an affected build, reachability or exploitation. Deployments and enabled features were not measured.\nPatch owner: Legacy application operator/maintainer where supported; FOSSBilling is a separate migration target, not automatic patch propagation; PHP provider/operator for runtime\nDownstream surface: Legacy billing/client records, payment/provisioning integrations and credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable application pin pending\nSource accessed: 2026-10-17\nAliases: boxbilling/boxbilling\nConditional downstream consequence: A matching reachable flaw in PHP, a loaded extension or the relevant encoded-code loader could cause denial of service, disclosure, integrity loss or worker-level code execution. Billing records and configured payment/provisioning credentials could then be affected within actual permissions. Further management-plane actions require valid integration credentials/rights and reachable services; presence alone proves none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy application operator/maintainer where supported; FOSSBilling is a separate migration target, not automatic patch propagation; PHP provider/operator for runtime","links":["https://github.com/boxbilling/boxbilling"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0271","name":"Cacti","vendor":"The Cacti Group","category":"Monitoring and administration","version":"Not specified","summary":"The source manifest and README confirm PHP for the web application and built-in poller, with differing table/develop minima.","scope":"Inventory record: PHP-0271\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime and CLI/CGI polling/maintenance; separate Spine collector is not assumed PHP\nPHP version scope: Moving repository table says minimum PHP 8.2, recommended 8.3; inspected develop manifest declares ^8.3. README also describes a lock resolved against the 8.3 floor. Exact released branch alignment unresolved.\nExtensions: Required in stated source scope: pdo, phar, dom, gd, gmp, intl, json, ldap, mbstring, mysqlnd, openssl, pcntl, pdo_mysql, posix, sockets, sqlite3, xml\nLimitations: Develop requirements are not applied to all 1.2.x archives. Release SBOM/provenance production is described but no release SBOM was inspected. Package-check and polling commands were not run. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Monitoring UI, PHP poller, graphs, data-source configuration and integrations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Cacti/cacti, Cacti PHP poller\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/Cacti/cacti/blob/develop/composer.json","https://github.com/Cacti/cacti"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0272","name":"Observium","vendor":"Observium Limited / Observium project","category":"Monitoring and administration","version":"Not specified","summary":"The official installation guide explicitly provisions both the PHP web SAPI and command-line runtime.","scope":"Inventory record: PHP-0272\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache mod_php with prefork plus PHP CLI in the documented environments\nPHP version scope: Official Ubuntu/Debian examples use PHP 8.5 on Ubuntu 26.04, 8.4 on Debian 13 and 8.3 on Ubuntu 24.04. These are documented OS environments, not a universal minimum or edition/version matrix.\nExtensions: Full required extension set unknown. Conditional/ambiguous: Example packages include mysql connector, gd, bcmath, mbstring, curl, APCu and version-dependent OPcache packaging; mandatory/optional split remains unverified\nLimitations: Community/subscription source snapshots and complete native modules were not pinned separately. The guide’s PHP 8.5 OPcache packaging note is not generalized to every distributor. No monitoring commands were executed. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Network monitoring web interface, graphs, inventory and scheduled processing\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Observium Community Edition, Observium network monitoring\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://docs.observium.org/install_debian/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0273","name":"Icinga Web","vendor":"Icinga GmbH","category":"Monitoring and administration","version":"Not specified","summary":"The official guide explicitly separates PHP web/CLI requirements from Icinga 2 and Icinga DB monitoring services.","scope":"Inventory record: PHP-0273\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache/nginx PHP web runtime and icingacli CLI\nPHP version scope: Current source-installation guide: PHP >=8.2 and Icinga PHP Library/Thirdparty >=1.0.0. Official release article identifies Web 2.14.0; installed package/source pair remains unpinned.\nExtensions: Required in stated source scope: curl, json, gettext, fileinfo, intl, dom, openssl, xml. Conditional/ambiguous: MariaDB/MySQL or PostgreSQL PHP connector matching the selected database; ldap for Active Directory/LDAP authentication; PDF export requires a separately installed pdfexport module, not merely PHP core\nLimitations: The PHP interface does not establish PHP in every Icinga engine, database daemon, agent or plugin. Module and core release requirements can differ. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Monitoring/management UI, authentication, resources, modules and CLI\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Icinga Web 2, icingaweb2, Icinga Web 2.14\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://icinga.com/docs/icinga-web/latest/doc/02-Installation/From-Source/","https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0274","name":"Icinga DB Web","vendor":"Icinga GmbH","category":"Monitoring and administration","version":"Not specified","summary":"The named web module has its own PHP/module requirements and is installed into Icinga Web.","scope":"Inventory record: PHP-0274\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0273\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Current module guide: PHP >=8.2, Icinga PHP Library >=0.19.0 and Thirdparty >=0.15.0; host Web requirements may be higher.\nExtensions: Required in stated source scope: curl, dom, json, libxml. Conditional/ambiguous: pdo_mysql OR pdo_pgsql matching the database\nLimitations: Icinga DB Web is distinct from the Icinga DB daemon, Redis and Icinga 2. Lower module library minima do not override the newer host Web requirements. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Monitoring status/history views, database access and web controls\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: icingadb web module\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://icinga.com/docs/icinga-db-web/latest/doc/02-Installation/From-Source/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0275","name":"Icinga Director","vendor":"Icinga GmbH","category":"Monitoring and administration","version":"Not specified","summary":"The official module installation guide supplies PHP and extension requirements for configuration deployment and background work.","scope":"Inventory record: PHP-0275\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0273\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP module in Icinga Web plus icingacli and Director daemon/service workflows\nPHP version scope: Current source guide: PHP >=8.2; Director 1.10 is documented as the last version supporting PHP 5.6. PHP Library/Thirdparty >=1.0.0 and Legacy >=1.1.0 are separate packages.\nExtensions: Required in stated source scope: curl, iconv, pcntl, sockets\nLimitations: Package presence does not establish deployed API credentials, import sources or permission to change monitored hosts. Legacy support statements are not current PHP security guidance. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Monitoring configuration deployment, imports, API credentials and background jobs\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: icingaweb2-module-director\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://icinga.com/docs/icinga-director/latest/doc/02-Installation/From-Source/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0276","name":"Icinga Certificate Monitoring","vendor":"Icinga GmbH","category":"Monitoring and administration","version":"Not specified","summary":"The official module guide requires Icinga Web; the release announcement explicitly identifies this PHP module and version support.","scope":"Inventory record: PHP-0276\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0273\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Release article identifies Certificate Monitoring 1.4.0 with PHP 8.5 support; coordinated release minimum is PHP 8.2. Exact archive and native module set unpinned.\nExtensions: Full required extension set unknown\nLimitations: Certificate collection/scanning roles and web presentation have distinct processes and permissions. No certificate scan or import was performed. Module counts overlap the host Web installation. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Certificate inventory, trust/configuration metadata, reports and CLI imports\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Icinga x509 module\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://icinga.com/docs/icinga-certificate-monitoring/latest/doc/02-Installation/","https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0277","name":"Icinga Reporting","vendor":"Icinga GmbH","category":"Monitoring and administration","version":"Not specified","summary":"The module’s own requirements explicitly identify PHP, mbstring and a database PDO connector.","scope":"Inventory record: PHP-0277\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0273\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Icinga Web PHP module and scheduled/CLI report generation\nPHP version scope: Current requirements: PHP >=8.2, Web >=2.12.5 and PHP Library/Thirdparty >=1.0.0. Release article names Reporting 1.1.0.\nExtensions: Required in stated source scope: mbstring. Conditional/ambiguous: pdo_mysql OR pdo_pgsql matching the database\nLimitations: Host Web and PDF modules can impose further requirements. Report/export worker permissions and data access are deployment-specific; no scheduled task was run. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Monitoring reports, schedules, rendered output and report databases\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Icinga reporting module\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://icinga.com/docs/icinga-reporting/latest/doc/02-Installation/","https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0278","name":"Icinga PDF Export","vendor":"Icinga GmbH","category":"Monitoring and administration","version":"Not specified","summary":"The vendor explicitly identifies the PHP PDF-export module and separates PHP libraries from its locally installed Chromium process.","scope":"Inventory record: PHP-0278\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0273\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official release article: PDF Export 0.13.0 supports PHP 8.5 and requires PHP >=8.2 / PHP Library >=1.0.0. Exact release bytes and full modules unpinned.\nExtensions: Full required extension set unknown\nLimitations: Chromium is a separate native/browser process; this PHP module does not prove PHP inside Chromium. The guessed standalone module documentation route was unavailable. No export was executed. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Monitoring PDF/report rendering and application/worker file access\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Icinga pdfexport module\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://icinga.com/blog/icinga-web-2-14-security-releases-and-module-updates"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0279","name":"Centreon Web and central-server PHP interface","vendor":"Centreon","category":"Monitoring and administration","version":"Not specified","summary":"The vendor installation procedure explicitly enables PHP 8.2 for the central web environment.","scope":"Inventory record: PHP-0279\nCategory: Monitoring and administration\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-FPM behind Apache in central-server package installation\nPHP version scope: Current central-server installation page is labelled 25.10 and configures PHP 8.2 / PHP-FPM on supported OS examples. This is an installation environment, not every Centreon component’s runtime.\nExtensions: Full required extension set unknown\nLimitations: Centreon Engine/Broker, connectors, Gorgone and agents are separate components. The Collect source repository describes native build dependencies; PHP is not automatically attributed to all of them. Exact package patch/module contents unresolved. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Central monitoring/admin UI, configuration, resource data and integration settings\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Centreon Web, Centreon OnPrem web components\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://docs.centreon.com/docs/installation/installation-of-a-central-server/using-packages/","https://github.com/centreon/centreon-collect"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0280","name":"Nagios XI web configuration-wizard subsystem","vendor":"Nagios Enterprises","category":"Monitoring and administration","version":"Not specified","summary":"The official development guide identifies PHP scripts and callback functions loaded by the XI configuration-wizard interface.","scope":"Inventory record: PHP-0280\nCategory: Monitoring and administration\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Vendor guide explicitly titled for XI 2024 and 2026 documents PHP wizard scripts loaded under the XI web application. Exact PHP version/build and required extensions unknown.\nExtensions: Full required extension set unknown\nLimitations: The example establishes a real server extension mechanism, not that a particular custom wizard is installed. It does not establish PHP in Nagios Core, native checks, agents or every XI subsystem. No example code was run. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: XI web configuration wizards, monitoring configuration and accessible management credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Nagios XI PHP wizards, Nagios XI 2024/2026 configuration wizards\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://assets.nagios.com/downloads/nagiosxi/docs/Writing-Custom-Wizards-2024.pdf"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0281","name":"Nagios Fusion web component subsystem","vendor":"Nagios Enterprises","category":"Monitoring and administration","version":"Not specified","summary":"The vendor explains how PHP component files are included during Fusion application instantiation and register web-page callbacks.","scope":"Inventory record: PHP-0281\nCategory: Monitoring and administration\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official Fusion developer guide documents runtime inclusion of component-name.inc.php files and registration callbacks. Exact current Fusion/PHP release and module set unpinned.\nExtensions: Full required extension set unknown\nLimitations: This confirms the PHP web component mechanism, not installation of the demonstration component or PHP in every remote monitored server. No component was created, loaded or executed. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Fusion management pages, remote-monitoring integration configuration and PHP callbacks\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Nagios Fusion PHP components\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web/API input, imported content or PHP background jobs could cause denial of service, information disclosure or worker-level code execution. Monitoring data, application configuration and accessible integration credentials could then be read or changed. Further management actions require the configured rights and reachable services; native engines, agents, host privilege and tenant escape remain separate boundaries.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://assets.nagios.com/downloads/nagiosfusion/guides/developer/components.php"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0282","name":"Adminer","vendor":"Jakub Vrana / Adminer project","category":"Monitoring and administration","version":"Not specified","summary":"The official site describes a database administration application shipped as a single PHP file and requiring PHP session support.","scope":"Inventory record: PHP-0282\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official requirements claim PHP 5.3+, 7 and 8 with sessions; homepage lists Adminer 6.0.0 news dated 2026-08-07. Exact download/version alignment not pinned.\nExtensions: Required in stated source scope: session. Conditional/ambiguous: Database PHP driver(s) matching selected backend; complete set not enumerated in this batch\nLimitations: A broad homepage range is not proof of every historical/new release on every PHP build. Adminer Editor and plugins are related but separate scopes; supplied database credentials/privileges determine accessible data. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Database administration web interface, SQL actions and session-held credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Adminer database manager, phpMinAdmin\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://www.adminer.org/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0283","name":"phpPgAdmin","vendor":"phpPgAdmin project","category":"Monitoring and administration","version":"Not specified","summary":"The official application manifest explicitly declares PHP and the PostgreSQL PHP extension.","scope":"Inventory record: PHP-0283\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Inspected master root composer.json: PHP >=7.1 and ext-pgsql. Exact current release and complete transitive native modules unpinned.\nExtensions: Required in stated source scope: pgsql\nLimitations: This web administration component is distinct from the PostgreSQL server itself. A PHP frontend dependency does not place PHP inside the database engine. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: PostgreSQL administration interface and session/configuration database access\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: phppgadmin/phppgadmin\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/phppgadmin/phppgadmin/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0284","name":"phpLDAPadmin","vendor":"phpLDAPadmin / leenooks project","category":"Monitoring and administration","version":"Not specified","summary":"The current source manifest explicitly requires PHP and LDAP-related extensions for the directory administration web application.","scope":"Inventory record: PHP-0284\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Inspected master manifest requires PHP ^8.5. Repository identifies the v2 application and says v1, originally for PHP 5, is deprecated; master is not applied to every released v2 build.\nExtensions: Required in stated source scope: fileinfo, ldap, iconv, openssl\nLimitations: Docker packaging and older v1/v2 releases have distinct requirements. LDAP server internals and administrator privileges are not inferred from this PHP frontend. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: LDAP directory browser/administration, authentication and session credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: PLA v2, leenooks/phpLDAPadmin\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/leenooks/phpLDAPadmin/blob/master/composer.json","https://github.com/leenooks/phpLDAPadmin"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0285","name":"LDAP Account Manager","vendor":"LDAP Account Manager project","category":"Monitoring and administration","version":"Not specified","summary":"The manual requires a PHP web environment and separates optional Perl lamdaemon from the PHP application.","scope":"Inventory record: PHP-0285\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Current official manual: PHP >=8.1 on Apache/nginx. Exact LAM release and plugin/module resolution not pinned.\nExtensions: Required in stated source scope: ldap, gettext, xml. Conditional/ambiguous: openssl is listed both with required modules and as optional in the same sentence; exact release requirement needs resolution; Plugins can require additional PHP extensions; Perl is for optional lamdaemon, not a PHP extension\nLimitations: The manual notes RPMs may omit an explicit PHP package dependency because distribution names differ. Package metadata absence is not absence of runtime use. Directory/home/host changes depend on configured rights. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Directory account/host management, uploads, session credentials and optional daemon actions\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: LAM, LDAPAccountManager/lam\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://www.ldap-account-manager.org/static/doc/manual/ch02.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0286","name":"FusionDirectory","vendor":"FusionDirectory","category":"Monitoring and administration","version":"Not specified","summary":"The versioned manual identifies a PHP identity-management web application with an independently operated LDAP server.","scope":"Inventory record: PHP-0286\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Version-1.4 requirements explicitly specify PHP 7.4. This is that documented branch’s runtime, not a verified current family-wide PHP matrix.\nExtensions: Required in stated source scope: curl, filter, gd, iconv, imagick, imap, json, mbstring, ldap, openssl, simplexml, xml. Conditional/ambiguous: The guide groups CAS and FPDF under extensions; these library identities are not automatically recorded as native PHP modules; Guide also describes optional legacy feature modules; exact contemporary ABI/configuration unresolved\nLimitations: PHP-library/extension terminology in the guide is broader than native extension loading. Do not equate CAS/FPDF package names or this old branch’s requirements with a modern resolved native build. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Identity, directory, account/workstation configuration and configured management integrations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: FusionDirectory IAM\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://fusiondirectory-user-manual.readthedocs.io/en/1.4/fusiondirectory/prerequisite/prerequisite.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0287","name":"FusionDirectory Orchestrator","vendor":"FusionDirectory","category":"Monitoring and administration","version":"Not specified","summary":"The vendor manual identifies Orchestrator as a PHP web application with its own version requirements and a separate FusionDirectory/LDAP dependency.","scope":"Inventory record: PHP-0287\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0286\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Guide labelled 1.5 documents Orchestrator 1.1 with PHP 7.4/8.0 and FusionDirectory 1.4 with configured tasks. The source scopes are not a current stable release claim.\nExtensions: Full required extension set unknown\nLimitations: This is distinct from the main directory application and from task agents/backends. Task permissions, execution environments and modern PHP compatibility remain unverified; no task was run. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Directory-related task orchestration, workflow configuration and accessible credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: FusionDirectory Orchestrator 1.1\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://fusiondirectory-user-manual.readthedocs.io/en/latest/fusiondirectory-orchestrator/prerequisite/prerequisite.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0288","name":"phpIPAM","vendor":"phpIPAM project","category":"Monitoring and administration","version":"Not specified","summary":"The project supplies branch-specific PHP ranges and separately documents PHP modules and optional CLI functions.","scope":"Inventory record: PHP-0288\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web runtime; optional PHP CLI scheduled scanning/status checks documented but not performed\nPHP version scope: Official repository matrix: 1.8.x / DEVELOP PHP 7.2–8.5; 1.7.x and 1.6.x PHP 7.2–8.3; 1.5.x/1.4.x PHP 5.4–7.4. These branch tests do not identify an installed build.\nExtensions: Required in stated source scope: pdo, pdo_mysql, sockets, openssl, gmp, json, filter, mbstring. Conditional/ambiguous: ldap for directory/AD support; simplexml for RIPE queries/API where needed; pcntl and PHP CLI for optional scanning/status checks; CLI is a SAPI, not an extension\nLimitations: Older installation prose is not a universal current support matrix. No scan, status check, endpoint query or discovered-network access was performed. Native GMP is an upstream dependency used through PHP, not a PHP-dependent product. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Address-space inventory, network metadata, authentication and optional scanning configuration\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: phpipam/phpipam\nConditional downstream consequence: A matching reachable PHP or loaded-extension flaw could cause denial of service, disclosure, integrity loss or code execution within the administration worker. Database or directory actions would depend on supplied/session/configured credentials and actual privileges. A PHP process is not automatically a database superuser, directory administrator, root account or route to another tenant.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/phpipam/phpipam","https://phpipam.net/documents/installation/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0289","name":"SnappyMail","vendor":"SnappyMail project","category":"Mail and analytics","version":"Not specified","summary":"The project documents PHP for its server-side webmail implementation and identifies its RainLoop lineage.","scope":"Inventory record: PHP-0289\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official README: PHP >=7.4 and mbstring. Exact application release, other mandatory modules and runtime build unknown.\nExtensions: Required in stated source scope: mbstring\nLimitations: The archive APIs described in the README do not alone prove every archive extension is mandatory. The browser UI and external IMAP/SMTP services are distinct; RainLoop’s older PHP range is not inherited. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Webmail, messages, attachments, authentication and mailbox session credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: the-djmaze/snappymail\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/the-djmaze/snappymail"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0290","name":"RainLoop Webmail","vendor":"RainLoop Team","category":"Mail and analytics","version":"Not specified","summary":"The vendor requirements explicitly specify PHP and distinguish optional contact-database support from the mail UI.","scope":"Inventory record: PHP-0290\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official legacy requirements list PHP >=5.4. Repository was archived 2024-11-04; the archived line’s current deployment population is unknown.\nExtensions: Required in stated source scope: curl, iconv, json, libxml, dom, openssl, pcre, spl. Conditional/ambiguous: DateTime support is listed, not a separately installed native module; Optional PDO plus selected database driver for contacts\nLimitations: Historical-only describes the archived source scope, not disappearance of deployments. Legacy browser/PHP requirements are not current deployment advice. SnappyMail is a separate maintained lineage with its own requirements. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Legacy webmail, messages, attachments, contacts and mailbox credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: RainLoop, RainLoop/rainloop-webmail\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://www.rainloop.net/docs/system-requirements/","https://github.com/RainLoop/rainloop-webmail"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0291","name":"PostfixAdmin","vendor":"PostfixAdmin project","category":"Mail and analytics","version":"Not specified","summary":"The project identifies a PHP-capable web application used to administer virtual users for a separate Postfix mail server.","scope":"Inventory record: PHP-0291\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official README: master PHP >=8.2; the separate 3.3 branch supports PHP >=7.0. Exact released artifact and complete module requirements unpinned.\nExtensions: Full required extension set unknown\nLimitations: PHP in this administrator does not prove PHP inside Postfix or Dovecot. Branch-specific compatibility and actual credentials/rights must be checked independently. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Mail-domain/user administration, mailbox/account database and configured service credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: postfixadmin/postfixadmin\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/postfixadmin/postfixadmin"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0292","name":"MailWatch for MailScanner","vendor":"MailWatch project","category":"Mail and analytics","version":"Not specified","summary":"The official repository explicitly describes a PHP web front end to the separate MailScanner system.","scope":"Inventory record: PHP-0292\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official README claims PHP 5.6 through PHP 8, with MySQL/MariaDB; no precise latest PHP minor or released build is pinned.\nExtensions: Full required extension set unknown\nLimitations: The broad PHP-8 wording is not proof of every minor/build. MailScanner, mail-transfer software and scanners are separate; frontend PHP does not automatically characterize their implementations. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Mail/security logs, quarantine management, reports and associated database credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: MailWatch, mailwatch/MailWatch\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/mailwatch/MailWatch"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0293","name":"SquirrelMail legacy documented webmail","vendor":"SquirrelMail project","category":"Mail and analytics","version":"Not specified","summary":"The old official installation manual explicitly requires a PHP-capable web server for the webmail application.","scope":"Inventory record: PHP-0293\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Legacy official administration manual requires PHP >=4.1.0 and discusses old register_globals/PHP compilation options. Current maintained branch compatibility is not established by that manual.\nExtensions: Required in stated source scope: session, pcre\nLimitations: Historical-only here describes the documented installation generation, not a claim that all SquirrelMail development or deployments ended. Obsolete settings and version recommendations are not adopted; current release/native modules remain open. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Legacy webmail, sessions, messages, attachments and mailbox credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: SquirrelMail legacy installation model\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://www.squirrelmail.org/docs/admin/admin-3.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0294","name":"Open Web Analytics","vendor":"Open Web Analytics project","category":"Mail and analytics","version":"Not specified","summary":"The official analytics application manifest explicitly requires PHP and a Composer merge plugin for module requirements.","scope":"Inventory record: PHP-0294\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Inspected master root manifest requires PHP >=8.2 and merges modules/*/composer.json. config.platform.php=8.2.0 is separate from the runtime requirement.\nExtensions: Full required extension set unknown\nLimitations: The root is not the complete module/dependency graph or an immutable release. Browser tracking code and external analytics services do not inherit a PHP runtime from the server. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Analytics collection, reports, data storage and configured integrations\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: OWA, Open-Web-Analytics/Open-Web-Analytics\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached by tracking/API requests, imported data, links, reports or background jobs could cause denial of service, disclosure, tampering or worker-level code execution. Analytics/customer data, configured integrations and responses/redirects could then be affected within application permissions. Browser execution, host privilege, remote service compromise and tenant escape are additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/Open-Web-Analytics/Open-Web-Analytics/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0295","name":"Mautic","vendor":"Mautic project","category":"Mail and analytics","version":"Not specified","summary":"The official installation guide documents PHP web settings and console execution for marketing automation.","scope":"Inventory record: PHP-0295\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web/front-controller environment and bin/console CLI installation/update/operations\nPHP version scope: Official 7.0-labelled install guide confirms PHP web/console operations but retains an old PHP 7.4 example. Inspected 7.x manifest has a PHP 8.2 resolution target; no verified effective released runtime minimum was derived from it.\nExtensions: Full required extension set unknown\nLimitations: config.platform.php and old Composer examples are not promoted to an application floor. The linked authoritative requirements page was inaccessible. Development DDEV services such as PHPMyAdmin/Mailhog are not assumed present in production. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Marketing/customer data, campaigns, forms, email delivery, reports and background jobs\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: mautic/mautic, Mautic marketing automation\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://docs.mautic.org/en/7.0/getting_started/how_to_install_mautic.html","https://github.com/mautic/mautic/blob/7.x/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0296","name":"phpList","vendor":"phpList project","category":"Mail and analytics","version":"Not specified","summary":"The official requirements explicitly identify PHP and warn that some functionality/modules and plugin requirements are conditional.","scope":"Inventory record: PHP-0296\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Current requirements page leads with PHP >=8.1 but retains 3.6.0 PHP >=7.0 and a July-2023 support note. Exact current release/PHP matrix and feature minima remain unresolved.\nExtensions: Full required extension set unknown. Conditional/ambiguous: For full functionality the guide lists curl, hash, iconv, imap, json, mbstring, mysqli, openssl, pcre and xml among its modules; the startup-mandatory subset is unresolved; GD required only by CKEditor plugin; plugins have independent requirements\nLimitations: Older requirements/support prose is not current upstream PHP support guidance. The guessed manual URL and direct GitHub reads failed; this official requirements page was actually read. Native SMTP services and hosted service internals remain separate. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Subscriber data, campaign content, mail delivery, tracking and administrative jobs\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: phpList 3, phpList newsletter manager\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://resources.phplist.com/system/start"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0297","name":"Shlink","vendor":"Shlink project","category":"Mail and analytics","version":"Not specified","summary":"Official package metadata identifies a PHP URL-shortening application with CLI/REST interfaces and direct runtime modules.","scope":"Inventory record: PHP-0297\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP HTTP/REST application and PHP CLI; exact worker/SAPI packaging not pinned\nPHP version scope: Registry advertises v5.1.7 (2026-09-21), PHP ^8.4. README supports 8.4/8.5. Root/transitive requirements can differ; no installed build was measured.\nExtensions: Required in stated source scope: curl, mbstring, pdo. Conditional/ambiguous: README additionally names json, intl, gd and gmp OR bcmath; sockets and bcmath for RabbitMQ integration; connector/worker modules depend on deployment\nLimitations: A separate web client or API consumer does not thereby use PHP. Registry downloads are not installations; source archives are PHP-version-specific and must be matched. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Redirects, link data, API keys, visit analytics and optional queue integration\nRelease pin: Registry-advertised v5.1.7, source reference 3f17ecf9334ea3d53beba0539e6f23a42454f5a3; immutable manifest retrieval failed\nSource accessed: 2026-10-17\nAliases: shlinkio/shlink, Shlink URL shortener\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached by tracking/API requests, imported data, links, reports or background jobs could cause denial of service, disclosure, tampering or worker-level code execution. Analytics/customer data, configured integrations and responses/redirects could then be affected within application permissions. Browser execution, host privilege, remote service compromise and tenant escape are additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://packagist.org/packages/shlinkio/shlink","https://github.com/shlinkio/shlink"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0298","name":"YOURLS","vendor":"YOURLS project","category":"Mail and analytics","version":"Not specified","summary":"The official project explicitly describes PHP scripts providing self-hosted URL shortening, statistics and plugins.","scope":"Inventory record: PHP-0298\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official README identifies a server-side set of PHP scripts. Precise current release, PHP range and mandatory/optional module list not independently established in this batch.\nExtensions: Full required extension set unknown\nLimitations: This confirms the PHP relationship, not a tested current PHP version or plugin graph. Remote link targets and browser clients do not inherit PHP from the redirect service. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Short-link redirects, analytics, administration and plugin execution\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: YOURLS/YOURLS, Your Own URL Shortener\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached by tracking/API requests, imported data, links, reports or background jobs could cause denial of service, disclosure, tampering or worker-level code execution. Analytics/customer data, configured integrations and responses/redirects could then be affected within application permissions. Browser execution, host privilege, remote service compromise and tenant escape are additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://github.com/YOURLS/YOURLS"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0299","name":"Sendy self-hosted application","vendor":"Sendy","category":"Mail and analytics","version":"Not specified","summary":"The vendor describes Sendy as a PHP-hosted application and separately identifies Amazon SES for sending mail.","scope":"Inventory record: PHP-0299\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Vendor product FAQ explicitly states standard hosting with PHP and MySQL/MariaDB. Exact Sendy/PHP version, encoded/bundled contents and modules remain unknown.\nExtensions: Full required extension set unknown\nLimitations: This is product FAQ evidence, not a customer testimonial or proof that Amazon SES uses PHP internally. Licensed release/source details and configured sending rights need separate verification; no compatibility probe was run. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: Subscriber and campaign data, tracking, uploads and configured sending credentials\nRelease pin: Version-scoped/moving official documentation or source branch; immutable release pin pending\nSource accessed: 2026-10-17\nAliases: Sendy newsletter software\nConditional downstream consequence: A matching PHP runtime or loaded-extension flaw reached through web requests, messages, attachments or PHP mail/admin jobs could cause denial of service, disclosure or worker-level code execution. Mail, subscriber data, quarantine metadata and configured or session-held credentials could be affected according to permissions. Native IMAP/SMTP/scanning services, browser/mobile clients, privileged host actions and tenant isolation require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://sendy.co/","https://sendy.co/get-started"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0300","name":"Matomo Analytics for WordPress","vendor":"Matomo / InnoCraft","category":"Mail and analytics","version":"Not specified","summary":"The publisher listing identifies server-side analytics processing in WordPress and version-gated PHP requirements for the coming Matomo-6 update.","scope":"Inventory record: PHP-0300\nCategory: Mail and analytics\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0027\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime; exact SAPI and any separate CLI phase deployment-dependent/unpinned\nPHP version scope: Official plugin listing advertises 5.13.1, structured PHP minimum 7.2.5; prose abbreviates 7.2. Upcoming Matomo 6 requires PHP >=8.1. Host WordPress requirements can raise the effective floor.\nExtensions: Full required extension set unknown\nLimitations: This overlaps standalone Matomo source and WordPress core; it is not another unique installation per relationship. Connect Matomo is a separate integration-only plugin, and browser/mobile tracking clients remain separate. No install/activation was performed. PHP presence does not establish an affected build, reachability or exploitation. Deployments, loaded modules and enabled features were not measured.\nPatch owner: Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates\nDownstream surface: WordPress-integrated tracking, reports, analytics database and PHP scheduled work\nRelease pin: Publisher plugin listing version 5.13.1; immutable plugin archive/SBOM and bundled Matomo build not verified\nSource accessed: 2026-10-17\nAliases: matomo WordPress plugin, Matomo Analytics WordPress distribution\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached by tracking/API requests, imported data, links, reports or background jobs could cause denial of service, disclosure, tampering or worker-level code execution. Analytics/customer data, configured integrations and responses/redirects could then be affected within application permissions. Browser execution, host privilege, remote service compromise and tenant escape are additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Application/module maintainer for product code; PHP package/image/hosting provider and deploying operator for compatible runtime/module updates","links":["https://wordpress.org/plugins/matomo/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0301","name":"Laminas MVC","vendor":"Laminas Project / Linux Foundation","category":"Frameworks and packages","version":"Not specified","summary":"The released package declares PHP and MVC application dependencies; official Laminas documentation labels MVC security-only maintenance.","scope":"Inventory record: PHP-0301\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.8.0 registry: ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0.\nExtensions: No complete required native-extension inventory established\nLimitations: Security-only maintenance is not proof of no remaining deployments. Optional MVC console and other modules are separate packages. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: MVC request dispatch, controllers, routing and application bootstrap\nRelease pin: Publisher registry scope 3.8.0; advertised source reference 53ba28b7222d3a3b49747a26babef43d1b17fb6f; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: laminas/laminas-mvc, Zend Framework MVC successor\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/laminas/laminas-mvc","https://docs.laminas.dev/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0302","name":"Mezzio","vendor":"Laminas Project / Mezzio","category":"Frameworks and packages","version":"Not specified","summary":"Publisher metadata identifies a PHP PSR-15 middleware framework with router, template and request-handler packages.","scope":"Inventory record: PHP-0302\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.28.1 registry: PHP ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0.\nExtensions: No complete required native-extension inventory established\nLimitations: A PSR interface and optional router/template implementation are separate packages; framework membership does not establish every adapter is loaded. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Middleware HTTP applications and API request pipelines\nRelease pin: Publisher registry scope 3.28.1; advertised source reference b67f3f4a090d444e94e1ef3c49085b8e313ad501; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: mezzio/mezzio, Zend Expressive successor\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/mezzio/mezzio","https://docs.laminas.dev/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0303","name":"CakePHP framework","vendor":"CakePHP project","category":"Frameworks and packages","version":"Not specified","summary":"CakePHP release metadata declares PHP, three direct native extensions and a monolithic replacement list for fifteen CakePHP component packages.","scope":"Inventory record: PHP-0303\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 5.4.3 registry: PHP >=8.2.\nExtensions: Required direct/documented subset: intl, json, mbstring; feature-specific: curl for more efficient HTTP calls; openssl for encryption or secure CSRF token generation\nLimitations: The fifteen replaced component package identities overlap this monolith; they must not be summed as independent installations. Root, dependency and feature-specific requirements remain distinct. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: MVC web applications, database and console services\nRelease pin: Publisher registry scope 5.4.3; advertised source reference 6f3dd91371ac0698b64024ddb21d57def9fbba91; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: cakephp/cakephp\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/cakephp/cakephp"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0304","name":"CodeIgniter 4 framework","vendor":"CodeIgniter Foundation","category":"Frameworks and packages","version":"Not specified","summary":"The released framework declares PHP and direct intl/mbstring requirements; its native database, image, cache and signal modules are feature-specific.","scope":"Inventory record: PHP-0304\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v4.7.5 registry: PHP ^8.2.\nExtensions: Required direct/documented subset: intl, mbstring; feature-specific: curl for CURLRequest; gd or imagick for chosen image adapter; mysqli/oci8/pgsql/sqlite3/sqlsrv for selected database; apcu/memcache/memcached/redis for selected cache; pcntl and posix for signals; sodium for SodiumHandler; simplexml for XML formatting\nLimitations: CodeIgniter 3 forks and pocketarc/codeigniter are not the same release line. Test-only DOM/EXIF/Xdebug suggestions were not promoted to mandatory production modules. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP web requests, CLI commands and selected data/image/cache handlers\nRelease pin: Publisher registry scope v4.7.5; advertised source reference a1f129d56df3278702a8d1048af955d0ebf68c03; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: codeigniter4/framework\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/codeigniter4/framework"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0305","name":"Yii 2 framework","vendor":"Yii Software / Yii project","category":"Frameworks and packages","version":"Not specified","summary":"Yii 2 release metadata declares a server PHP framework and separately lists lib-pcre and browser asset packages.","scope":"Inventory record: PHP-0305\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 2.0.55 registry: PHP >=7.4.0.\nExtensions: Required direct/documented subset: ctype, mbstring\nLimitations: lib-pcre is an upstream native library/platform requirement used by PHP, not a downstream PHP product. jQuery/inputmask/browser assets do not run the PHP interpreter. Yii 3 lineage is separate. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Server MVC applications, request handling and supporting application code\nRelease pin: Publisher registry scope 2.0.55; advertised source reference b900eecdb225041a4c4e0f5e0e5336f606a23bdb; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: yiisoft/yii2\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/yiisoft/yii2"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0306","name":"Slim framework","vendor":"Slim project","category":"Frameworks and packages","version":"Not specified","summary":"Slim is a PHP HTTP microframework; its package requires a separately chosen PSR-7 implementation and identifies XML parser modules as optional.","scope":"Inventory record: PHP-0306\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 4.15.3 registry: PHP ~7.4.0 or ~8.0.0 through ~8.5.0, using explicit minor-version alternatives.\nExtensions: Required direct/documented subset: json; feature-specific: simplexml and xml for XML body parsing\nLimitations: PSR-7 implementation choice is not resolved by the framework row. PHP compatibility in the README is broader wording than the explicit manifest minor ranges. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: HTTP middleware, routing and configured body parsers\nRelease pin: Publisher registry scope 4.15.3; advertised source reference 3675bf6baac66b07032575b7bef4200b60b7974b; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: slim/slim\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/slim/slim"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0307","name":"Nette framework metapackage","vendor":"Nette Foundation / Nette community","category":"Frameworks and packages","version":"Not specified","summary":"Nette 3.3.0 is a metapackage with a finite seventeen-name direct runtime package list; each name was independently checked for PHP use.","scope":"Inventory record: PHP-0307\nCategory: Frameworks and packages\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v3.3.0 has seventeen direct package requirements and no direct php constraint. Inspected Application/Bootstrap/Forms 3.3 and HTTP 3.4 require PHP 8.3–8.5; no complete version-locked graph was resolved.\nExtensions: No complete required native-extension inventory established\nLimitations: The metapackage does not itself imply seventeen installations or contain every runtime module. Open-ended >= constraints can resolve newer versions; the independently viewed Database default was a 4.0 prerelease, not a verified 3.2 stable graph. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Combined framework package selection; execution occurs in selected PHP components\nRelease pin: Publisher registry scope v3.3.0; advertised source reference ed088be41dd2833fe43966fd875bb903c931eb98; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/nette\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/nette"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0308","name":"Phalcon framework PHP extension","vendor":"Phalcon project","category":"Frameworks and packages","version":"Not specified","summary":"Official installation guides describe Phalcon as a compiled PHP extension, with distinct web/CLI loading and feature-specific companion modules.","scope":"Inventory record: PHP-0308\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native phalcon module in a compatible PHP web/CLI process; per-SAPI configuration differs\nPHP version scope: 5.23 documentation route still labels its PHP support sentence v5.20 and says >=8.1; 5.9 versioned guide also says >=8.1. Exact 5.23 binary ABI/compatibility is not independently verified.\nExtensions: No complete required native-extension inventory established; feature-specific: PDO plus selected database driver for database features; guide specifies load order; curl/fileinfo/gettext/gd/imagick/json/openssl/mbstring/cache extensions according to selected components\nLimitations: The current documentation route contains a stale internal version label and distinguishes Zephir source generation from ordinary module installation. No module was installed, built, loaded or inspected as a binary. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Native extension code and PHP framework application paths\nRelease pin: Version-scoped/moving official source; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: ext-phalcon, cphalcon\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://docs.phalcon.io/5.23/installation/","https://docs.phalcon.io/5.9/installation/","https://pecl.php.net/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0309","name":"API Platform Core","vendor":"API Platform project","category":"Frameworks and packages","version":"Not specified","summary":"The API framework core declares PHP and runtime Symfony components; Laravel/Doctrine and tooling entries in require-dev are not automatically mandatory production dependencies.","scope":"Inventory record: PHP-0309\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v5.0.4 registry declares PHP >=8.2 and Symfony ^7.4 || ^8.0 dependencies; the selected Symfony graph can raise the effective floor.\nExtensions: No complete required native-extension inventory established\nLimitations: The core package is not the entire API Platform distribution, admin UI or client generators. Optional integrations and require-dev do not establish remote-service backend implementation. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: API request processing, serialization, validation and application integration\nRelease pin: Publisher registry scope v5.0.4; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: api-platform/core\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/api-platform/core"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0310","name":"Yii Web extension abandoned prototype","vendor":"Yii Software / Yii project","category":"Frameworks and packages","version":"Not specified","summary":"The package registry explicitly marks this old PHP web extension abandoned and recommends yiisoft/yii-middleware instead.","scope":"Inventory record: PHP-0310\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: Inspected abandoned 2021 development branch: PHP ^7.4|^8.0.\nExtensions: Required direct/documented subset: dom, json\nLimitations: This old prototype must not stand in for the current Yii 3 architecture, release or support matrix. Abandonment does not establish that every installation disappeared. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Historical Yii web request integration\nRelease pin: Publisher registry scope dev-master / 3.0.x-dev dated 2021-11-10; advertised source reference 421515d06a5c039247fa945f674476ef26e6937e; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: yiisoft/yii-web\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/yiisoft/yii-web"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0311","name":"Symfony HttpFoundation component","vendor":"Symfony","category":"Frameworks and packages","version":"Not specified","summary":"PHP request, response, session and upload abstractions is distributed as an independently installable PHP package.","scope":"Inventory record: PHP-0311\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0018\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Invoked within host PHP CLI/web process; not an independent server\nPHP version scope: v8.1.9 registry: PHP >=8.4.1. This is not a universal minimum for earlier component branches.\nExtensions: No complete required native-extension inventory established\nLimitations: Component membership does not imply all Symfony components or the full framework are installed. The v7.4.0 source-manifest fetch failed; only the stated registry release declaration was read. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: HTTP requests, responses, uploaded-file and session objects\nRelease pin: Publisher registry scope v8.1.9; advertised source reference 7850897fb8659f98491b03be79ac48600bdaf9ab; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: symfony/http-foundation\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/symfony/http-foundation"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0312","name":"Symfony HttpKernel component","vendor":"Symfony","category":"Frameworks and packages","version":"Not specified","summary":"PHP HTTP kernel and request/response conversion pipeline is distributed as an independently installable PHP package.","scope":"Inventory record: PHP-0312\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0018\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Invoked within host PHP CLI/web process; not an independent server\nPHP version scope: v8.1.9 registry: PHP >=8.4.1. This is not a universal minimum for earlier component branches.\nExtensions: No complete required native-extension inventory established\nLimitations: Component membership does not imply all Symfony components or the full framework are installed. The v7.4.0 source-manifest fetch failed; only the stated registry release declaration was read. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: HTTP request lifecycle, events and controller handling\nRelease pin: Publisher registry scope v8.1.9; advertised source reference 55c6935bb4c004a72b55f723e79d5404881dcad3; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: symfony/http-kernel\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/symfony/http-kernel"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0313","name":"Symfony Console component","vendor":"Symfony","category":"Frameworks and packages","version":"Not specified","summary":"PHP command-line application framework is distributed as an independently installable PHP package.","scope":"Inventory record: PHP-0313\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0018\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI in an invoking application\nPHP version scope: v8.1.9 registry: PHP >=8.4.1. This is not a universal minimum for earlier component branches.\nExtensions: No complete required native-extension inventory established\nLimitations: Component membership does not imply all Symfony components or the full framework are installed. The v7.4.0 source-manifest fetch failed; only the stated registry release declaration was read. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Console commands and operational or build jobs\nRelease pin: Publisher registry scope v8.1.9; advertised source reference 630e74196a2635ec0f06c12bd3fb47cfedf85157; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: symfony/console\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/symfony/console"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0314","name":"Symfony Process component","vendor":"Symfony","category":"Frameworks and packages","version":"Not specified","summary":"PHP API for invoking and managing system subprocesses is distributed as an independently installable PHP package.","scope":"Inventory record: PHP-0314\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0018\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Invoked within host PHP CLI/web process; not an independent server\nPHP version scope: v8.1.9 registry: PHP >=8.4.1. This is not a universal minimum for earlier component branches.\nExtensions: No complete required native-extension inventory established\nLimitations: Component membership does not imply all Symfony components or the full framework are installed. The v7.4.0 source-manifest fetch failed; only the stated registry release declaration was read. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Host application subprocess launches and captured process I/O\nRelease pin: Publisher registry scope v8.1.9; advertised source reference 59a682fd049b2d4d37c444f5ac21b7d01b8c7189; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: symfony/process\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/symfony/process"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0315","name":"Symfony mbstring polyfill","vendor":"Symfony","category":"Frameworks and packages","version":"Not specified","summary":"The PHP package provides the ext-mbstring Composer platform capability while implementing a fallback and directly requiring iconv.","scope":"Inventory record: PHP-0315\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0018\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v1.43.0 registry: PHP >=7.2.\nExtensions: Required direct/documented subset: iconv; optional: mbstring for performance\nLimitations: Composer provides ext-mbstring is not proof that a native mbstring shared module is installed or loaded. The fallback has its own native iconv requirement. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Userland multibyte-string fallback inside consuming PHP applications\nRelease pin: Publisher registry scope v1.43.0; advertised source reference 4d5d331bf731e0aedbc6b2f5e61135b7b7996a72; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: symfony/polyfill-mbstring\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/symfony/polyfill-mbstring"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0316","name":"Twig template engine","vendor":"Twig / Symfony community","category":"Frameworks and packages","version":"Not specified","summary":"Twig compiles templates to PHP; its stable 3.x documentation and the registry default alpha describe distinct compatibility scopes.","scope":"Inventory record: PHP-0316\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: Official 3.x introduction: PHP >=8.1.0. Registry default is v4.0.0-alpha1 with PHP >=8.2; alpha metadata/source reference is not a stable 3.x release pin.\nExtensions: No complete required native-extension inventory established\nLimitations: A template engine or sandbox is not proof of a currently reachable PHP flaw. Symfony polyfills are PHP packages, not proof of native ctype/mbstring loading. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Server-side template compilation and rendering\nRelease pin: Publisher registry scope 3.x documentation; registry default v4.0.0-alpha1; advertised source reference 6931c9256aa2c635338d821b623cff226402dbd7; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: twig/twig\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/twig/twig","https://twig.symfony.com/doc/3.x/intro.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0317","name":"Monolog","vendor":"Jordi Boggiano / Monolog contributors","category":"Frameworks and packages","version":"Not specified","summary":"Monolog is a PHP logging library; handler-dependent modules and service clients are optional, and several integrations appear only in require-dev.","scope":"Inventory record: PHP-0317\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.12.1 registry: PHP >=8.1.\nExtensions: No complete required native-extension inventory established; feature-specific: amqp for AMQP handler; curl for named webhook/HTTP handlers; mbstring for Unicode handling; mongodb for MongoDB handler; openssl for SSL transport; sockets for UDP syslog\nLimitations: A logging interface or optional cloud client does not prove the destination service is implemented in PHP. A require-dev dependency is not a mandatory deployed handler. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Application log formatting and configured transports/handlers\nRelease pin: Publisher registry scope 3.12.1; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: monolog/monolog\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/monolog/monolog"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0318","name":"Guzzle HTTP client","vendor":"Guzzle project","category":"Frameworks and packages","version":"Not specified","summary":"Guzzle declares a PHP HTTP client with promises and PSR-7 packages; cURL is a chosen-handler requirement rather than an unconditional root runtime requirement.","scope":"Inventory record: PHP-0318\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 8.2.0 registry: PHP ^7.4 || ^8.0.\nExtensions: Required direct/documented subset: json; feature-specific: curl for cURL handler; intl for IDN support\nLimitations: This is caller-side PHP and proves nothing about contacted service backends. cURL appears in require-dev as well as a feature suggestion; do not infer it is universally loaded. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Outbound HTTP requests, streams, responses and configured client middleware\nRelease pin: Publisher registry scope 8.2.0; advertised source reference 93939470950a9b11e2e84204166ef5e048c55fe4; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: guzzlehttp/guzzle\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/guzzlehttp/guzzle"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0319","name":"Doctrine ORM","vendor":"Doctrine project","category":"Frameworks and packages","version":"Not specified","summary":"The PHP ORM release requires DBAL and other PHP packages; database extension choice is inherited from the chosen driver graph, not universal PDO presence.","scope":"Inventory record: PHP-0319\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.7.5 registry: PHP ^8.1; selected DBAL ^3.8.2 || ^4 and Symfony components may raise the effective application floor.\nExtensions: Required direct/documented subset: ctype; feature-specific: dom for XML mapping XSD validation; deepclone for optional performance path\nLimitations: The root floor is not the complete selected driver/framework graph. Native database server implementation is separate from the PHP ORM. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Object/database mapping, query generation and mapping metadata\nRelease pin: Publisher registry scope 3.7.5; advertised source reference 00c2fd70da291cca1ec75f4dae5344fe3df588fa; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: doctrine/orm\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/doctrine/orm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0320","name":"Doctrine DBAL","vendor":"Doctrine project","category":"Frameworks and packages","version":"Not specified","summary":"DBAL is a PHP database abstraction layer; official configuration documents alternative native-extension drivers and custom driver classes.","scope":"Inventory record: PHP-0320\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 4.5.0 registry: PHP ^8.2. Additional driver examples were read in the separate 4.4 configuration guide.\nExtensions: No complete required native-extension inventory established; feature-specific: selected driver: pdo_mysql, mysqli, pdo_sqlite, sqlite3, pdo_pgsql, pgsql, pdo_oci, pdo_sqlsrv, sqlsrv, oci8 or ibm_db2; not all simultaneously\nLimitations: The 4.4 driver guide does not independently verify every 4.5 driver build. No one extension is universal across all supported configurations. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Database connections, SQL/schema operations and data conversion\nRelease pin: Publisher registry scope 4.5.0; advertised source reference c435cd7ea33e17d2a89288caf994cf3d4549b879; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: doctrine/dbal\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/doctrine/dbal","https://www.doctrine-project.org/projects/doctrine-dbal/en/4.4/reference/configuration.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0321","name":"PHPMailer","vendor":"PHPMailer project","category":"Frameworks and packages","version":"Not specified","summary":"The PHP mail creation/transport class declares three direct extension requirements and feature-specific mail/encoding integrations.","scope":"Inventory record: PHP-0321\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v7.1.1 publisher registry declares PHP >=5.5.0; compatibility declaration is not current PHP security support.\nExtensions: Required direct/documented subset: ctype, filter, hash; feature-specific: imap for advanced RFC822 address parsing; mbstring or documented PHP polyfill for multibyte handling; openssl for secure SMTP/DKIM\nLimitations: The client library is not the native SMTP/IMAP server or a remote mail provider. OAuth provider packages and alternative multibyte fallback are separate optional dependencies. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Mail address/header/body creation, SMTP and configured authentication/signing\nRelease pin: Publisher registry scope v7.1.1; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: phpmailer/phpmailer\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/phpmailer/phpmailer"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0322","name":"Flysystem","vendor":"The PHP League","category":"Frameworks and packages","version":"Not specified","summary":"Flysystem supplies a PHP storage abstraction with a separately documented adapter set and distinct require-dev integrations.","scope":"Inventory record: PHP-0322\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.36.0 registry: PHP ^8.0.2, with flysystem-local and MIME detection packages.\nExtensions: No complete required native-extension inventory established\nLimitations: Root require-dev fileinfo/FTP/ZIP entries are not automatically mandatory production modules. Transitive MIME/local-adapter requirements and cloud SDKs need independent resolution; a storage adapter does not prove provider backend PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Filesystem and selected storage-adapter operations\nRelease pin: Publisher registry scope 3.36.0; advertised source reference f7fb152932f30072d573510cbd4dd657d6475b25; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: league/flysystem\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/league/flysystem"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0323","name":"phpseclib","vendor":"phpseclib project","category":"Frameworks and packages","version":"Not specified","summary":"The library implements cryptography and secure communications in PHP; native crypto acceleration and XML-key features are optional.","scope":"Inventory record: PHP-0323\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 4.0.2 registry: PHP >=8.1. Earlier 3.x is a distinct release line.\nExtensions: No complete required native-extension inventory established; feature-specific: dom for XML-formatted public keys; gmp and openssl for acceleration; libsodium as named by registry for some SSH/SFTP algorithms; exact current module naming unresolved\nLimitations: Pure PHP implementation is not proof of native OpenSSL/GMP/sodium loading. Crypto library presence does not establish a matching flaw or remote service implementation. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP crypto, key/certificate parsing, SSH2 and SFTP client code\nRelease pin: Publisher registry scope 4.0.2; advertised source reference 1fe20b9acb08ce810cec24d8a9d02e7c13426e4c; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: phpseclib/phpseclib\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/phpseclib/phpseclib"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0324","name":"Ramsey UUID","vendor":"Ben Ramsey / Ramsey project","category":"Frameworks and packages","version":"Not specified","summary":"The PHP UUID package uses PHP math/collection dependencies and suggests native modules only for selected acceleration or generator paths.","scope":"Inventory record: PHP-0324\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 4.9.4 registry: PHP ^8.0.\nExtensions: No complete required native-extension inventory established; feature-specific: bcmath or gmp for faster arithmetic; uuid for PECL UUID generators\nLimitations: Replaces rhumsaa/uuid is package lineage, not a second independent installation. No native UUID/BCMath/GMP module is proven loaded. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: UUID generation, representation and optional generation adapters\nRelease pin: Publisher registry scope 4.9.4; advertised source reference 75d73f48d02797c2c285a7e9f348fadc0102ffe2; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: ramsey/uuid\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/ramsey/uuid"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0325","name":"Carbon date/time library","vendor":"CarbonPHP project","category":"Frameworks and packages","version":"Not specified","summary":"Carbon is a PHP DateTime API library with translation, clock and polyfill dependencies.","scope":"Inventory record: PHP-0325\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.14.2 registry: PHP ^8.1.\nExtensions: Required direct/documented subset: json\nLimitations: The word extension describes a PHP API/library extension here, not a native shared PHP module. Host framework and selected dependencies can impose a higher PHP floor. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Application date/time handling, parsing and localized output\nRelease pin: Publisher registry scope 3.14.2; advertised source reference 94cfc34887f07ab5c0efa07914c8f527544e3224; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nesbot/carbon\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nesbot/carbon"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0326","name":"SimpleSAMLphp","vendor":"SimpleSAMLphp project","category":"Frameworks and packages","version":"Not specified","summary":"SimpleSAMLphp is a PHP SAML service-provider/identity-provider application with explicit PHP and extension requirements.","scope":"Inventory record: PHP-0326\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v2.5.3.1 registry: PHP ^8.3 and Composer runtime API ^2.2.\nExtensions: Required direct/documented subset: date, dom, fileinfo, filter, hash, json, libxml, mbstring, openssl, pcre, session, simplexml, spl, zlib; feature-specific: curl for automatic update checks; intl for non-English translations; ldap/memcache/PDO or selected database extensions for chosen backends\nLimitations: Other branches and hosted identity services need separate evidence. Legacy ext-mysql wording in suggestions is not silently adopted as a valid current PHP module recommendation. Built-in date/SPL entries are kept as declared platform modules. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Federation request/response processing, authentication, keys and session state\nRelease pin: Publisher registry scope v2.5.3.1; advertised source reference e049be1819327c76403fc0d6fa648d6dcfbc8516; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: simplesamlphp/simplesamlphp\nConditional downstream consequence: A matching PHP/XML/crypto-extension flaw reached by federation or authentication processing could cause denial of service, disclosure or worker-level code execution. Identity data, configured keys and trust decisions could then be affected within application permissions. This is not evidence of an existing authentication bypass.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/simplesamlphp/simplesamlphp"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0327","name":"webonyx GraphQL-PHP","vendor":"webonyx / GraphQL-PHP project","category":"Frameworks and packages","version":"Not specified","summary":"This package implements GraphQL in PHP and declares optional AMPHP/ReactPHP integrations separately.","scope":"Inventory record: PHP-0327\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v15.38.1 registry: PHP ^7.4 || ^8.\nExtensions: Required direct/documented subset: json, mbstring\nLimitations: GraphQL as a protocol is not a PHP dependency. A PHP implementation does not establish other GraphQL servers or clients use PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: GraphQL parsing, schema validation, query execution and resolvers in a host application\nRelease pin: Publisher registry scope v15.38.1; advertised source reference 32edc67af119b709d020f93447729afd503fe56a; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: webonyx/graphql-php\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/webonyx/graphql-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0328","name":"ReactPHP EventLoop","vendor":"ReactPHP project","category":"Frameworks and packages","version":"Not specified","summary":"ReactPHP provides a PHP event loop with a stream_select default that works without installing a separate event-loop extension.","scope":"Inventory record: PHP-0328\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Long-running PHP CLI process; a separate loop extension is optional\nPHP version scope: v1.6.0 registry says PHP >=5.3.0; inspected README says supported PHP 7.1 through current 8+. This declaration/support-scope difference remains unresolved.\nExtensions: No complete required native-extension inventory established; feature-specific: pcntl for StreamSelectLoop signal handling; optional native event-loop extensions for selected implementations\nLimitations: ReactPHP is not the JavaScript React UI library. Declared old minima, currently supported/tested versions and chosen optional loop implementations are distinct. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Long-running PHP CLI loops, timers, streams and supported signal handlers\nRelease pin: Publisher registry scope v1.6.0; advertised source reference ba276bda6083df7e0050fd9b33f66ad7a4ac747a; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: react/event-loop\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/react/event-loop"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0329","name":"AMP asynchronous PHP framework","vendor":"AMPHP project","category":"Frameworks and packages","version":"Not specified","summary":"AMP is a PHP asynchronous programming library with a PHP runtime constraint and a separate event-loop dependency.","scope":"Inventory record: PHP-0329\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP process using AMP; commonly CLI workers, exact application SAPI not measured\nPHP version scope: v3.1.3 registry: PHP >=8.1 and revolt/event-loop ^1 || ^0.2.\nExtensions: No complete required native-extension inventory established\nLimitations: The native extension/module set of the selected Revolt loop was not resolved. Async PHP library presence does not establish an exposed application listener. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Concurrent/fiber-based PHP application tasks and long-running workers\nRelease pin: Publisher registry scope v3.1.3; advertised source reference 73c38b323ff8d790abf0f76c56fcc892bda4111a; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: amphp/amp\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/amphp/amp"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0330","name":"PSR logging interfaces package","vendor":"PHP-FIG","category":"Frameworks and packages","version":"Not specified","summary":"The package distributes PHP interfaces/classes/traits for PSR-3 and explicitly does not provide a logger implementation.","scope":"Inventory record: PHP-0330\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: 3.0.2 registry: PHP >=8.0.0.\nExtensions: No complete required native-extension inventory established\nLimitations: The textual PSR standard is not an executable runtime and this interface package is not Monolog or another logger. A provides psr/log-implementation virtual capability is also not automatically a separate installed product. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP logging type contracts loaded by consuming applications\nRelease pin: Publisher registry scope 3.0.2; advertised source reference f16e1d5863e37f8d8c2a01719f5b34baa2b714d3; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: psr/log\nConditional downstream consequence: These PHP interfaces are not a standalone network listener, parser or logger implementation. A matching host PHP-runtime flaw could affect applications that load them, but this relationship supplies no independent reachable attack surface or implementation-specific vulnerability claim.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/psr/log"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0331","name":"PHP-Parser userland parser","vendor":"Nikita Popov / PHP-Parser contributors","category":"Development and build","version":"Not specified","summary":"PHP-Parser is implemented in PHP and declares native tokenizer/json requirements for parsing source into an abstract syntax tree.","scope":"Inventory record: PHP-0331\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v5.9.0 registry: PHP >=7.4.\nExtensions: Required direct/documented subset: json, tokenizer\nLimitations: Parsing source into an AST does not by itself execute that source. The parser library is separate from the PHP engine native parser and from consuming analysis tools. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Static analysis, source transformation and application-embedded parsing\nRelease pin: Publisher registry scope v5.9.0; advertised source reference 9e33da9553fe7786f0962b35f4e4ecf01be89def; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nikic/php-parser\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while parsing untrusted package, source, archive or build metadata could affect the build/installer process and its credentials or generated artifacts. Normal package/plugin execution is not itself evidence of a PHP vulnerability. Production impact requires an additional propagation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nikic/php-parser"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0332","name":"phpdotenv","vendor":"Vance Lucas / Graham Campbell / phpdotenv contributors","category":"Frameworks and packages","version":"Not specified","summary":"The PHP library loads .env configuration and depends on PHP polyfill packages; boolean validation adds an optional filter requirement.","scope":"Inventory record: PHP-0332\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP web runtime and/or CLI; exact SAPI and invocation deployment-dependent\nPHP version scope: v5.7.0 registry: PHP ^7.2.5 || ^8.0.\nExtensions: Required direct/documented subset: pcre; feature-specific: filter for boolean validator\nLimitations: A configuration library is not a secrets vault, independent service or proof of exposed .env files. Polyfill dependencies are not proof of native ctype/mbstring loading. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Application configuration parsing and environment initialization\nRelease pin: Publisher registry scope v5.7.0; advertised source reference 301c07936b16d88628b126b01d082ba153cf4c40; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: vlucas/phpdotenv\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/vlucas/phpdotenv"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0333","name":"Nette Application","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"MVC kernel and application request dispatch are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0333\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.3.0 registry: PHP 8.3 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: MVC kernel and application request dispatch\nRelease pin: Publisher registry scope v3.3.0; advertised source reference 104484c317fdb1b29baf77617ca040b97685e9bb; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/application\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/application"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0334","name":"Nette Assets","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP-side asset mapping, versioning and storage integration are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0334\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v1.0.7 registry: PHP 8.1 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP-side asset mapping, versioning and storage integration\nRelease pin: Publisher registry scope v1.0.7; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/assets\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/assets"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0335","name":"Nette Bootstrap","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP application bootstrap and configuration loading are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0335\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.3.0 registry: PHP 8.3 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP application bootstrap and configuration loading\nRelease pin: Publisher registry scope v3.3.0; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/bootstrap\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/bootstrap"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0336","name":"Nette Caching","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP caching abstractions and selected storage are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0336\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.4.2 registry: PHP 8.1 - 8.5.\nExtensions: No complete required native-extension inventory established; feature-specific: pdo_sqlite for SQLite cache storage/journal\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP caching abstractions and selected storage\nRelease pin: Publisher registry scope v3.4.2; advertised source reference 31f4bc6b366e6896998bd4538b26fa88a627bf2b; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/caching\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/caching"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0337","name":"Nette Command Line","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP command-line interface utilities are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0337\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI\nPHP version scope: v1.9.2 registry: PHP 8.2 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP command-line interface utilities\nRelease pin: Publisher registry scope v1.9.2; advertised source reference 42a6ea85f8b203ca1bd793327c526009c2525cc7; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/command-line\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/command-line"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0338","name":"Nette Database","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP database access and abstraction are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0338\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v4.0.0-RC1 registry: PHP 8.1 - 8.4.\nExtensions: Required direct/documented subset: pdo\nLimitations: The registry default is a release candidate; this is not a stable 3.2 requirements pin or a resolved Nette 3.3 graph. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP database access and abstraction\nRelease pin: Publisher registry scope v4.0.0-RC1; advertised source reference 0084e7360ba877e8a16c4bdf79c86bd8440c6242; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/database\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/database"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0339","name":"Nette DI","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP dependency injection and container compilation are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0339\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.2.7 registry: PHP 8.1 - 8.5.\nExtensions: Required direct/documented subset: ctype, tokenizer\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP dependency injection and container compilation\nRelease pin: Publisher registry scope v3.2.7; advertised source reference 7b00ce16011f628e5861a81a2dbf74edcd4e97cd; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/di\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/di"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0340","name":"Nette Forms","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"Server PHP form handling and validation are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0340\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.3.0 registry: PHP 8.3 - 8.5.\nExtensions: No complete required native-extension inventory established; feature-specific: intl for date/time controls\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Server PHP form handling and validation\nRelease pin: Publisher registry scope v3.3.0; advertised source reference 90aac9e6a55a71a76aaead65bca1129acb41ec84; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/forms\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/forms"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0341","name":"Nette HTTP","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP requests, uploaded-file handling, URLs and sessions are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0341\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.4.1 registry: PHP 8.3 - 8.5.\nExtensions: No complete required native-extension inventory established; feature-specific: fileinfo for upload MIME detection; gd for upload image helpers; intl for URL punycode; session for session class\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP requests, uploaded-file handling, URLs and sessions\nRelease pin: Publisher registry scope v3.4.1; advertised source reference ceebf08f42a3de756a0cfe74d9b88d51155774a5; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/http\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/http"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0342","name":"Nette Mail","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP mail construction and sending are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0342\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v4.2.1 registry: PHP 8.2 - 8.5.\nExtensions: Required direct/documented subset: iconv; feature-specific: dom for CSS inliner; fileinfo for attachment MIME detection; intl for IDN recipient domains; openssl for RSA DKIM; sodium for Ed25519 DKIM\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP mail construction and sending\nRelease pin: Publisher registry scope v4.2.1; advertised source reference b9b82b47f2e38050ae718877efc3ce82bd201a90; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/mail\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/mail"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0343","name":"Nette PHP Generator","vendor":"Nette community","category":"Development and build","version":"Not specified","summary":"PHP source generation and optional source-body parsing are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0343\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v4.2.2 registry: PHP 8.1 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: Source generation can be used during builds and at runtime by DI. Optional nikic/php-parser body-import functionality is a PHP package, not another native module. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP source generation and optional source-body parsing\nRelease pin: Publisher registry scope v4.2.2; advertised source reference 0d7060926f5c3e8c488b9b9ced42d857f12a34b5; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/php-generator\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while parsing untrusted package, source, archive or build metadata could affect the build/installer process and its credentials or generated artifacts. Normal package/plugin execution is not itself evidence of a PHP vulnerability. Production impact requires an additional propagation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/php-generator"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0344","name":"Nette RobotLoader","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP class discovery, source analysis, autoloading and cache are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0344\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v4.1.3 registry: PHP 8.1 - 8.5.\nExtensions: Required direct/documented subset: tokenizer\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP class discovery, source analysis, autoloading and cache\nRelease pin: Publisher registry scope v4.1.3; advertised source reference 44dba0bbb9cb521a3fed15046d3294c85dabe516; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/robot-loader\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/robot-loader"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0345","name":"Nette SafeStream","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP safe/atomic file stream handling are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0345\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.0.4 registry: PHP 8.0 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP safe/atomic file stream handling\nRelease pin: Publisher registry scope v3.0.4; advertised source reference f37cf82709f78550e752c599169289b9b73fdca1; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/safe-stream\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/safe-stream"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0346","name":"Nette Security","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP authentication, authorization and ACL handling are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0346\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.2.6 registry: PHP 8.1 - 8.5.\nExtensions: No complete required native-extension inventory established\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP authentication, authorization and ACL handling\nRelease pin: Publisher registry scope v3.2.6; advertised source reference 6cad44dbac2153bccf36e73784a38c43d7cdae8b; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/security\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/security"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0347","name":"Nette Utils","vendor":"Nette community","category":"Frameworks and packages","version":"Not specified","summary":"PHP utility functions and selected image/string/JSON helpers are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0347\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v4.1.5 registry: PHP 8.2 - 8.5.\nExtensions: No complete required native-extension inventory established; feature-specific: gd for images; iconv/intl/mbstring for selected string methods; json for JSON helpers; tokenizer for selected reflection helper\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP utility functions and selected image/string/JSON helpers\nRelease pin: Publisher registry scope v4.1.5; advertised source reference b043439dbdf954e6c28b5ea7e34b0100f83165e0; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: nette/utils\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/nette/utils"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0348","name":"Tracy debugger","vendor":"Nette community / Tracy","category":"Development and build","version":"Not specified","summary":"PHP debugging, diagnostics and error handling are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0348\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v2.12.1 registry: PHP 8.2 - 8.5.\nExtensions: Required direct/documented subset: json, session\nLimitations: Development diagnostics and production error logging/configuration must be distinguished; no exposed debug page is inferred. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP debugging, diagnostics and error handling\nRelease pin: Publisher registry scope v2.12.1; advertised source reference 90d24872cd97202f79281aac7eb09c27ec48bf69; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: tracy/tracy\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while parsing untrusted package, source, archive or build metadata could affect the build/installer process and its credentials or generated artifacts. Normal package/plugin execution is not itself evidence of a PHP vulnerability. Production impact requires an additional propagation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/tracy/tracy"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0349","name":"Latte template engine","vendor":"Nette community / Latte","category":"Frameworks and packages","version":"Not specified","summary":"PHP template compilation and rendering are implemented in this independently identifiable PHP package.","scope":"Inventory record: PHP-0349\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0307\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Host PHP runtime; web/CLI use depends on consuming application\nPHP version scope: v3.1.6 registry: PHP 8.2 - 8.5.\nExtensions: Required direct/documented subset: json, tokenizer\nLimitations: This is a separately installable PHP package also selected by the Nette metapackage; no claim that browser assets or every optional feature execute PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: PHP template compilation and rendering\nRelease pin: Publisher registry scope v3.1.6; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: latte/latte\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while a host application invokes this library could cause denial of service, disclosure or worker-level code execution. Consequences inherit host data and credential permissions. Package presence alone does not establish invocation, an attacker-controlled input path or any remote-service compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://packagist.org/packages/latte/latte"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0350","name":"PHP Installer for Extensions (PIE)","vendor":"The PHP Foundation / PHP PIE project","category":"Development and build","version":"Not specified","summary":"The official README identifies a PHP-based extension installer, distinguishes its PHP execution version from the target, and points to the paginated Packagist extension catalogue.","scope":"Inventory record: PHP-0350\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI running a PHAR; target interpreter/ABI can differ\nPHP version scope: Current README requires PHP >=8.1 for PIE itself; it can target a different installed PHP version. Examples mention 1.4/1.5 features, not an independently pinned latest PHAR.\nExtensions: No complete required native-extension inventory established\nLimitations: Linux/macOS build tooling and precompiled Windows packages are different paths. No extension, PHAR, build tool or retrieved code was installed or executed. Main/1.x and attempted release manifests were unavailable. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Extension package selection, metadata, build orchestration and target configuration\nRelease pin: Version-scoped/moving official source; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: pie.phar, PHP PIE\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while parsing untrusted package, source, archive or build metadata could affect the build/installer process and its credentials or generated artifacts. Normal package/plugin execution is not itself evidence of a PHP vulnerability. Production impact requires an additional propagation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://github.com/php/pie","https://pecl.php.net/","https://packagist.org/extensions"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0351","name":"PEAR Base System","vendor":"PEAR project / PHP Group","category":"Development and build","version":"Not specified","summary":"The official PEAR package page identifies the installer/base PHP error-handling classes and published version/runtime dependencies.","scope":"Inventory record: PHP-0351\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI installer and included PHP classes\nPHP version scope: Official package page lists stable PEAR 1.10.18 released 2026-01-25 and PHP >=5.4.0 as a dependency.\nExtensions: No complete required native-extension inventory established\nLimitations: PEAR Base System is not every PEAR or PECL package. PECL catalogue deprecation does not remove historical installations or establish current support for all old PHP versions. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Package metadata, archive installation and PEAR runtime utility classes\nRelease pin: Version-scoped/moving official source; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: PEAR installer, pear/pear-core\nConditional downstream consequence: A matching PHP or loaded-extension flaw reached while parsing untrusted package, source, archive or build metadata could affect the build/installer process and its credentials or generated artifacts. Normal package/plugin execution is not itself evidence of a PHP vulnerability. Production impact requires an additional propagation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://pear.php.net/package/PEAR","https://github.com/pear/pear-core","https://pecl.php.net/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0352","name":"Packagist.org open-source web application","vendor":"Composer / Packagist project","category":"Development and build","version":"Not specified","summary":"The official Packagist source manifest requires PHP and three native extensions; its README explicitly identifies PHP as the web application implementation.","scope":"Inventory record: PHP-0352\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP server web application; separate workers/services and actual deployment build unmeasured\nPHP version scope: Inspected main manifest: PHP ^8.4, with config.platform.php 8.4.11 as a resolver target, not a measured loaded runtime.\nExtensions: Required direct/documented subset: apcu, ctype, iconv\nLimitations: This confirms published application source, not exact production runtime, all Private Packagist internals or every package hosted on the registry. Other supporting services are not automatically PHP. PHP presence is not proof of an affected build, reachable flaw or exploitation. Loaded extensions, deployed builds and installations were not measured. Direct manifest requirements are not a fully resolved host-application graph.\nPatch owner: Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates\nDownstream surface: Registry package web/API application and its configured metadata processing\nRelease pin: Version-scoped/moving official source; released source bytes, lock graph and signatures not independently verified\nSource accessed: 2026-10-17\nAliases: composer/packagist.org, Packagist web application source\nConditional downstream consequence: A matching PHP engine or loaded-extension flaw reached through requests, uploads, serialization or background input could cause denial of service, disclosure or PHP-worker code execution. Application data, credentials and output integrity could be affected within worker permissions. Host privilege, tenant escape and lateral movement need additional conditions.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Library/framework maintainer for package code; PHP package/image/hosting provider and deploying operator for compatible runtime and native-module updates","links":["https://github.com/composer/packagist/blob/main/composer.json","https://github.com/composer/packagist/blob/main/README.md"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0353","name":"Docker Official PHP CLI image variant","vendor":"Docker Official Images / docker-library PHP maintainers","category":"Containers and distribution","version":"Not specified","summary":"The tag manifest lists patched stable CLI build directories; the selected Alpine recipe sets PHP_VERSION 8.5.12.","scope":"Inventory record: PHP-0353\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0032\nEvidence status: Vendor-confirmed fixed image definitions\nDeployment status: Not measured\nPHP surface: CLI interpreter; php-cgi availability documented for CLI variant\nPHP version scope: Bounded stable PHP 8.5.12 matrix at source commit f6048b5f6e3c2202ee082665a4ccc0d90de291a3; not RC tags or all PHP branches\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: All variants also contain a CLI binary; CLI presence is not a web listener. Fourteen PHP 8.5.12 source directories are a bounded catalogue sample, not every supported PHP branch or an image digest inventory. OS tag and architecture affect native ABI. A source commit does not verify built image bytes. Operators must pull rebuilt images and rebuild/redeploy derived images and running containers.\nPatch owner: Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: PHP 8.5.12 build source f6048b5f6e3c2202ee082665a4ccc0d90de291a3; variant cli; image content digest unverified\nSource accessed: 2026-10-21\nAliases: docker.io/library/php:cli\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Official Docker PHP image source definitions and official-images metadata were updated to PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests still need verification.\nCVE-2026-109618: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE-2026-109619: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE assessment limit: Vendor source establishes updated source definitions and official-images metadata, not deployed image bytes; operator rollout remains unmeasured.","owner":"Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout","links":["https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/alpine3.24/cli/Dockerfile","https://github.com/docker-library/official-images/blob/master/library/php","https://github.com/docker-library/php/pull/1694","https://github.com/docker-library/official-images/pull/22541"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."}}},{"id":"PHP-0354","name":"Docker Official PHP Apache/mod_php image variant","vendor":"Docker Official Images / docker-library PHP maintainers","category":"Containers and distribution","version":"Not specified","summary":"The official guide identifies the Apache variant as PHP loaded into Apache; the tag manifest lists Debian trixie and bookworm builds.","scope":"Inventory record: PHP-0354\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0032\nEvidence status: Vendor-confirmed fixed image definitions\nDeployment status: Not measured\nPHP surface: Apache module with mpm_prefork, plus PHP CLI\nPHP version scope: Bounded stable PHP 8.5.12 matrix at source commit f6048b5f6e3c2202ee082665a4ccc0d90de291a3; not RC tags or all PHP branches\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: The Apache recipe pin is advertised by the manifest. No Alpine Apache directory occurs in this bounded matrix. Fourteen PHP 8.5.12 source directories are a bounded catalogue sample, not every supported PHP branch or an image digest inventory. OS tag and architecture affect native ABI. A source commit does not verify built image bytes. Operators must pull rebuilt images and rebuild/redeploy derived images and running containers.\nPatch owner: Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: PHP 8.5.12 build source f6048b5f6e3c2202ee082665a4ccc0d90de291a3; variant apache; image content digest unverified\nSource accessed: 2026-10-21\nAliases: docker.io/library/php:apache\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Official Docker PHP image source definitions and official-images metadata were updated to PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests still need verification.\nCVE-2026-109618: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE-2026-109619: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE assessment limit: Vendor source establishes updated source definitions and official-images metadata, not deployed image bytes; operator rollout remains unmeasured.","owner":"Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout","links":["https://github.com/docker-library/docs/blob/master/php/README.md","https://github.com/docker-library/official-images/blob/master/library/php","https://github.com/docker-library/php/pull/1694","https://github.com/docker-library/official-images/pull/22541"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."}}},{"id":"PHP-0355","name":"Docker Official PHP FPM image variant","vendor":"Docker Official Images / docker-library PHP maintainers","category":"Containers and distribution","version":"Not specified","summary":"The immutable trixie recipe starts from debian:trixie-slim, disables CGI and enables FPM.","scope":"Inventory record: PHP-0355\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0032\nEvidence status: Vendor-confirmed fixed image definitions\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI, plus CLI; separate HTTP reverse proxy\nPHP version scope: Bounded stable PHP 8.5.12 matrix at source commit f6048b5f6e3c2202ee082665a4ccc0d90de291a3; not RC tags or all PHP branches\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: FastCGI is not HTTP. Debian PHP apt packages are explicitly blocked; source-built /usr/local PHP has a separate rebuild lane. Fourteen PHP 8.5.12 source directories are a bounded catalogue sample, not every supported PHP branch or an image digest inventory. OS tag and architecture affect native ABI. A source commit does not verify built image bytes. Operators must pull rebuilt images and rebuild/redeploy derived images and running containers.\nPatch owner: Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: PHP 8.5.12 build source f6048b5f6e3c2202ee082665a4ccc0d90de291a3; variant fpm; image content digest unverified\nSource accessed: 2026-10-21\nAliases: docker.io/library/php:fpm\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Official Docker PHP image source definitions and official-images metadata were updated to PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests still need verification.\nCVE-2026-109618: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE-2026-109619: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE assessment limit: Vendor source establishes updated source definitions and official-images metadata, not deployed image bytes; operator rollout remains unmeasured.","owner":"Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout","links":["https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/fpm/Dockerfile","https://github.com/docker-library/official-images/blob/master/library/php","https://github.com/docker-library/php/pull/1694","https://github.com/docker-library/official-images/pull/22541"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."}}},{"id":"PHP-0356","name":"Docker Official PHP ZTS image variant","vendor":"Docker Official Images / docker-library PHP maintainers","category":"Containers and distribution","version":"Not specified","summary":"The immutable trixie recipe enables ZTS, embed and phpdbg. The manifest groups four OS build directories under ZTS tags.","scope":"Inventory record: PHP-0356\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0032\nEvidence status: Vendor-confirmed fixed image definitions\nDeployment status: Not measured\nPHP surface: Thread-safe PHP CLI/build; inspected Debian recipe also enables embed and phpdbg\nPHP version scope: Bounded stable PHP 8.5.12 matrix at source commit f6048b5f6e3c2202ee082665a4ccc0d90de291a3; not RC tags or all PHP branches\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: ZTS is a build mode, not a separate application or proof of a listening web service. Native extensions need matching thread-safety/ABI. Fourteen PHP 8.5.12 source directories are a bounded catalogue sample, not every supported PHP branch or an image digest inventory. OS tag and architecture affect native ABI. A source commit does not verify built image bytes. Operators must pull rebuilt images and rebuild/redeploy derived images and running containers.\nPatch owner: Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: PHP 8.5.12 build source f6048b5f6e3c2202ee082665a4ccc0d90de291a3; variant zts; image content digest unverified\nSource accessed: 2026-10-21\nAliases: docker.io/library/php:zts\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Official Docker PHP image source definitions and official-images metadata were updated to PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests still need verification.\nCVE-2026-109618: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE-2026-109619: Fixed in official Docker PHP image source definitions and official-images metadata; deployed tags and digests must be verified\nCVE assessment limit: Vendor source establishes updated source definitions and official-images metadata, not deployed image bytes; operator rollout remains unmeasured.","owner":"Docker PHP image maintainers for rebuilds; derived-image publisher for rebuilds and operator for rollout","links":["https://github.com/docker-library/php/blob/f6048b5f6e3c2202ee082665a4ccc0d90de291a3/8.5/trixie/zts/Dockerfile","https://github.com/docker-library/official-images/blob/master/library/php","https://github.com/docker-library/php/pull/1694","https://github.com/docker-library/official-images/pull/22541"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified","action":"","detail":"Added from the official docker-library/php security update pull request and the official-images metadata pull request merged 2026-10-21.\nAction statement: Verify deployed tags/digests, pull rebuilt Docker Official PHP images and rebuild/redeploy derived images and running containers."}}},{"id":"PHP-0357","name":"Debian trixie PHP 8.4 FPM package","vendor":"Debian PHP Maintainers","category":"Containers and distribution","version":"8.4.27-1~deb13u1","summary":"Debian DSA-6574-1 fixes CVE-2026-109618 and CVE-2026-109619 in trixie php8.4 8.4.27-1~deb13u1.","scope":"Inventory record: PHP-0357\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI; package also depends on php8.4-cli\nPHP version scope: Debian DSA-6574-1 fixes trixie php8.4 at 8.4.27-1~deb13u1; architecture-specific dependencies remain package-specific.\nExtensions: php8.4-opcache dependency declared; common module contents not fully enumerated; PEAR is a suggested tool, not a native extension\nLimitations: This row covers the named optional package, not every Debian installation or all Debian PHP packages. No binary/image was pulled, installed, built or executed. Package availability does not prove operator rollout or process restart.\nPatch owner: Debian package/security maintainers and operator applying package updates/restarting workers\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Debian DSA-6574-1; trixie php8.4 8.4.27-1~deb13u1; binary hash unverified\nSource accessed: 2026-10-21\nAliases: deb:trixie/php8.4-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Debian trixie php8.4 8.4.27-1~deb13u1.\nCVE-2026-109618: Fixed in php8.4 8.4.27-1~deb13u1\nCVE-2026-109619: Fixed in php8.4 8.4.27-1~deb13u1\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Debian package/security maintainers and operator applying package updates/restarting workers","links":["https://packages.debian.org/trixie/php8.4-fpm","https://lists.debian.org/debian-security-announce/2026/msg00489.html"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Debian trixie php8.4 8.4.27-1~deb13u1","action":"","detail":"Added from Debian DSA-6574-1 issued 2026-10-21.\nAction statement: Apply DSA-6574-1 updated php8.4 packages for affected Debian trixie systems."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Debian trixie php8.4 8.4.27-1~deb13u1","action":"","detail":"Added from Debian DSA-6574-1 issued 2026-10-21.\nAction statement: Apply DSA-6574-1 updated php8.4 packages for affected Debian trixie systems."}}},{"id":"PHP-0358","name":"Ubuntu optional PHP package and SAPI family","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1","summary":"USN-8948-1 supplies fixes for the listed Ubuntu Apache-module, CGI, CLI and FPM packages; separately inventoried FPM rows also retain USN-8948-2 release and entitlement scope.","scope":"Inventory record: PHP-0358\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Documented optional Apache module, CLI and CGI; scoped FPM members separately pinned in PHP-0591 and PHP-0634 through PHP-0640\nPHP version scope: Family spans release/pocket-specific packages. USN-8948-1 fixes scoped FPM members for Jammy, Noble, Resolute and Stonking in PHP-0591 and PHP-0634 through PHP-0636. USN-8948-2 fixes scoped FPM members for Focal, Bionic, Xenial and Trusty in PHP-0637 through PHP-0640; this is not a version for every Ubuntu PHP package.\nExtensions: Exact scoped FPM members require release-matched common, opcache and CLI packages. Other family packages and loaded extensions remain unresolved.\nLimitations: The scoped FPM metadata does not establish all Ubuntu releases, pockets, installed binaries or support entitlements. Focal, Bionic, Xenial and Trusty fixes require Ubuntu Pro or Legacy Support entitlements. Distro versions retain backports and cannot be judged from upstream version strings alone. No binary/package was downloaded, installed or executed; no deployment or vulnerability was measured.\nPatch owner: Ubuntu package/security maintainers and operator; coverage depends on release, package pocket and support entitlement\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-1 and USN-8948-2; scoped FPM rows pinned separately; broader family and installed bytes not pinned\nSource accessed: 2026-10-21\nAliases: ubuntu:php, ubuntu:libapache2-mod-php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fix available for the Apache-module, CGI, CLI and FPM packages/releases listed in USN-8948-1; scoped FPM rows are retained separately, including USN-8948-2.\nCVE-2026-109618: Fixed in the release-specific packages listed in USN-8948-1\nCVE-2026-109619: Fixed in the release-specific packages listed in USN-8948-1\nCVE assessment limit: This family status confirms availability only for the packages/releases listed by the advisories, not every Ubuntu PHP package or deployed instance. Older release FPM fixes and support entitlements remain separately scoped in PHP-0637 through PHP-0640.","owner":"Ubuntu package/security maintainers and operator; coverage depends on release, package pocket and support entitlement","links":["https://ubuntu.com/server/docs/how-to/web-services/install-php/","https://packages.ubuntu.com/noble-updates/php8.3-fpm","https://ubuntu.com/security/notices/USN-8948-1","https://ubuntu.com/security/notices/USN-8948-2"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://ubuntu.com/security/notices/USN-8948-1\nAction statement: Install the corrected packages for the Ubuntu release and restart all processes using them; the older upstream version numbers include Ubuntu backports."},"CVE-2026-109619":{"status":"Fix","notes":"USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://ubuntu.com/security/notices/USN-8948-1\nAction statement: Install the corrected packages for the Ubuntu release and restart all processes using them; the older upstream version numbers include Ubuntu backports."}}},{"id":"PHP-0359","name":"Alpine Linux v3.22 php84 package family","vendor":"Alpine Linux package maintainers","category":"Containers and distribution","version":"Not specified","summary":"Alpine lists the php84 runtime and php84-common dependency, alongside musl and other upstream native libraries. The page separately lists subpackages.","scope":"Inventory record: PHP-0359\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP84 language runtime; FPM and other subpackages are separate catalogue entries\nPHP version scope: community x86_64 php84 8.4.16-r0; page build time 2025-12-21; advertised packaging commit 1a0af28d8f5e9377f19142ee6d846d86dcffb01e\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: This is the inspected v3.22/x86_64 catalogue entry, not a latest-Alpine or security-support claim. Reverse dependencies php84-dev/pear/phar are not runtime requirements of php84. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Alpine package/security maintainers and operator applying branch-appropriate updates\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: php84 8.4.16-r0; advertised packaging commit 1a0af28d8f5e9377f19142ee6d846d86dcffb01e; artifact unverified\nSource accessed: 2026-10-17\nAliases: apk:v3.22/community/php84\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Alpine package/security maintainers and operator applying branch-appropriate updates","links":["https://pkgs.alpinelinux.org/package/v3.22/community/x86_64/php84"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0360","name":"Fedora PHP distribution package family","vendor":"Fedora Project PHP maintainers","category":"Containers and distribution","version":"Not specified","summary":"The official package catalogue identifies PHP and gives distinct stable, testing and Rawhide release entries.","scope":"Inventory record: PHP-0360\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Packaged server-side PHP runtime; exact SAPI subpackage/configuration must be selected\nPHP version scope: Page lists Fedora 45 8.5.11-2.fc45; Fedora 44 8.5.11-1.fc44; Fedora 43 8.4.26-1.fc43; Rawhide 8.5.12~RC1-1.fc46\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Rawhide RC is not a stable upstream release. Catalogue labels do not establish OS-release availability on any host or which SAPI/modules were installed. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Fedora PHP package maintainers, Fedora update process and deploying operator\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Dated package catalogue observations; no RPM bytes or signatures verified\nSource accessed: 2026-10-17\nAliases: rpm:fedora/php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Fedora PHP package maintainers, Fedora update process and deploying operator","links":["https://packages.fedoraproject.org/pkgs/php/php/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0361","name":"Arch Linux Extra PHP package","vendor":"Arch Linux package maintainers","category":"Containers and distribution","version":"8.5.12-1","summary":"Arch Linux states that php versions before 8.5.12 are affected by both CVEs; the current Extra package page lists php 8.5.12-1.","scope":"Inventory record: PHP-0361\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: Packaged PHP runtime; web SAPIs/modules need separate package/configuration evidence\nPHP version scope: Arch Linux news states php versions before 8.5.12 are affected by CVE-2026-109618 and CVE-2026-109619. The current x86_64 Extra package page lists php 8.5.12-1, built 2026-10-21 13:42 UTC.\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Apache, ICU, GD and other make dependencies do not prove every associated runtime module is installed or loaded. Optional package availability is not PHP in every Arch host. No binary/image was pulled, installed, built or executed. Package availability does not prove operator rollout or process restart.\nPatch owner: Arch package maintainers and operator updating the rolling package and restarting users\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Arch php 8.5.12-1 x86_64; official package page last updated 2026-10-21 13:50 UTC\nSource accessed: 2026-10-21\nAliases: arch:extra/x86_64/php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Arch Linux Extra php 8.5.12-1.\nCVE-2026-109618: Fixed in php 8.5.12-1\nCVE-2026-109619: Fixed in php 8.5.12-1\nCVE assessment limit: Vendor news establishes the fixed package threshold, not deployment status or whether an operator has applied the update and restarted affected services.","owner":"Arch package maintainers and operator updating the rolling package and restarting users","links":["https://archlinux.org/packages/extra/x86_64/php/","https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Arch Linux php 8.5.12-1","action":"","detail":"Added from the Arch Linux security news item and package page published 2026-10-21.\nAction statement: Upgrade Arch Linux php to 8.5.12-1 or later.\nDuplicate upstream fixed assessment reconciled on 2026-10-21. Update Arch Linux systems to php >= 8.5.12 and restart affected services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Arch Linux php 8.5.12-1","action":"","detail":"Added from the Arch Linux security news item and package page published 2026-10-21.\nAction statement: Upgrade Arch Linux php to 8.5.12-1 or later.\nDuplicate upstream fixed assessment reconciled on 2026-10-21. Update Arch Linux systems to php >= 8.5.12 and restart affected services."}}},{"id":"PHP-0362","name":"FreeBSD PHP port and mod_php package integration","vendor":"FreeBSD Project / ports maintainers","category":"Containers and distribution","version":"Ports source: php82 8.2.35; php83 8.3.36; php84 8.4.27; php85 8.5.12","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0362\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Optional Apache mod_php; separate PHP binary and modular feature ports\nPHP version scope: Ports source: php82 8.2.35; php83 8.3.36; php84 8.4.27; php85 8.5.12\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: The August 2026Q3 update is not a claim about the October current branch, every architecture or installed packages. The current php85 Makefile was inaccessible; earlier php84 failure remains historical evidence. No source/archive bytes or signatures were verified and no code was executed.\nPatch owner: FreeBSD ports/package maintainers and operator selecting a maintained branch and enabling the chosen SAPI\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Ports source: php82 8.2.35; php83 8.3.36; php84 8.4.27; php85 8.5.12\nSource accessed: 2026-10-22\nAliases: freebsd:php-ports\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: FreeBSD VuXML names both CVEs and the fixed PHP branch thresholds. Current official main-branch port Makefiles independently select those fixed releases. This confirms corrected ports source, not binary package availability for every architecture/quarterly repository or all mod_php subpackages; no installed system was tested.\nCVE-2026-109619: FreeBSD VuXML names both CVEs and the fixed PHP branch thresholds. Current official main-branch port Makefiles independently select those fixed releases. This confirms corrected ports source, not binary package availability for every architecture/quarterly repository or all mod_php subpackages; no installed system was tested.\nVendor advisory sources: https://www.vuxml.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html; https://www.vuxml.org/freebsd/vuln.xml; https://github.com/freebsd/freebsd-ports/blob/main/lang/php82/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php83/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php84/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php85/Makefile\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"FreeBSD ports/package maintainers and operator selecting a maintained branch and enabling the chosen SAPI","links":["https://lists.freebsd.org/archives/dev-commits-ports-branches/2026-August/014722.html","https://docs.freebsd.org/en/books/handbook/network-servers/","https://www.vuxml.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html","https://www.vuxml.org/freebsd/vuln.xml","https://github.com/freebsd/freebsd-ports/blob/main/lang/php82/Makefile","https://github.com/freebsd/freebsd-ports/blob/main/lang/php83/Makefile","https://github.com/freebsd/freebsd-ports/blob/main/lang/php84/Makefile","https://github.com/freebsd/freebsd-ports/blob/main/lang/php85/Makefile"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"FreeBSD VuXML names both CVEs and the fixed PHP branch thresholds. Current official main-branch port Makefiles independently select those fixed releases. This confirms corrected ports source, not binary package availability for every architecture/quarterly repository or all mod_php subpackages; no installed system was tested.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://www.vuxml.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html; https://www.vuxml.org/freebsd/vuln.xml; https://github.com/freebsd/freebsd-ports/blob/main/lang/php82/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php83/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php84/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php85/Makefile\nAction statement: Use a branch/repository carrying the corrected port, rebuild or install the corresponding fixed packages, and restart dependent services; verify architecture and quarterly-repository availability separately."},"CVE-2026-109619":{"status":"Fix","notes":"FreeBSD VuXML names both CVEs and the fixed PHP branch thresholds. Current official main-branch port Makefiles independently select those fixed releases. This confirms corrected ports source, not binary package availability for every architecture/quarterly repository or all mod_php subpackages; no installed system was tested.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://www.vuxml.org/freebsd/d8e16d08-cd2f-11f1-8135-8447094a420f.html; https://www.vuxml.org/freebsd/vuln.xml; https://github.com/freebsd/freebsd-ports/blob/main/lang/php82/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php83/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php84/Makefile; https://github.com/freebsd/freebsd-ports/blob/main/lang/php85/Makefile\nAction statement: Use a branch/repository carrying the corrected port, rebuild or install the corresponding fixed packages, and restart dependent services; verify architecture and quarterly-repository availability separately."}}},{"id":"PHP-0363","name":"Homebrew PHP formula and bottles","vendor":"Homebrew maintainers","category":"Containers and distribution","version":"Homebrew php 8.5.12, revision 0; formula source SHA-256 e1fe7d4bad28b3d65b67ac83013fd0dd78d4aa1fe55ca95124e8213bc4c17ab5","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0363\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: php-fpm service and Apache libphp.so integration documented; PHP CLI/tool use\nPHP version scope: Homebrew php 8.5.12, revision 0; formula source SHA-256 e1fe7d4bad28b3d65b67ac83013fd0dd78d4aa1fe55ca95124e8213bc4c17ab5\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Formula availability is not an installed service. HEAD, versioned formulae, platform bottles and locally compiled options are separate scopes; no bottle hash or formula commit was verified. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Homebrew formula/bottle maintainers and operator upgrading the selected formula and services\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Homebrew php 8.5.12, revision 0; formula source SHA-256 e1fe7d4bad28b3d65b67ac83013fd0dd78d4aa1fe55ca95124e8213bc4c17ab5\nSource accessed: 2026-10-22\nAliases: homebrew:php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Homebrew's live formula/API publishes PHP 8.5.12 and bottle metadata for the listed macOS ARM and Linux architectures, sourced from PHP's fixed 8.5.12 tarball. PHP's official advisory confirms this release fixes both CVEs. This confirmation is scoped to php 8.5.12, not EOL php@8.1 or all older bottles; binaries were not downloaded or executed.\nCVE-2026-109619: Homebrew's live formula/API publishes PHP 8.5.12 and bottle metadata for the listed macOS ARM and Linux architectures, sourced from PHP's fixed 8.5.12 tarball. PHP's official advisory confirms this release fixes both CVEs. This confirmation is scoped to php 8.5.12, not EOL php@8.1 or all older bottles; binaries were not downloaded or executed.\nVendor advisory sources: https://formulae.brew.sh/formula/php; https://formulae.brew.sh/api/formula/php.json; https://www.php.net/archive/2026.php#2026-10-21-5\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Homebrew formula/bottle maintainers and operator upgrading the selected formula and services","links":["https://formulae.brew.sh/formula/php","https://formulae.brew.sh/api/formula/php.json","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Homebrew's live formula/API publishes PHP 8.5.12 and bottle metadata for the listed macOS ARM and Linux architectures, sourced from PHP's fixed 8.5.12 tarball. PHP's official advisory confirms this release fixes both CVEs. This confirmation is scoped to php 8.5.12, not EOL php@8.1 or all older bottles; binaries were not downloaded or executed.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://formulae.brew.sh/formula/php; https://formulae.brew.sh/api/formula/php.json; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Upgrade the selected Homebrew PHP formula to the listed fixed version and restart PHP-FPM/Apache consumers; verify the actual formula and running processes."},"CVE-2026-109619":{"status":"Fix","notes":"Homebrew's live formula/API publishes PHP 8.5.12 and bottle metadata for the listed macOS ARM and Linux architectures, sourced from PHP's fixed 8.5.12 tarball. PHP's official advisory confirms this release fixes both CVEs. This confirmation is scoped to php 8.5.12, not EOL php@8.1 or all older bottles; binaries were not downloaded or executed.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://formulae.brew.sh/formula/php; https://formulae.brew.sh/api/formula/php.json; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Upgrade the selected Homebrew PHP formula to the listed fixed version and restart PHP-FPM/Apache consumers; verify the actual formula and running processes."}}},{"id":"PHP-0364","name":"Red Hat Enterprise Linux 9 PHP RPM/AppStreams","vendor":"Red Hat","category":"Containers and distribution","version":"Not specified","summary":"Red Hat's CVE pages mark the RHEL 9 PHP component family affected; RHSA-2026:87072 separately fixes the scoped php:8.2 module row.","scope":"Inventory record: PHP-0364\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected family\nDeployment status: Not measured\nPHP surface: Common profile includes php-fpm for Apache/nginx; minimal profile is CLI only\nPHP version scope: Red Hat CVE pages list Red Hat Enterprise Linux 9 php, php:8.2/php, php:8.3/php and php:8.4/php components as affected. PHP-0633 separately records the RHSA-2026:87072 fixed php:8.2 module package.\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: The RHEL 9 family row spans multiple component streams with mixed fix state. Use the scoped PHP-0633 row for the vendor-confirmed php:8.2 fix; other listed components still require branch-specific errata evidence. Module availability, support entitlement, backported package release and actual installation must be resolved together. No binary/image was pulled, installed, built or executed. Deployments were not measured.\nPatch owner: Red Hat for supported backported RPMs/AppStreams; subscriber/operator for supported stream selection, update and restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Red Hat CVE-2026-109618 and CVE-2026-109619 pages last modified 2026-10-21; RHSA-2026:87072 scoped separately\nSource accessed: 2026-10-21\nAliases: rhel9:php-appstreams\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Affected: Red Hat lists the RHEL 9 PHP component family as affected; the scoped php:8.2 module fix is recorded separately.\nCVE-2026-109618: Affected for the RHEL 9 PHP component family; scoped php:8.2 fix recorded separately\nCVE-2026-109619: Affected for the RHEL 9 PHP component family; scoped php:8.2 fix recorded separately\nCVE assessment limit: Vendor VEX confirms affected RHEL 9 PHP component family scope, not deployment status or whether branch-specific fixes have been applied.","owner":"Red Hat for supported backported RPMs/AppStreams; subscriber/operator for supported stream selection, update and restart","links":["https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html-single/installing_and_using_dynamic_programming_languages/installing_and_using_dynamic_programming_languages","https://access.redhat.com/support/policy/updates/rhel-app-streams-life-cycle","https://access.redhat.com/security/cve/cve-2026-109618","https://access.redhat.com/security/cve/cve-2026-109619"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: Red Hat lists the RHEL 9 PHP component family as affected; scoped php:8.2 fix recorded separately","action":"Apply branch-specific Red Hat errata as released; RHSA-2026:87072 fixes the separately scoped RHEL 9 php:8.2 module row.","detail":"Added from Red Hat CVE-2026-109618 VEX page last modified 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: Red Hat lists the RHEL 9 PHP component family as affected; scoped php:8.2 fix recorded separately","action":"Apply branch-specific Red Hat errata as released; RHSA-2026:87072 fixes the separately scoped RHEL 9 php:8.2 module row.","detail":"Added from Red Hat CVE-2026-109619 VEX page last modified 2026-10-21."}}},{"id":"PHP-0365","name":"SUSE Linux Enterprise PHP8 package families","vendor":"SUSE","category":"Containers and distribution","version":"Not specified","summary":"SUSE release notes establish PHP 8.2 availability; its published update lists versioned php8 runtime, FPM and extension packages.","scope":"Inventory record: PHP-0365\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Vendor package list includes php8-fpm, Apache module, FastCGI and embed packages; selection is product-specific\nPHP version scope: SLES 15 SP6 release notes announce PHP 8.2 replacing8.0. Separate 2026 vendor update lists php8 8.0.30-150400.4.76.1 for its eligible product scopes\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: The advisory package build must not be assigned to every SLES 15 service pack or entitlement. Backported vendor releases cannot be assessed solely by upstream 8.0.30. No advisory CVE was assessed or copied into exposure claims. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: SUSE vendor package/security maintenance for the entitled product; operator applies packages and restarts runtimes\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: sles:php8\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SUSE vendor package/security maintenance for the entitled product; operator applies packages and restarts runtimes","links":["https://documentation.suse.com/releasenotes/sles/15-SP6/index.html","https://www.suse.com/support/update/announcement/2026/suse-su-20264651-1/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0366","name":"SUSE SLE BCI PHP-FPM 8 container","vendor":"SUSE","category":"Containers and distribution","version":"Not specified","summary":"Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0366\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI, not HTTP; separate FastCGI-aware HTTP proxy\nPHP version scope: Dated 12 September 2026 advisory lists bci/php-fpm:8.3.33-26.4, release 26.4. Current latest catalogue digest is a separate observation, not linked to that dated tag.\nExtensions: Optional RPM php8-gd/php8-intl examples, not default presence; PECL interoperability/support not guaranteed\nLimitations: Image notice concerns php-composer2 2.6.4-150600.3.18.1 and base metadata, not proof of a PHP core fix or complete image contents. Advertised catalogue digest has unverified architecture/tag linkage and no pulled bytes. Compatibility helpers do not establish Docker Official Image contents. No loaded modules, deployment, reachable flaw or compromise measured.\nPatch owner: SUSE for RPM/image rebuilds; derived-image publisher and operator for rebuild and rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Dated tag bci/php-fpm:8.3.33-26.4 (notice SUSE-CU-2026:10107-1); catalogue latest digest separately advertised, bytes unverified\nSource accessed: 2026-10-19\nAliases: registry.suse.com/bci/php-fpm\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"SUSE for RPM/image rebuilds; derived-image publisher and operator for rebuild and rollout","links":["https://registry.suse.com/repositories/bci-php-fpm","https://lists.suse.com/pipermail/sle-container-updates/2026-September/012563.html","https://www.suse.com/security/cve/CVE-2026-109618.html","https://www.suse.com/security/cve/CVE-2026-109619.html"],"cves":{"CVE-2026-109618":{"status":"Not vuln","notes":"SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html"},"CVE-2026-109619":{"status":"Not vuln","notes":"SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html"}}},{"id":"PHP-0367","name":"Official PHP Windows binary ZIP distribution","vendor":"The PHP Group / PHP Windows maintainers","category":"Containers and distribution","version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","summary":"Official downloads distinguish NTS/TS roles and list four architecture/thread-safety ZIP choices; the security advisory points users to fixed Windows binaries.","scope":"Inventory record: PHP-0367\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: NTS for CLI/FastCGI (e.g. IIS); TS for multithreaded web-server module (e.g. Apache); not a Windows FPM claim\nPHP version scope: Download page lists PHP 8.5.11 VS17 x64/x86, TS/NTS ZIPs dated2026-09-22. Only x64NTS SPDX 2.3 metadata inspected\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Published ZIP hashes were not independently checked. SBOM filesAnalyzed=false; declared source/build and native-library edges do not prove a loaded module or that Apache ships/runs in the NTS ZIP. Other ZIP SBOMs not inspected. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: PHP Windows binary maintainers for rebuilt ZIPs/native dependencies; bundle publisher and operator for replacement and process restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: php-8.5.11-nts-Win32-vs17-x64.zip; advertised SHA256 0ea96e0d2b9b737a6036f05cf4e95c49313faa6d0f27bd97edb2742503f0c043; bytes unverified\nSource accessed: 2026-10-17\nAliases: php-windows:official-zips\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PHP Windows binary maintainers for rebuilt ZIPs/native dependencies; bundle publisher and operator for replacement and process restart","links":["https://www.php.net/downloads.php?os=windows","https://www.php.net/archive/2026.php#2026-10-21-5","https://downloads.php.net/~windows/releases/archives/php-8.5.11-nts-Win32-vs17-x64.zip.spdx.json"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed upstream Windows binaries are available for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Replace affected Windows PHP binaries with a fixed release."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed upstream Windows binaries are available for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Replace affected Windows PHP binaries with a fixed release."}}},{"id":"PHP-0368","name":"WampServer Windows development bundle","vendor":"WampServer maintainers / Aviatechno","category":"Containers and distribution","version":"Not specified","summary":"The publisher distinguishes the full installer, manager updates and separately downloadable PHP add-ons; Apache/PHP and database administration tools are bundled.","scope":"Inventory record: PHP-0368\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled Apache/PHP; Apache fcgi_module add-on supports per-VirtualHost PHP selection\nPHP version scope: Full installer 3.4.0 lists PHP 8.0.30/8.1.33/8.2.29/8.3.28/8.4.15/8.5.0; update 3.4.2 and separate add-ons8.2.34/8.3.35/8.4.26/8.5.11 are distinct\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: A manager update or add-on listing is not proof an installed PHP binary was replaced. The page is dated2026-10-14; old available add-ons are not support assurances. PHPMyAdmin/Adminer rows overlap with the bundle. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: WampServer/add-on publisher and developer/operator selecting and updating each PHP version\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Full installer3.4.0 versus update3.4.2 and separately versioned PHP add-ons; binary hashes not verified\nSource accessed: 2026-10-17\nAliases: wampserver:windows\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"WampServer/add-on publisher and developer/operator selecting and updating each PHP version","links":["https://wampserver.aviatechno.net/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0369","name":"MAMP local server environment","vendor":"MAMP GmbH","category":"Containers and distribution","version":"Not specified","summary":"MAMP describes an installable local stack containing PHP; its downloads distinguish OS-specific installer versions.","scope":"Inventory record: PHP-0369\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled PHP with Apache/nginx and MySQL; exact SAPI varies by edition/OS\nPHP version scope: Downloads page lists macOS 7.4.0 and Windows 5.0.6 installers; PHP patch inventory not enumerated on inspected pages\nExtensions: Product page says APC and OPcache integrated; exact module version/selection per installer unresolved\nLimitations: Installer version is not a PHP version. Free MAMP, PRO, Viewer and Cloud Connect are different boundaries; cloud-provider or mobile-viewer PHP internals are not established. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: MAMP bundle publisher and developer/operator updating the selected OS/edition and runtime\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: mamp:local-stack\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"MAMP bundle publisher and developer/operator updating the selected OS/edition and runtime","links":["https://www.mamp.info/en/mamp/mac/","https://www.mamp.info/en/downloads/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0370","name":"Laragon Full Windows development bundle","vendor":"Laragon project","category":"Containers and distribution","version":"Not specified","summary":"Laragon explicitly calls PHP bundled, documents terminal PATH use and switching/updating PHP versions in the Full environment.","scope":"Inventory record: PHP-0370\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled PHP for local Apache/nginx and terminal PATH; per-project versions\nPHP version scope: Full 8.7.0 download page lists PHP 8.1–8.5 families; exact patches and auto-added version state unknown\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Full installer contents, later quick-add/automatic updates and active per-project PHP are distinct. Database/Node/Python co-bundling does not make those components PHP-based. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Laragon distribution/update publisher and developer/operator selecting updated PHP binaries\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Laragon Full8.7.0 product download declaration; individual runtime binary pins pending\nSource accessed: 2026-10-17\nAliases: laragon:full\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Laragon distribution/update publisher and developer/operator selecting updated PHP binaries","links":["https://laragon.org/download"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0371","name":"EasyPHP PHP Devserver Windows bundle","vendor":"EasyPHP project","category":"Containers and distribution","version":"Not specified","summary":"The project describes a portable PHP development environment with PHP, Apache and modular PHP/version tools.","scope":"Inventory record: PHP-0371\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled PHP/Apache; optional modular tools and Xdebug management\nPHP version scope: Devserver 17.4.8 page lists PHP 8.5.0/8.4.15/8.3.28 tools and page last update 2025-11-29; base installer patch inventory unresolved\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: The website tools list is not proof those versions are all in the base installer or active. The promotional download count was not treated as installations or recorded as a measurement. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: EasyPHP/component publisher and developer/operator updating selected runtime modules\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Product17.4.8 and dated tool listings; installer bytes/components unverified\nSource accessed: 2026-10-17\nAliases: easyphp:devserver\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"EasyPHP/component publisher and developer/operator updating selected runtime modules","links":["https://www.easyphp.org/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0372","name":"Laravel Herd managed native PHP environment","vendor":"Beyond Code in partnership with Laravel","category":"Containers and distribution","version":"Not specified","summary":"Herd describes a native PHP stack without containers; Windows documentation distinguishes shipped tools from downloaded PHP binaries.","scope":"Inventory record: PHP-0372\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native managed PHP binaries and local nginx integration; exact SAPI/build per OS not pinned\nPHP version scope: Moving macOS product page and Windows directories guide; site demo shows version choices7.4–8.6 and8.5.10 example, not a release/support catalogue\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Website screenshots/demo patch numbers are not installed builds or assurance8.6 is stable. Linux is described as not yet shipped. Pro services and the GUI implementation are not all inferred to be PHP. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Herd runtime download/update publisher and developer/operator applying the selected PHP update\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: herd:php-runtime\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Herd runtime download/update publisher and developer/operator applying the selected PHP update","links":["https://herd.laravel.com/","https://herd.laravel.com/docs/windows/advanced-usage/directories-and-files"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0373","name":"DDEV PHP webserver development container","vendor":"DDEV project","category":"Containers and distribution","version":"Not specified","summary":"DDEV config defines php_version, ddev/ddev-webserver image selection and separate nginx-fpm/apache-fpm/generic modes.","scope":"Inventory record: PHP-0373\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Default nginx-fpm; alternate apache-fpm; generic mode runs no web-server daemon\nPHP version scope: Stable docs default PHP 8.4, selectable5.6–8.5 family labels; patch selection not supported in php_version setting\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: The configured image, customized build and actual patch contents need a digest/SBOM. Old selectable families are not upstream support guarantees. PHP in managed containers does not establish the host orchestrator is written in PHP. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: DDEV webserver-image publishers and developer/CI operator rebuilding custom images and replacing containers\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving stable DDEV configuration documentation; image digest/PHP patch unknown\nSource accessed: 2026-10-17\nAliases: ddev/ddev-webserver:php\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"DDEV webserver-image publishers and developer/CI operator rebuilding custom images and replacing containers","links":["https://docs.ddev.com/en/stable/users/configuration/config/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0374","name":"Lando PHP service plugin images","vendor":"Lando project","category":"Containers and distribution","version":"Not specified","summary":"Lando documents an optional PHP service and custom images; its legacy warning says EOL families can run but should be considered deprecated.","scope":"Inventory record: PHP-0374\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP service via separate apache/nginx integration; exact SAPI depends on selected image/mode\nPHP version scope: Plugin lists8.5–7.3 and custom options; separately lists legacy7.2–5.3. Own PHP images do not support patch pinning via service version\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: A UI list labelled supported is not an upstream PHP support lifecycle. Specific patch pinning requires custom Compose/override evidence. The host tool and every Lando service are not inferred PHP-based. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Lando PHP image/plugin maintainers and developer/CI operator choosing supported runtime and refreshing custom images\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving Lando PHP plugin guide; exact image digest/PHP patch unverified\nSource accessed: 2026-10-17\nAliases: lando:php-service\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Lando PHP image/plugin maintainers and developer/CI operator choosing supported runtime and refreshing custom images","links":["https://docs.lando.dev/plugins/php/index.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0375","name":"Nextcloud community Docker image distribution","vendor":"Nextcloud Docker community volunteers / Docker Official Images","category":"Containers and distribution","version":"Not specified","summary":"The repository distinguishes community maintenance from Nextcloud GmbH AIO, and explicitly bases its FPM variant on php-fpm.","scope":"Inventory record: PHP-0375\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache variant; FPM variant inherits PHP-FPM and requires separate HTTP server; PHP occ CLI\nPHP version scope: Moving community image documentation; exact Nextcloud/PHP patch and image digest not pinned\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: AIO and community Docker have different maintainers. Database, Redis and reverse-proxy containers are separate components; image count cannot be added to Nextcloud installation count. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Community image maintainers plus PHP base-image maintainers; operator rebuilds derived images and rolls out containers\nDownstream surface: Nextcloud files, sessions, application configuration, mounted data and configured service credentials\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: docker.io/library/nextcloud\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Community image maintainers plus PHP base-image maintainers; operator rebuilds derived images and rolls out containers","links":["https://github.com/nextcloud/docker"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0376","name":"Nextcloud AIO Nextcloud application container","vendor":"Nextcloud GmbH / Nextcloud AIO maintainers","category":"Containers and distribution","version":"Not specified","summary":"Nextcloud AIO maintainers confirm affected PHP base images and report that rebuilt images depend on upstream PHP image publication; a fixed AIO release is not yet confirmed.","scope":"Inventory record: PHP-0376\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0015\nEvidence status: Vendor-confirmed affected product\nDeployment status: Not measured\nPHP surface: PHP-FPM and CLI inherited from official PHP Alpine image\nPHP version scope: Inspected main recipe FROM php:8.4.26-fpm-alpine3.24 and NEXTCLOUD_VERSION34.0.5; Nextcloud AIO maintainers state rebuilt images depend on updated upstream PHP base images and were still in progress on 2026-10-21.\nExtensions: Recipe subset: bcmath, exif, gd, gmp, intl, ldap, opcache, pcntl, pdo_pgsql, sysvsem, zip, bz2, pgsql, ftp; PECL igbinary, APCu, memcached, redis, imagick, imap, smbclient. These are build selections, not universal Nextcloud requirements.\nLimitations: Only the Nextcloud container is covered, not every AIO master/database/office/Talk container. Moving main may precede released images; base tag has no verified digest. No binary/image was pulled, installed, built or executed. Deployments and operator rollout were not measured.\nPatch owner: Nextcloud AIO publisher and PHP image maintainers; operator applies AIO/container updates\nDownstream surface: Nextcloud application container files, configured credentials and mounted storage; other AIO service boundaries not inferred\nRelease pin: Nextcloud AIO issue #8876 opened 2026-10-21; moving main recipe declares PHP 8.4.26, Alpine 3.24 and Nextcloud 34.0.5; immutable release digest pending\nSource accessed: 2026-10-21\nAliases: nextcloud-aio:nextcloud-container\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; upstream PHP image publication and AIO rebuild completion were still pending in the vendor tracker.\nCVE-2026-109618: Affected: fixed AIO image release not yet confirmed\nCVE-2026-109619: Affected: fixed AIO image release not yet confirmed\nCVE assessment limit: Vendor issue confirms AIO impact and rebuild progress, but not a completed fixed AIO release; exact deployed image digest and operator rollout remain unmeasured.","owner":"Nextcloud AIO publisher and PHP image maintainers; operator applies AIO/container updates","links":["https://github.com/nextcloud/all-in-one/blob/main/Containers/nextcloud/Dockerfile","https://github.com/nextcloud/all-in-one/issues/8876"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; fixed AIO image release not yet confirmed","action":"Apply the next Nextcloud AIO image release containing patched PHP base images; until then follow the AIO shutdown guidance.","detail":"Added from Nextcloud AIO issue #8876 updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; fixed AIO image release not yet confirmed","action":"Apply the next Nextcloud AIO image release containing patched PHP base images; until then follow the AIO shutdown guidance.","detail":"Added from Nextcloud AIO issue #8876 updated 2026-10-21."}}},{"id":"PHP-0377","name":"Nextcloud Snap bundled PHP runtime","vendor":"Nextcloud Snap maintainers","category":"Containers and distribution","version":"Not specified","summary":"The Snap recipe has an explicit PHP autotools part with FPM enabled and separate Redis6.3.0/APCu5.1.28 extension builds.","scope":"Inventory record: PHP-0377\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Source-built PHP-FPM and CLI; CGI/phpdbg disabled in recipe; snap-specific CLI wrapper\nPHP version scope: Moving snapcraft recipe pins php8.4.26 tarball and SHA256 4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca\nExtensions: Inspected build selections include mbstring, zip, pdo_mysql, zlib, gd, curl, openssl, bz2, sodium, exif, intl, pcntl, ftp, bcmath, sysvsem, ldap, gmp; separate redis and APCu builds. Full loaded module set unknown.\nLimitations: Source checksum is a recipe declaration, not independently hashed tarball or installed Snap revision. Snap channel/revision, application release and refresh state remain unmeasured; OS apt PHP is a separate installation. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Nextcloud Snap publisher rebuilds the bundled runtime/extensions; operator/channel/refresh policy determines rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: PHP8.4.26 tarball SHA256 declaration in moving snapcraft.yaml; Snap revision/digest pending\nSource accessed: 2026-10-17\nAliases: nextcloud-snap:php-part\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Nextcloud Snap publisher rebuilds the bundled runtime/extensions; operator/channel/refresh policy determines rollout","links":["https://github.com/nextcloud-snap/nextcloud-snap/blob/master/snap/snapcraft.yaml"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0378","name":"NextcloudPi turnkey PHP stack","vendor":"NextcloudPi project / Nextcloud community","category":"Containers and distribution","version":"Not specified","summary":"The NextcloudPi feature list explicitly includes PHP 8.1, Apache, APCu and Zend OPcache file cache.","scope":"Inventory record: PHP-0378\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache/PHP stack with CLI administration; exact loaded SAPI build unresolved\nPHP version scope: Inspected README advertises Debian 12/Bookworm and PHP 8.1; exact released image/installer manifest not pinned\nExtensions: README identifies APCu and OPcache; complete modules and exact versions unresolved\nLimitations: README is not an image SBOM, supported-version promise or observation that a current device runs PHP 8.1. Hardware targets and an installer are overlapping delivery modes, not independent installations. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: NextcloudPi stack/image maintainers, selected OS PHP package source and device/operator applying updates\nDownstream surface: NextcloudPi file service, local administration and configured storage/credentials\nRelease pin: Moving README feature scope PHP8.1; immutable image/build pin pending\nSource accessed: 2026-10-17\nAliases: nextcloudpi:stack\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"NextcloudPi stack/image maintainers, selected OS PHP package source and device/operator applying updates","links":["https://github.com/nextcloud/nextcloudpi"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0379","name":"DokuWiki official Docker distribution","vendor":"DokuWiki project","category":"Containers and distribution","version":"Not specified","summary":"The Dockerfile starts from php:8.4-apache, allows optional PHP_EXTENSIONS build arguments and creates the DokuWiki image.","scope":"Inventory record: PHP-0379\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0182\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Official PHP 8.4 Apache base; container health.php server-side request\nPHP version scope: Moving Dockerfile FROM php:8.4-apache; DOKUWIKI_VERSION stable default; exact PHP patch/application release/digest unresolved\nExtensions: PHP_EXTENSIONS build argument defaults empty; build-deps script and inherited module set not fully enumerated\nLimitations: stable/latest aliases are not immutable versions. ImageMagick executable presence is not proof the imagick PHP extension is loaded; optional build arguments are not default contents. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: DokuWiki image maintainers, Docker PHP base-image maintainers and operator rebuilding/rolling out derived images\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: docker.io/dokuwiki/dokuwiki\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"DokuWiki image maintainers, Docker PHP base-image maintainers and operator rebuilding/rolling out derived images","links":["https://github.com/dokuwiki/docker/blob/main/Dockerfile","https://github.com/dokuwiki/docker"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0380","name":"WordPress Docker Official Image distribution","vendor":"Docker Community / Docker Official Images, not WordPress upstream image ownership","category":"Containers and distribution","version":"Not specified","summary":"The packaging template derives from official PHP images and installs WordPress-serving native extensions; the repository identifies Docker Community ownership.","scope":"Inventory record: PHP-0380\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0006\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Generated PHP Apache/FPM application images; CLI template mode is a separate operational boundary\nPHP version scope: Moving template uses php:<phpVersion>-<variant>; exact rendered release/patch/digest unresolved\nExtensions: Template build selections include bcmath, exif, gd, intl, mysqli, zip and PECL imagick3.8.1; conditional CLI/server and OS branches differ\nLimitations: A template is not every rendered image. OPcache defaults cannot be inferred universally from comments; CLI/server and OS differences must be resolved against actual build recipes. WordPress application and derived image overlap. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Docker WordPress image maintainers, PHP image maintainers, derived-image publisher and deploying operator\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: docker.io/library/wordpress\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Docker WordPress image maintainers, PHP image maintainers, derived-image publisher and deploying operator","links":["https://github.com/docker-library/wordpress/blob/master/Dockerfile.template","https://github.com/docker-library/wordpress"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0381","name":"Roundcube Webmail Docker image family","vendor":"Roundcube project","category":"Containers and distribution","version":"Unrebuilt Roundcube Docker variants using pre-fix PHP 8.4 base images","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0381\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0026\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache, FPM and FPM-Alpine variants derive from corresponding official PHP images\nPHP version scope: Moving README defines variants/latest tags; historical build example still names php:7.4-apache; current exact PHP patch/digest unknown\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Do not use the stale PHP 7.4 example as the current tag runtime. Nonroot reduces process privilege but does not prove isolation or a matching flaw is harmless. SMTP/IMAP servers are separate components. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Roundcube image maintainers and PHP base-image maintainers; operator refreshes derived images and rolls out webmail containers\nDownstream surface: Webmail messages, sessions, plugins and configured IMAP/SMTP/database/OAuth credentials\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: docker.io/roundcube/roundcubemail\nConditional downstream consequence: If a matching flaw in the shipped PHP runtime or a loaded native module is reached through application input, it could cause denial of service, disclosure, data alteration or worker-level code execution. Access would be bounded by worker privileges, mounts and credentials; host or cross-tenant compromise is not established.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Roundcube image maintainers and PHP base-image maintainers; operator refreshes derived images and rolls out webmail containers","links":["https://github.com/roundcube/roundcubemail-docker","https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Roundcube's maintainer confirms that image rebuilds are needed after patched PHP base images arrive and reports build failures. No complete set of published fixed Roundcube tags is confirmed in the reviewed thread.","action":"Verify a successfully published patched image for the exact tag before pulling and redeploying; upstream PHP tag availability alone does not patch Roundcube images.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744"},"CVE-2026-109619":{"status":"Vulnerable","notes":"Roundcube's maintainer confirms that image rebuilds are needed after patched PHP base images arrive and reports build failures. No complete set of published fixed Roundcube tags is confirmed in the reviewed thread.","action":"Verify a successfully published patched image for the exact tag before pulling and redeploying; upstream PHP tag availability alone does not patch Roundcube images.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/roundcube/roundcubemail-docker/issues/468#issuecomment-6321479744"}}},{"id":"PHP-0382","name":"Composer default Docker runtime image","vendor":"Composer project / Docker Official Images","category":"Containers and distribution","version":"Not specified","summary":"The pinned recipe installs Composer 2.10.3 into a PHP8 Alpine runtime stage, makes default inherit it, and separately defines a scratch standalone-binary stage.","scope":"Inventory record: PHP-0382\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0019\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI inside binary-with-runtime/default build stage; not a production web image\nPHP version scope: Composer 2.10.3 advertised manifest source a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1; immutable recipe FROM php:8-alpine leaves PHP patch/digest floating\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Copying Composer PHAR or using the scratch stage does not copy the PHP interpreter. Documentation discourages relying on the container PHP version or using it as a production base. Composer platform overrides do not change the running interpreter. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Composer Docker image publisher plus PHP base-image maintainers; developer/CI operator replaces build images\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Composer2.10.3 build source a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1; PHP base digest unresolved\nSource accessed: 2026-10-17\nAliases: docker.io/library/composer:default\nConditional downstream consequence: If a matching PHP or loaded-parser flaw is reached while processing a project, dependency, fixture or local web request, developer/CI files or available credentials could be affected. Consequences depend on executed inputs and privileges; development use does not establish a public service or a tenant escape.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Composer Docker image publisher plus PHP base-image maintainers; developer/CI operator replaces build images","links":["https://github.com/composer/docker/blob/a23788a1b4f65ad2dd090c3ee2a7ad9e35a7d9d1/latest/Dockerfile","https://github.com/docker-library/official-images/blob/master/library/composer","https://github.com/docker-library/docs/blob/master/composer/README.md"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0383","name":"Endor browser LAMP sandbox / XAMPP for Browsers","vendor":"Endor; linked by Apache Friends","category":"Embedded runtimes","version":"Not specified","summary":"Apache Friends links its browser bundle to Endor. Endor explicitly describes a browser-run Linux/Apache/MariaDB/PHP emulator and bundled phpMyAdmin.","scope":"Inventory record: PHP-0383\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0033\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Emulated Alpine Linux/Apache/PHP environment in browser; not ordinary JavaScript client PHP inference\nPHP version scope: Apache Friends browser listing PHP 8.3.12/Alpine 3.20; Endor confirms emulated LAMP but no independently pinned runtime image/version\nExtensions: Apache Friends browser listing includes mbstring; complete emulated runtime modules unknown\nLimitations: No emulator was launched, local folder mounted or code executed. WASM/CPU architecture, isolation, persistence, runtime patch and actual browser support are not verified by the short landing page. No binary/image was pulled, installed, built or executed. Presence is not proof of an affected build, reachable flaw or compromise. Deployments were not measured.\nPatch owner: Endor sandbox/runtime publisher and browser-environment operator; Apache Friends listing alone does not establish update ownership of runtime bytes\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Moving official documentation; immutable artifact pin pending\nSource accessed: 2026-10-17\nAliases: endor:lamp-sandbox, xampp:browser-sandbox\nConditional downstream consequence: A matching flaw reached inside the emulated PHP environment could affect data or credentials made available to that environment. Crossing the emulator, browser or host boundary would need separate evidence; ordinary browser JavaScript use is not itself PHP presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Endor sandbox/runtime publisher and browser-environment operator; Apache Friends listing alone does not establish update ownership of runtime bytes","links":["https://endor.dev/s/lamp","https://www.apachefriends.org/download.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0384","name":"cPanel internal PHP for hooks and AppConfig applications","vendor":"WebPros / cPanel","category":"Hosting and cloud","version":"cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0384\nCategory: Hosting and cloud\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0028\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Internal /usr/local/cpanel/3rdparty/bin/php CLI; PHP AppConfig application configuration\nPHP version scope: cPanel PHP guide, valid for version 130 onward and revised 8 July 2026, declares internal PHP 8.4. Exact PHP patch and package revision remain unpinned.\nExtensions: Vendor-included catalogue: 50 PHP module names, 65 PEAR/PECL names and two loaders, retained in CAT-R23-CPANEL-INTERNAL. Inclusion is not a minimum application requirement or loaded-state observation.\nLimitations: The version range is a documentation scope, not a statement about every installation. Module/package labels include different component types and do not imply enabled functions. Hook/AppConfig evidence and distinct daemon/worker privileges remain qualified. No payload or service was inspected.\nPatch owner: cPanel for its internal PHP distribution; panel operator for updates and PHP application owner for hook/AppConfig code\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Guide revised 2026-07-08, valid for cPanel 130 onward; PHP 8.4 family only\nSource accessed: 2026-10-19\nAliases: cpanel:internal-php\nConditional downstream consequence: A reachable matching PHP/parser flaw in this management component could affect availability, configuration integrity or credentials accessible to its service account; code execution would inherit that account’s privileges. Root access, other tenants and lateral movement are not automatic and need a separate privilege/isolation path.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://docs.cpanel.net/changelogs/136-change-log/\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"cPanel for its internal PHP distribution; panel operator for updates and PHP application owner for hook/AppConfig code","links":["https://docs.cpanel.net/knowledge-base/general-systems-administration/cpanel-php/","https://api.docs.cpanel.net/guides/guide-to-standardized-hooks/guide-to-standardized-hooks-hook-action-code","https://docs.cpanel.net/whm/development/apps-managed-by-appconfig/","https://docs.cpanel.net/changelogs/136-change-log/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://docs.cpanel.net/changelogs/136-change-log/\nAction statement: Update to cPanel & WHM 136.0.50 on the 136 branch and verify the updated internal PHP runtime is in use."},"CVE-2026-109619":{"status":"Fix","notes":"cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://docs.cpanel.net/changelogs/136-change-log/\nAction statement: Update to cPanel & WHM 136.0.50 on the 136 branch and verify the updated internal PHP runtime is in use."}}},{"id":"PHP-0385","name":"Plesk sw-engine internal PHP management runtime","vendor":"Plesk","category":"Hosting and cloud","version":"Not specified","summary":"Plesk confirms that all versions of the Linux sw-engine internal UI component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.","scope":"Inventory record: PHP-0385\nCategory: Hosting and cloud\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0029\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: sw-engine PHP scripts, sw-engine-fpm and panel php.ini\nPHP version scope: Plesk's 21 October 2026 advisory states that all versions of Plesk for Linux sw-engine, part of the Plesk UI, are affected. Plesk plans hotfixes as 18.0.80#11 and 18.0.81#4. The earlier release note pin remains useful context: Plesk Obsidian 18.0.79 declared Linux sw-engine PHP 8.4.21.\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Do not infer that PHP 8.4.21 stayed unchanged in all later releases or that hosted-handler versions identify this engine. Linux and Windows engines, packages and service accounts differ. Exact payload, modules, privilege boundaries and deployed builds remain unknown.\nPatch owner: Plesk for internal sw-engine distribution; hosting/server operator for panel update rollout\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Plesk security advisory updated 2026-10-21; hotfixes planned as 18.0.80#11 and 18.0.81#4\nSource accessed: 2026-10-21\nAliases: plesk:sw-engine-php\nConditional downstream consequence: A reachable matching PHP/parser flaw in this management component could affect availability, configuration integrity or credentials accessible to its service account; code execution would inherit that account’s privileges. Root access, other tenants and lateral movement are not automatic and need a separate privilege/isolation path.\nVulnerability status: Confirmed affected by Plesk advisory for CVE-2026-109618 and CVE-2026-109619; hotfixes are planned but not yet released.\nCVE-2026-109618: Vulnerable\nCVE-2026-109619: Vulnerable\nCVE assessment limit: Installed build, configuration and reachable path need separate evidence.","owner":"Plesk for internal sw-engine distribution; hosting/server operator for panel update rollout","links":["https://docs.plesk.com/release-notes/obsidian/change-log/","https://support.plesk.com/hc/en-us/articles/31743316866071-The-sw-engine-process-causes-high-CPU-usage-on-a-Plesk-server","https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4","action":"Apply Plesk Obsidian hotfix 18.0.80#11 or 18.0.81#4 when available.","detail":"Added from the Plesk security advisory updated 2026-10-21; the Plesk changelog names the Windows internal PHP runtime plesk-engine while the advisory table labels the Windows UI component sw-engine."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4","action":"Apply Plesk Obsidian hotfix 18.0.80#11 or 18.0.81#4 when available.","detail":"Added from the Plesk security advisory updated 2026-10-21; the Plesk changelog names the Windows internal PHP runtime plesk-engine while the advisory table labels the Windows UI component sw-engine."}}},{"id":"PHP-0386","name":"DirectAdmin CustomBuild hosted PHP","vendor":"JBMC Software / DirectAdmin","category":"Hosting and cloud","version":"CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0386\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Per-domain/subdomain PHP; PHP-FPM, FastCGI and LSPHP modes; separate CLI settings\nPHP version scope: Up to nine selectable CustomBuild PHP slots; sample old version numbers are not a current support catalogue\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Hosting support alone does not prove DirectAdmin core is PHP. Published mode/isolation intent is not a measured tenant boundary. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: DirectAdmin/CustomBuild and selected package suppliers publish updates; server operator rebuilds and rolls out installed PHP\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: directadmin:custombuild-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://forum.directadmin.com/threads/critical-php-updates.82726/page-3\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"DirectAdmin/CustomBuild and selected package suppliers publish updates; server operator rebuilds and rolls out installed PHP","links":["https://docs.directadmin.com/webservices/php/multiple-php.html","https://docs.directadmin.com/webservices/php/php-options.html","https://forum.directadmin.com/threads/critical-php-updates.82726/page-3"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledged.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://forum.directadmin.com/threads/critical-php-updates.82726/page-3\nAction statement: Update DirectAdmin, then rebuild each active PHP runtime with CustomBuild. Confirm build success; a panel update alone does not update hosted PHP."},"CVE-2026-109619":{"status":"Fix","notes":"DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledged.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://forum.directadmin.com/threads/critical-php-updates.82726/page-3\nAction statement: Update DirectAdmin, then rebuild each active PHP runtime with CustomBuild. Confirm build success; a panel update alone does not update hosted PHP."}}},{"id":"PHP-0387","name":"CloudLinux Alt-PHP / PHP Selector runtime family","vendor":"CloudLinux / TuxCare","category":"Containers and distribution","version":"Not specified","summary":"CloudLinux identifies Alt-PHP as affected by both CVEs and reports fixed alt-php74 builds for several Linux platforms plus alt-php80 for Alpine Linux 3.23; broader family coverage is still in progress.","scope":"Inventory record: PHP-0387\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected family\nDeployment status: Not measured\nPHP surface: Parallel /opt/alt/phpXX PHP builds and selected user extensions\nPHP version scope: CloudLinux version/OS compatibility matrix includes legacy and 8.x families through 8.5; exact RPM/DEB build and backports unresolved\nExtensions: Per-user selected modules and version defaults differ; complete required and loaded list unknown\nLimitations: Alt-PHP is not the same package family as ea-PHP. Extension selection does not enable modules in every PHP version. CageFS/LVE prerequisites and a single-user mode do not prove deployed isolation. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: CloudLinux/TuxCare for Alt-PHP packages and covered backports; hosting operator for entitlements, updates and selected-user configuration\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-21\nAliases: cloudlinux:alt-php, cloudlinux:php-selector-runtimes\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Affected: CloudLinux identifies the Alt-PHP family as affected; scoped fixed alt-php74 and alt-php80 platform rows are recorded separately.\nCVE-2026-109618: Affected for the broader Alt-PHP family; scoped fixed rows recorded separately\nCVE-2026-109619: Affected for the broader Alt-PHP family; scoped fixed rows recorded separately\nCVE assessment limit: Vendor notice confirms affected Alt-PHP family scope and partial fixed-package releases, not complete family remediation or deployment status.","owner":"CloudLinux/TuxCare for Alt-PHP packages and covered backports; hosting operator for entitlements, updates and selected-user configuration","links":["https://docs.cloudlinux.com/cloudlinuxos/cloudlinux_os_components/","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5","https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected family: CloudLinux Alt-PHP; scoped fixed alt-php74 and alt-php80 platform rows are recorded separately","action":"Apply updated Alt-PHP packages when available from CloudLinux.","detail":"Added from the CloudLinux incident notice updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected family: CloudLinux Alt-PHP; scoped fixed alt-php74 and alt-php80 platform rows are recorded separately","action":"Apply updated Alt-PHP packages when available from CloudLinux.","detail":"Added from the CloudLinux incident notice updated 2026-10-21."}}},{"id":"PHP-0388","name":"CloudLinux legacy ea-PHP extended-support packages","vendor":"CloudLinux","category":"Containers and distribution","version":"Not specified","summary":"CloudLinux identifies ea-php as affected by both CVEs and says patched ea-php74 through ea-php85 packages are scheduled for EasyApache4 v25.91; release is not yet confirmed.","scope":"Inventory record: PHP-0388\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0028\nEvidence status: Vendor-confirmed affected family\nDeployment status: Not measured\nPHP surface: EasyApache ea-PHP packages managed through MultiPHP/EasyApache\nPHP version scope: Vendor documents older EOL ea-PHP on CloudLinux 6–9; exact covered branches, package releases and entitlement unresolved\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: This page’s general Linux discussion does not override its compatibility rows: ea-PHP is marked unavailable for Ubuntu/Debian there. No promise that every flaw/build is fixed follows from the product description. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: CloudLinux for its backported packages; hosting operator for subscription, package update and service rollout\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-21\nAliases: cloudlinux:ea-php-extended-support\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Affected: CloudLinux identifies ea-php as affected and states patched ea-php74 through ea-php85 packages are scheduled for EasyApache4 v25.91.\nCVE-2026-109618: Affected: patched ea-php74 through ea-php85 packages scheduled, release not yet confirmed\nCVE-2026-109619: Affected: patched ea-php74 through ea-php85 packages scheduled, release not yet confirmed\nCVE assessment limit: Vendor notice confirms affected ea-php family scope and planned EasyApache4 package releases, not completed release or deployment status.","owner":"CloudLinux for its backported packages; hosting operator for subscription, package update and service rollout","links":["https://docs.cloudlinux.com/cloudlinuxos/alt-ea_packages/","https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately","action":"Apply updated CloudLinux or TuxCare PHP packages when available.","detail":"Added from the CloudLinux knowledge base article and incident status page updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately","action":"Apply updated CloudLinux or TuxCare PHP packages when available.","detail":"Added from the CloudLinux knowledge base article and incident status page updated 2026-10-21."}}},{"id":"PHP-0389","name":"ISPConfig 3 control panel UI and scripts","vendor":"ISPConfig project","category":"Hosting and cloud","version":"ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0389\nCategory: Hosting and cloud\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP panel UI and update/maintenance scripts; exact web SAPI depends on installation\nPHP version scope: Release 3.2.12 explicitly requires system-default PHP >=7.0 for UI/scripts; this is not a current latest-release floor\nExtensions: Required in the inspected release: openssl; other required/optional modules not inventoried\nLimitations: Customer websites may use separate older PHP versions. Panel PHP and hosted-site PHP constraints must not be substituted for each other. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: ISPConfig for panel code; OS/PHP vendor and server operator for the system runtime and update rollout\nDownstream surface: Only the named PHP component and its callers\nRelease pin: ISPConfig 3.2.12 release announcement; archive advertised but bytes/hash not verified\nSource accessed: 2026-10-17\nAliases: ispconfig:3-panel\nConditional downstream consequence: A reachable matching PHP/parser flaw in this management component could affect availability, configuration integrity or credentials accessible to its service account; code execution would inherit that account’s privileges. Root access, other tenants and lateral movement are not automatic and need a separate privilege/isolation path.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"ISPConfig for panel code; OS/PHP vendor and server operator for the system runtime and update rollout","links":["https://www.ispconfig.org/blog/ispconfig-3-2-12-released/","https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix.","action":"Update the system PHP runtime and restart workers. Follow the vendor's temporary isolation/guard guidance only until a confirmed PHP fix is applied.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/"},"CVE-2026-109619":{"status":"Vulnerable","notes":"ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix.","action":"Update the system PHP runtime and restart workers. Follow the vendor's temporary isolation/guard guidance only until a confirmed PHP fix is applied.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.ispconfig.org/blog/php2shell-critical-php-vulnerabilities-cve-2026-109618-cve-2026-109619/"}}},{"id":"PHP-0390","name":"Froxlor control panel PHP branches","vendor":"Froxlor Team","category":"Hosting and cloud","version":"Not specified","summary":"The main manifest declares PHP^8.5 and Laravel13, while the separately scoped 2.0 migration guide documents older PHP requirements and PHP CLI helpers.","scope":"Inventory record: PHP-0390\nCategory: Hosting and cloud\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP panel/API and console helpers; main branch Laravel/Artisan\nPHP version scope: 2.0 migration guide: PHP7.4+; inspected moving main manifest: ^8.5 and Laravel^13.0. Main is not assumed to be a released 2.x version\nExtensions: 2.0 only: required session,ctype,xml,filter,posix,mbstring,curl,gmp,json; suggested bcmath,zip. Main complete extension set unresolved\nLimitations: 2.3 migration page retrieval failed. Preserve branch-specific floors; neither the 2.0 guide nor moving main establishes all stable 2.x release requirements. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Froxlor and dependencies for panel code; runtime/package vendor and server operator for PHP updates\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: froxlor:panel\nConditional downstream consequence: A reachable matching PHP/parser flaw in this management component could affect availability, configuration integrity or credentials accessible to its service account; code execution would inherit that account’s privileges. Root access, other tenants and lateral movement are not automatic and need a separate privilege/isolation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Froxlor and dependencies for panel code; runtime/package vendor and server operator for PHP updates","links":["https://github.com/froxlor/froxlor/blob/main/composer.json","https://docs.froxlor.org/v2/general/migration-guide.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0391","name":"HestiaCP hestia-php internal runtime","vendor":"Hestia Control Panel project","category":"Hosting and cloud","version":"Unpatched HestiaCP bundled hestia-php runtime; fix still being built","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0391\nCategory: Hosting and cloud\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Separately compiled hestia-php package; system /usr/bin/php used for Composer dependency setup\nPHP version scope: Hestia 1.10.5 release dated 14 September 2026 explicitly bumps hestia-php to 8.5.10. Advertised release commit 7d617fd1c5fd3be86458c7f53a6dad4a444b0a82 was opened; native package bytes remain unverified.\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: The panel release commit is a source-reference pin, not a binary hash or verification of GitHub signature metadata. Co-listed OpenSSL/PCRE updates do not independently prove their linkage into this PHP package. Hosted-site PHP and system PHP used during setup remain separate. Complete modules, ABI, package revisions and installed state remain unknown.\nPatch owner: Hestia package maintainers for hestia-php builds; operator for native runtime/package rollout and system PHP used during setup\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Hestia 1.10.5, 2026-09-14; hestia-php 8.5.10; release commit 7d617fd1c5fd3be86458c7f53a6dad4a444b0a82\nSource accessed: 2026-10-19\nAliases: hestiacp:hestia-php\nConditional downstream consequence: A reachable matching PHP/parser flaw in this management component could affect availability, configuration integrity or credentials accessible to its service account; code execution would inherit that account’s privileges. Root access, other tenants and lateral movement are not automatic and need a separate privilege/isolation path.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Hestia package maintainers for hestia-php builds; operator for native runtime/package rollout and system PHP used during setup","links":["https://github.com/hestiacp/hestiacp/releases/tag/1.10.5","https://hestiacp.com/docs/contributing/building","https://hestiacp.com/docs/server-administration/configuration","https://github.com/hestiacp/hestiacp/commit/7d617fd1c5fd3be86458c7f53a6dad4a444b0a82","https://forum.hestiacp.com/t/hestia-1-10-5-release/22209","https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"HestiaCP's maintainer explicitly confirms its bundled hestia-php remains vulnerable while a fix is prepared. This is distinct from patched distribution PHP serving hosted websites; INI changes are not a complete fix.","action":"Apply the hestia-php update once published and verify the panel's running runtime; updating hosted-site PHP alone does not patch the panel.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423"},"CVE-2026-109619":{"status":"Vulnerable","notes":"HestiaCP's maintainer explicitly confirms its bundled hestia-php remains vulnerable while a fix is prepared. This is distinct from patched distribution PHP serving hosted websites; INI changes are not a complete fix.","action":"Apply the hestia-php update once published and verify the panel's running runtime; updating hosted-site PHP alone does not patch the panel.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423"}}},{"id":"PHP-0392","name":"HestiaCP hosted-site PHP-FPM / MultiPHP option","vendor":"Hestia Control Panel project","category":"Hosting and cloud","version":"HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0392\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Optional PHP-FPM and MultiPHP installation configuration\nPHP version scope: Hestia install page labeled1.10.5; exact offered PHP branches/builds unresolved\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: These customer runtime options are separate from hestia-php. Installer availability does not prove selected options, installed modules or active listeners. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Selected PHP repository/package vendor and Hestia integration maintainers; operator applies packages and per-site configuration\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: hestiacp:hosted-site-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Selected PHP repository/package vendor and Hestia integration maintainers; operator applies packages and per-site configuration","links":["https://hestiacp.com/install","https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423\nAction statement: Install the confirmed PHP packages for each hosted-site runtime and restart workers; separately track the hestia-php panel update."},"CVE-2026-109619":{"status":"Fix","notes":"HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/hestiacp/hestiacp/issues/5817#issuecomment-6318435423\nAction statement: Install the confirmed PHP packages for each hosted-site runtime and restart workers; separately track the hestia-php panel update."}}},{"id":"PHP-0393","name":"Pterodactyl Panel PHP application","vendor":"Pterodactyl project","category":"Hosting and cloud","version":"Not specified","summary":"The Panel manifest declares PHP, Laravel and required PHP extensions for the management application.","scope":"Inventory record: PHP-0393\nCategory: Hosting and cloud\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0017\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Laravel PHP panel and CLI jobs; exact web SAPI not pinned\nPHP version scope: Inspected 1.0-develop root constraint ^8.2 || ^8.3 with Laravel^12.60.0; platform.php8.2.0 is dependency-resolution configuration\nExtensions: Required root declarations: json,mbstring,pdo,pdo_mysql,posix,zip; transitive and optional set incomplete\nLimitations: Composer caret constraints are not an 8.2/8.3-only upper bound. require-dev tools are not production requirements. Wings, hosted game servers and browser clients are separate components. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Pterodactyl for Panel code/dependencies; server/runtime vendor and operator for PHP rollout\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: pterodactyl:panel\nConditional downstream consequence: A reachable matching PHP/parser flaw in this management component could affect availability, configuration integrity or credentials accessible to its service account; code execution would inherit that account’s privileges. Root access, other tenants and lateral movement are not automatic and need a separate privilege/isolation path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Pterodactyl for Panel code/dependencies; server/runtime vendor and operator for PHP rollout","links":["https://github.com/pterodactyl/panel/blob/1.0-develop/composer.json","https://github.com/pterodactyl/wings/blob/develop/go.mod"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0394","name":"CyberPanel hosted PHP / LSPHP options","vendor":"CyberPanel project","category":"Hosting and cloud","version":"Not specified","summary":"CyberPanel’s official README advertises selectable PHP families for hosted applications.","scope":"Inventory record: PHP-0394\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Customer PHP options alongside OpenLiteSpeed/LiteSpeed; exact selected handler/build unknown\nPHP version scope: Inspected v3.0.5-dev README lists PHP8.1–8.5 plus older8.0/7.4; not a verified stable-release support schedule\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: README lifecycle dates are not accepted as upstream PHP maintenance evidence. Python entrypoint evidence does not exclude PHP in every optional subcomponent. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: CyberPanel integration maintainers and selected LSPHP repositories publish changes; operator updates runtime packages and site selections\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: cyberpanel:hosted-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"CyberPanel integration maintainers and selected LSPHP repositories publish changes; operator updates runtime packages and site selections","links":["https://github.com/usmannasir/cyberpanel","https://github.com/usmannasir/cyberpanel/blob/v3.0.5-dev/manage.py"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0395","name":"aaPanel PHP Project hosting and CLI selection","vendor":"aaPanel","category":"Hosting and cloud","version":"aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0395\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Per-site PHP version selection, separate PHP CLI version setting and optional Composer actions\nPHP version scope: Moving PHP Project guide; exact installed PHP branches/builds unresolved\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: This is evidence of managed PHP workloads, not aaPanel core implementation. Web and CLI selections can differ; an app catalogue does not establish installed packages. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: aaPanel/PHP package providers and hosting operator for selected runtimes; app owner for Composer dependencies\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: aapanel:php-project\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.aapanel.com/forum/d/26249-critical-php-security-update\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"aaPanel/PHP package providers and hosting operator for selected runtimes; app owner for Composer dependencies","links":["https://www.aapanel.com/docs/Function/php.html","https://www.aapanel.com/forum/d/26249-critical-php-security-update"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.aapanel.com/forum/d/26249-critical-php-security-update\nAction statement: Refresh the aaPanel App Store, update each installed PHP branch to its patched release, and verify serving workers use the new build."},"CVE-2026-109619":{"status":"Fix","notes":"aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.aapanel.com/forum/d/26249-critical-php-security-update\nAction statement: Refresh the aaPanel App Store, update each installed PHP branch to its patched release, and verify serving workers use the new build."}}},{"id":"PHP-0396","name":"Virtualmin hosted PHP execution modes","vendor":"Virtualmin","category":"Hosting and cloud","version":"Not specified","summary":"Virtualmin documents PHP-FPM and FCGId/CGI wrapper execution for customer PHP applications.","scope":"Inventory record: PHP-0396\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Default/recommended PHP-FPM; FCGId/CGI wrapper with suEXEC; per-virtual-server configuration\nPHP version scope: Moving PHP execution guide; no exact currently installed branch/patch established\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: The guide’s pool/isolation design is not measured isolation or a tenant-escape claim. This does not replace prior contrary evidence about Webmin core implementation. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: OS/PHP package publisher and server operator; Virtualmin for integration/configuration code\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: virtualmin:hosted-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OS/PHP package publisher and server operator; Virtualmin for integration/configuration code","links":["https://www.virtualmin.com/docs/server-components/php-execution-modes/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0397","name":"Google App Engine Standard PHP runtime","vendor":"Google Cloud","category":"Hosting and cloud","version":"PHP 8.2+ supported runtimes","summary":"Google documents its managed Standard PHP runtime, PHP-FPM serving and automatic patch updates within the selected runtime family.","scope":"Inventory record: PHP-0397\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Managed php-fpm/web front controller; optional long-running PHP CLI entrypoint\nPHP version scope: Current guide demonstrates runtime php85 (PHP8.5 family); configured major/minor with automatic patch updates, not automatic minor upgrades\nExtensions: Default examples include curl,gd,intl,mbstring,openssl,PDO; optional ini-enabled modules include redis,mongodb,imagick,grpc,protobuf; full list/version availability not normalized\nLimitations: Only apps selecting the PHP runtime are in scope. Documentation updated2026-10-07 is not a measured installed patch or proof of control-plane PHP. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Google for managed runtime patch delivery; app operator for major/minor selection, application dependencies and rollout verification\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: gcp:appengine-standard-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Google for managed runtime patch delivery; app operator for major/minor selection, application dependencies and rollout verification","links":["https://docs.cloud.google.com/appengine/docs/standard/php-gen2/runtime","https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically","action":"","detail":"Added from the Google Cloud bulletin and blog post published 2026-10-21.\nAction statement: Upgrade unsupported App Engine Standard PHP runtimes to PHP 8.2 or newer and redeploy."},"CVE-2026-109619":{"status":"Fix","notes":"Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically","action":"","detail":"Added from the Google Cloud bulletin and blog post published 2026-10-21.\nAction statement: Upgrade unsupported App Engine Standard PHP runtimes to PHP 8.2 or newer and redeploy."}}},{"id":"PHP-0398","name":"Google App Engine Flexible PHP runtime","vendor":"Google Cloud","category":"Hosting and cloud","version":"App Engine Flexible PHP runtimes not redeployed onto patched supported images","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0398\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Managed nginx/php-fpm under supervisord; Composer dependency build\nPHP version scope: Guide demonstrates PHP8.5/Ubuntu24 and MAJOR.MINOR.* selection; patch runtime regularly updated, exact served patch unknown\nExtensions: Guide lists pre-enabled modules and optional ini-enabled grpc,imagick,memcached,mongodb,redis; zip is marked Ubuntu22-only. Complete loaded set unknown\nLimitations: Old7.3-and-earlier examples appear below a warning that EOL runtime deployment is blocked. They are not current support. Custom runtimes are a different patch boundary. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Google for supported managed stack updates; app operator for supported runtime configuration and app dependencies\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: gcp:appengine-flex-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Google for supported managed stack updates; app operator for supported runtime configuration and app dependencies","links":["https://docs.cloud.google.com/appengine/docs/flexible/php/runtime","https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding with fixed PHP; unsupported runtimes remain exposed.","action":"Redeploy using a patched supported PHP runtime. Rebuild custom images first; verify the running PHP build after deployment.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"},"CVE-2026-109619":{"status":"Vulnerable","notes":"Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding with fixed PHP; unsupported runtimes remain exposed.","action":"Redeploy using a patched supported PHP runtime. Rebuild custom images first; verify the running PHP build after deployment.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"}}},{"id":"PHP-0399","name":"Google Cloud Run customer PHP container option","vendor":"Google Cloud; customer image publisher","category":"Hosting and cloud","version":"Cloud Run customer containers with unpatched PHP on their respective branches","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0399\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0032\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Official example php:8.4-apache container; other container SAPIs are customer-defined\nPHP version scope: Quickstart Dockerfile uses mutable php:8.4-apache; digest, patch and deployed image unknown\nExtensions: Quickstart enables OPcache; other required/installed modules depend on customer image\nLimitations: PHP is inside this selected workload image, not inferred throughout Cloud Run or Google’s backend. A mutable base tag does not verify rebuilt runtime bytes. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: PHP base-image maintainers and customer image owner; customer rebuilds and deploys updated container\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: gcp:cloud-run-php-container\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"PHP base-image maintainers and customer image owner; customer rebuilds and deploys updated container","links":["https://docs.cloud.google.com/run/docs/quickstarts/build-and-deploy/deploy-php-service","https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe.","action":"Rebuild the customer image with fixed PHP and redeploy. Automatic base-image updates only cover eligible services configured to use them.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"},"CVE-2026-109619":{"status":"Vulnerable","notes":"Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe.","action":"Rebuild the customer image with fixed PHP and redeploy. Automatic base-image updates only cover eligible services configured to use them.","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619"}}},{"id":"PHP-0400","name":"Heroku PHP buildpack and application runtime","vendor":"Heroku / Salesforce","category":"Hosting and cloud","version":"Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0400\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Buildpack PHP app/Composer build and web/CLI workload; exact launcher/SAPI not pinned in this read\nPHP version scope: Advertised PHP8.1.34(h22,EOL),8.2.34(h22/24),8.3.35(h22/24),8.4.26(h22/24/26),8.5.11(h22/24/26)\nExtensions: Selected default examples curl,ctype,dom,fileinfo; opt-in examples bcmath,gd,intl,gmp. Not a complete loaded or PECL inventory\nLimitations: The availability table includes an expressly EOL/not-supported8.1 entry despite broad introductory support wording. Eleven nonblank stack choices are not installations or all supported choices. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Heroku for buildpack/stack distributions; app owner for selected constraints, rebuild/redeploy and compatibility verification\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving Heroku PHP support table retrieved2026-10-17; exact slug/buildpack commit not pinned\nSource accessed: 2026-10-17\nAliases: heroku:php-buildpack-runtime\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://devcenter.heroku.com/changelog-items/3845\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Heroku for buildpack/stack distributions; app owner for selected constraints, rebuild/redeploy and compatibility verification","links":["https://devcenter.heroku.com/articles/php-support","https://devcenter.heroku.com/changelog-items/3845"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://devcenter.heroku.com/changelog-items/3845\nAction statement: Redeploy the application using a supported fixed PHP runtime. Do not mistake the unchanged 8.1.34 upstream version for proof that the old build was patched."},"CVE-2026-109619":{"status":"Fix","notes":"Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://devcenter.heroku.com/changelog-items/3845\nAction statement: Redeploy the application using a supported fixed PHP runtime. Do not mistake the unchanged 8.1.34 upstream version for proof that the old build was patched."}}},{"id":"PHP-0401","name":"Upsun PHP application containers","vendor":"Upsun","category":"Hosting and cloud","version":"Managed PHP runtime images: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports for 7.4 / 8.0 / 8.1","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0401\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Managed PHP-FPM, FrankenPHP or Swoole application runtime options\nPHP version scope: Managed PHP runtime images: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports for 7.4 / 8.0 / 8.1\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Older ZTS examples are not accepted as a current supported-version catalogue. Platform.sh branding/legacy plan equivalence and control-plane implementation remain unverified. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Upsun for its managed runtime patches; app owner for selected runtime mode and application dependencies\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Managed PHP runtime images: 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor backports for 7.4 / 8.0 / 8.1\nSource accessed: 2026-10-22\nAliases: upsun:php-application-runtime\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Upsun's official technical notice names both CVEs and the patched images; its public incident RSS confirms grid deployment on 21 October and completed Dedicated-cluster patch deployment at 04:12 UTC on 22 October. PHP 7.3 and earlier receive no updates, and composable images require the separate customer action described by the vendor. Edge mitigations alone are not a fix.\nCVE-2026-109619: Upsun's official technical notice names both CVEs and the patched images; its public incident RSS confirms grid deployment on 21 October and completed Dedicated-cluster patch deployment at 04:12 UTC on 22 October. PHP 7.3 and earlier receive no updates, and composable images require the separate customer action described by the vendor. Edge mitigations alone are not a fix.\nVendor advisory sources: https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check; https://status.upsun.com/incidents/2cdvc2ctv5jwb; https://status.upsun.com/data/rss/feed.xml\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Upsun for its managed runtime patches; app owner for selected runtime mode and application dependencies","links":["https://developer.upsun.com/docs/languages/php","https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check","https://status.upsun.com/incidents/2cdvc2ctv5jwb","https://status.upsun.com/data/rss/feed.xml"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Upsun's official technical notice names both CVEs and the patched images; its public incident RSS confirms grid deployment on 21 October and completed Dedicated-cluster patch deployment at 04:12 UTC on 22 October. PHP 7.3 and earlier receive no updates, and composable images require the separate customer action described by the vendor. Edge mitigations alone are not a fix.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check; https://status.upsun.com/incidents/2cdvc2ctv5jwb; https://status.upsun.com/data/rss/feed.xml\nAction statement: Verify the actual runtime after Upsun's managed refresh. Follow the vendor's separate instructions for composable images, and migrate PHP 7.3 or earlier to a patched supported branch."},"CVE-2026-109619":{"status":"Fix","notes":"Upsun's official technical notice names both CVEs and the patched images; its public incident RSS confirms grid deployment on 21 October and completed Dedicated-cluster patch deployment at 04:12 UTC on 22 October. PHP 7.3 and earlier receive no updates, and composable images require the separate customer action described by the vendor. Edge mitigations alone are not a fix.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://developer.upsun.com/posts/releases/critical-php-security-patches-upsun-rollout-and-what-to-check; https://status.upsun.com/incidents/2cdvc2ctv5jwb; https://status.upsun.com/data/rss/feed.xml\nAction statement: Verify the actual runtime after Upsun's managed refresh. Follow the vendor's separate instructions for composable images, and migrate PHP 7.3 or earlier to a patched supported branch."}}},{"id":"PHP-0402","name":"Acquia Cloud Platform PHP hosting","vendor":"Acquia","category":"Hosting and cloud","version":"Not specified","summary":"Acquia publishes selectable PHP runtime settings for Cloud Platform environments.","scope":"Inventory record: PHP-0402\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Managed customer PHP environment and runtime settings; exact SAPI not resolved\nPHP version scope: Guide lists Acquia PHP8.5,8.4,8.3,8.2; both8.5 and8.3 are labeled default without resolved context\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Two default labels in the same page are retained as a source conflict, not silently resolved. Exact patch, modules and per-plan rollout unknown; hosted Drupal does not prove provider backend PHP. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Acquia for managed runtime packages; customer app owner for version selection and app dependencies\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: acquia:cloud-platform-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Acquia for managed runtime packages; customer app owner for version selection and app dependencies","links":["https://docs.acquia.com/acquia-cloud-platform/configuring-php-settings"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0403","name":"Pantheon managed PHP application runtime","vendor":"Pantheon","category":"Hosting and cloud","version":"Patched production/LTS and paid pre-production runtimes; upstream PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 plus vendor LTS backports","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0403\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Managed PHP customer application runtime; exact SAPI/module set unresolved\nPHP version scope: Patched production/LTS and paid pre-production runtimes; upstream PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 plus vendor LTS backports\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Published availability/security-update announcements do not show every tenant’s installed patch. Provider legacy availability is not upstream security support. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Pantheon for runtime distribution/rollout; site owner for supported version choice and application compatibility\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Patched production/LTS and paid pre-production runtimes; upstream PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 plus vendor LTS backports\nSource accessed: 2026-10-22\nAliases: pantheon:php-runtime\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Pantheon's current official incident API confirms patched live production, LTS, SFTP-mode and paid pre-production environments. The 22 October update leaves free/sandbox environments pending over the next 24-48 hours. This is a scoped confirmed fix, not fleet-wide completion; customers should follow their environment-specific status.\nCVE-2026-109619: Pantheon's current official incident API confirms patched live production, LTS, SFTP-mode and paid pre-production environments. The 22 October update leaves free/sandbox environments pending over the next 24-48 hours. This is a scoped confirmed fix, not fleet-wide completion; customers should follow their environment-specific status.\nVendor advisory sources: https://status.pantheon.io/incidents/x7h8z1yhgvml; https://status.pantheon.io/api/v2/incidents/x7h8z1yhgvml.json\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Pantheon for runtime distribution/rollout; site owner for supported version choice and application compatibility","links":["https://docs.pantheon.io/guides/php","https://docs.pantheon.io/release-notes/2026/09/php-82-83-84-85-security-updates","https://status.pantheon.io/incidents/x7h8z1yhgvml","https://status.pantheon.io/api/v2/incidents/x7h8z1yhgvml.json"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Pantheon's current official incident API confirms patched live production, LTS, SFTP-mode and paid pre-production environments. The 22 October update leaves free/sandbox environments pending over the next 24-48 hours. This is a scoped confirmed fix, not fleet-wide completion; customers should follow their environment-specific status.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://status.pantheon.io/incidents/x7h8z1yhgvml; https://status.pantheon.io/api/v2/incidents/x7h8z1yhgvml.json\nAction statement: Check the named environment's rollout state. Platform patching does not require a customer deployment, but pending free/sandbox and custom/self-managed runtimes need separate confirmation."},"CVE-2026-109619":{"status":"Fix","notes":"Pantheon's current official incident API confirms patched live production, LTS, SFTP-mode and paid pre-production environments. The 22 October update leaves free/sandbox environments pending over the next 24-48 hours. This is a scoped confirmed fix, not fleet-wide completion; customers should follow their environment-specific status.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://status.pantheon.io/incidents/x7h8z1yhgvml; https://status.pantheon.io/api/v2/incidents/x7h8z1yhgvml.json\nAction statement: Check the named environment's rollout state. Platform patching does not require a customer deployment, but pending free/sandbox and custom/self-managed runtimes need separate confirmation."}}},{"id":"PHP-0404","name":"WP Engine managed WordPress PHP hosting","vendor":"WP Engine","category":"Hosting and cloud","version":"Not specified","summary":"WP Engine’s guide documents PHP environment selection, staged version availability and forced EOL upgrades with a legacy exception.","scope":"Inventory record: PHP-0404\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0006\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Managed per-environment PHP version selection; exact web SAPI not established\nPHP version scope: Guide lists7.4,8.2,8.4 and a temporary7.4 extended-support exception; exact current environment patch/catalogue unresolved\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: The same page contains old WordPress/PHP compatibility wording and an EOL-removal rule alongside7.4 extended support. Treat this as bounded provider documentation, not authoritative current upstream lifecycle evidence. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: WP Engine for platform runtime updates/upgrades; customer for app compatibility and runtime choice where permitted\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: wpengine:php-hosting\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"WP Engine for platform runtime updates/upgrades; customer for app compatibility and runtime choice where permitted","links":["https://wpengine.com/support/php-guide/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0405","name":"Kinsta managed WordPress PHP hosting","vendor":"Kinsta","category":"Hosting and cloud","version":"Platform-wide PHP security rollout completed 2026-10-22 08:26 UTC; covered branches 7.4 / 8.0 / 8.1 / 8.2 / 8.3 / 8.4 / 8.5","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0405\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0006\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Managed WordPress PHP settings; selected engine version\nPHP version scope: Platform-wide PHP security rollout completed 2026-10-22 08:26 UTC; covered branches 7.4 / 8.0 / 8.1 / 8.2 / 8.3 / 8.4 / 8.5\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Availability of legacy families is not upstream maintenance or proof of a particular vendor fix. Native modules, service SAPI and current tenant builds remain unmeasured. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Kinsta for managed runtime distribution; customer for app compatibility/version selection and application dependencies\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Platform-wide PHP security rollout completed 2026-10-22 08:26 UTC; covered branches 7.4 / 8.0 / 8.1 / 8.2 / 8.3 / 8.4 / 8.5\nSource accessed: 2026-10-22\nAliases: kinsta:wordpress-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Kinsta's official incident reports the PHP security updates rolled out across the platform at 08:26 UTC on 22 October, following explicit branch-by-branch patch rollout updates. This records the vendor's completed managed-platform remediation, not a published independent package build ID or a guarantee about prior compromise.\nCVE-2026-109619: Kinsta's official incident reports the PHP security updates rolled out across the platform at 08:26 UTC on 22 October, following explicit branch-by-branch patch rollout updates. This records the vendor's completed managed-platform remediation, not a published independent package build ID or a guarantee about prior compromise.\nVendor advisory sources: https://status.kinsta.com/incidents/c0c6xl1ghpb2; https://www.php.net/archive/2026.php#2026-10-21-5\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Kinsta for managed runtime distribution; customer for app compatibility/version selection and application dependencies","links":["https://kinsta.com/docs/wordpress-hosting/php/","https://status.kinsta.com/incidents/c0c6xl1ghpb2","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Kinsta's official incident reports the PHP security updates rolled out across the platform at 08:26 UTC on 22 October, following explicit branch-by-branch patch rollout updates. This records the vendor's completed managed-platform remediation, not a published independent package build ID or a guarantee about prior compromise.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://status.kinsta.com/incidents/c0c6xl1ghpb2; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Verify the running environment and follow Kinsta's incident guidance; no customer runtime deployment is required for the managed rollout."},"CVE-2026-109619":{"status":"Fix","notes":"Kinsta's official incident reports the PHP security updates rolled out across the platform at 08:26 UTC on 22 October, following explicit branch-by-branch patch rollout updates. This records the vendor's completed managed-platform remediation, not a published independent package build ID or a guarantee about prior compromise.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://status.kinsta.com/incidents/c0c6xl1ghpb2; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Verify the running environment and follow Kinsta's incident guidance; no customer runtime deployment is required for the managed rollout."}}},{"id":"PHP-0406","name":"WordPress.com plugin-enabled PHP hosting environment","vendor":"Automattic / WordPress.com","category":"Hosting and cloud","version":"Not specified","summary":"WordPress.com publishes PHP8.3/8.4 and a module environment for plugin-enabled hosting plans.","scope":"Inventory record: PHP-0406\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0006\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Server-side PHP hosting with nginx; SAPI label cgi-fcgi in published module list\nPHP version scope: PHP environment page reviewed2026-09-08 lists8.3 and8.4; plugin-enabled plans only\nExtensions: Available examples APCu,bcmath,curl,gd,intl,mbstring,mysqli,pdo_mysql,sodium; table blanks do not prove ionCube/Suhosin installation\nLimitations: This page does not establish every WordPress.com plan’s runtime, every module’s enabled state, or PHP in a browser/mobile client. WordPress core auto-updates are not PHP runtime auto-updates. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: WordPress.com for managed PHP platform; site owner for selected compatible version and plugins/themes\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: wordpress.com:plugin-enabled-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"WordPress.com for managed PHP platform; site owner for selected compatible version and plugins/themes","links":["https://wordpress.com/support/php-environment/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0407","name":"Laravel Cloud PHP runtime option","vendor":"Laravel","category":"Hosting and cloud","version":"Laravel Cloud managed runtimes: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0407\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0017\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Managed PHP application runtime; SAPI not established by inspected runtime list\nPHP version scope: Laravel Cloud managed runtimes: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12\nExtensions: pdo_sqlsrv temporarily unavailable on PHP8.5; documentation directs affected users to8.2–8.4. Other modules unknown\nLimitations: The platform also lists non-PHP languages. Laravel branding does not prove every workload or the provider control plane is PHP; exact patch/container identity unresolved. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Laravel Cloud for managed runtime; app owner selects compatible version, redeploys and updates dependencies\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Laravel Cloud managed runtimes: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12\nSource accessed: 2026-10-22\nAliases: laravel-cloud:php-runtime\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Laravel's official response, updated 21 October 23:26 UTC, confirms every running Cloud application was patched in place and new deployments use fixed base images. No customer redeploy was needed. This finding is limited to Laravel Cloud, not arbitrary self-hosted Laravel applications.\nCVE-2026-109619: Laravel's official response, updated 21 October 23:26 UTC, confirms every running Cloud application was patched in place and new deployments use fixed base images. No customer redeploy was needed. This finding is limited to Laravel Cloud, not arbitrary self-hosted Laravel applications.\nVendor advisory sources: https://laravel.com/blog/php-critical-vulnerability-response-updates; https://www.php.net/archive/2026.php#2026-10-21-5\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Laravel Cloud for managed runtime; app owner selects compatible version, redeploys and updates dependencies","links":["https://laravel.com/cloud/docs/runtimes","https://laravel.com/cloud/docs/environments","https://laravel.com/blog/php-critical-vulnerability-response-updates","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Laravel's official response, updated 21 October 23:26 UTC, confirms every running Cloud application was patched in place and new deployments use fixed base images. No customer redeploy was needed. This finding is limited to Laravel Cloud, not arbitrary self-hosted Laravel applications.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://laravel.com/blog/php-critical-vulnerability-response-updates; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Verify the selected managed runtime; Laravel confirms the Cloud patch was applied in place without customer redeployment."},"CVE-2026-109619":{"status":"Fix","notes":"Laravel's official response, updated 21 October 23:26 UTC, confirms every running Cloud application was patched in place and new deployments use fixed base images. No customer redeploy was needed. This finding is limited to Laravel Cloud, not arbitrary self-hosted Laravel applications.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://laravel.com/blog/php-critical-vulnerability-response-updates; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Verify the selected managed runtime; Laravel confirms the Cloud patch was applied in place without customer redeployment."}}},{"id":"PHP-0408","name":"Laravel Vapor PHP serverless hosting configuration","vendor":"Laravel; AWS infrastructure","category":"Hosting and cloud","version":"Laravel Vapor native PHP 8.2+ patched runtimes; PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0408\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0017\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Native Lambda PHP runtime families or custom Docker runtime; architecture-specific options\nPHP version scope: Laravel Vapor native PHP 8.2+ patched runtimes; PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12\nExtensions: Native runtime cannot add arbitrary extensions such as imagick; custom Docker mode supports extension customization; full module set unknown\nLimitations: AL2 maintenance ended2026-06-30 according to guide. Historical Docker tag availability is not proof of maintained support or installed bytes. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Laravel for native/layer and base-image distributions; customer for mode selection, custom-image rebuilds and deployment\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Laravel Vapor native PHP 8.2+ patched runtimes; PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12\nSource accessed: 2026-10-22\nAliases: laravel-vapor:php-runtime-selection\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Laravel confirms the patched Vapor runtimes are live. Native PHP 8.2+ applications must be redeployed; custom/Docker runtime applications need a new build/deployment. PHP 8.0 and 8.1 are explicitly excluded from the available patch confirmation and must be upgraded.\nCVE-2026-109619: Laravel confirms the patched Vapor runtimes are live. Native PHP 8.2+ applications must be redeployed; custom/Docker runtime applications need a new build/deployment. PHP 8.0 and 8.1 are explicitly excluded from the available patch confirmation and must be upgraded.\nVendor advisory sources: https://laravel.com/blog/php-critical-vulnerability-response-updates; https://www.php.net/archive/2026.php#2026-10-21-5\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Laravel for native/layer and base-image distributions; customer for mode selection, custom-image rebuilds and deployment","links":["https://docs.vapor.build/projects/environments","https://laravel.com/blog/php-critical-vulnerability-response-updates","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Laravel confirms the patched Vapor runtimes are live. Native PHP 8.2+ applications must be redeployed; custom/Docker runtime applications need a new build/deployment. PHP 8.0 and 8.1 are explicitly excluded from the available patch confirmation and must be upgraded.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://laravel.com/blog/php-critical-vulnerability-response-updates; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Redeploy native PHP 8.2+ applications; rebuild and make a new deployment for custom/Docker runtimes. Upgrade PHP 8.0/8.1."},"CVE-2026-109619":{"status":"Fix","notes":"Laravel confirms the patched Vapor runtimes are live. Native PHP 8.2+ applications must be redeployed; custom/Docker runtime applications need a new build/deployment. PHP 8.0 and 8.1 are explicitly excluded from the available patch confirmation and must be upgraded.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://laravel.com/blog/php-critical-vulnerability-response-updates; https://www.php.net/archive/2026.php#2026-10-21-5\nAction statement: Redeploy native PHP 8.2+ applications; rebuild and make a new deployment for custom/Docker runtimes. Upgrade PHP 8.0/8.1."}}},{"id":"PHP-0409","name":"Laravel Vapor PHP Docker base image family","vendor":"Laravel","category":"Containers and distribution","version":"Not specified","summary":"Vapor’s Docker instructions name its PHP base-image family and architecture/version tag choices.","scope":"Inventory record: PHP-0409\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0408\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP Lambda-oriented Docker base runtime; exact handler differs by deployment configuration\nPHP version scope: Eleven documented base tags: php85,php85-arm,php84,php84-arm,php83,php83-arm,php82,php82-arm,php81,php80,php74\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: One family row, not eleven products/installations. Old tags do not establish current patch support; no image digest, SBOM or modules verified. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Laravel for base-image releases; derived-image publisher/operator for extension builds, updated base resolution and deployment\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: docker.io/laravelphp/vapor\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Laravel for base-image releases; derived-image publisher/operator for extension builds, updated base resolution and deployment","links":["https://docs.vapor.build/projects/environments"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0410","name":"Laravel Vapor core PHP invocation package","vendor":"Laravel","category":"Frameworks and packages","version":"Not specified","summary":"The published package manifest identifies Vapor’s PHP invocation handlers and runtime dependencies.","scope":"Inventory record: PHP-0410\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0408\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP kernel/invocation handlers and FastCGI client; not merely an AWS API SDK\nPHP version scope: Packagist v2.47.0 (2026-08-26): root PHP^7.2|^8.0; effective app/framework/runtime floor may be higher\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Root package compatibility is not a supported deployed Lambda runtime list. AWS SDK dependency does not establish AWS service implementation. require-dev analysis/test packages remain development-only. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Laravel for vapor-core; application owner for lockfile/runtime update and redeployment\nDownstream surface: Only the named PHP component and its callers\nRelease pin: v2.47.0; advertised source09a267e54650ea2c4cc8e0fa18357c207934db7c; source bytes not independently verified\nSource accessed: 2026-10-17\nAliases: laravel/vapor-core\nConditional downstream consequence: A matching runtime/parser flaw reached by this adapter’s event, HTTP or task inputs could affect its PHP process and accessible workload data or credentials. The deployed runtime, loaded modules, invocation path and permissions must match; a PHP package does not prove the implementation of the remote AWS or hosting control plane.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Laravel for vapor-core; application owner for lockfile/runtime update and redeployment","links":["https://packagist.org/packages/laravel/vapor-core"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0411","name":"Bref v2 PHP Docker images","vendor":"Bref project","category":"Containers and distribution","version":"Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27","summary":"Bref confirms published patched v2 Docker images for PHP 8.2 through 8.4; rebuild derived images with fresh base layers and redeploy.","scope":"Inventory record: PHP-0411\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed images\nDeployment status: Not measured\nPHP surface: Bref v2 PHP Docker images\nPHP version scope: The official release notice confirms bref/php-8x-fpm:2, bref/php-8x:2 and bref/php-8x-console:2 are updated for PHP 8.2 through 8.4; tags 2 and 2.3.45 point to the fixed PHP versions\nExtensions: Image-specific extension inventory unresolved\nLimitations: Mutable tags and image publication do not prove a running deployment is patched. Rebuild derived images with --pull and redeploy; verify the actual PHP version. Bref 1 is unmaintained and its layers will not be rebuilt. No image was pulled, built, executed or tested.\nPatch owner: Bref for Docker image rebuilds; customer updates image references and redeploys\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Official security release notice published 2026-10-21: Bref v2 Docker tags 2 and 2.3.45; image digests not independently measured\nSource accessed: 2026-10-21\nAliases: bref:v2-php-docker-images\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Fixed Bref v2 Docker images are published, superseding the earlier issue's pending-rebuild status.\nCVE-2026-109618: Fixed in the published v2 Docker images identified by tags 2 and 2.3.45\nCVE-2026-109619: Fixed in the published v2 Docker images identified by tags 2 and 2.3.45\nCVE assessment limit: Published replacement images only; cached images and running deployments require rebuild/redeployment and verification.","owner":"Bref for Docker image rebuilds; customer updates image references and redeploys","links":["https://bref.sh/docs/runtimes","https://github.com/brefphp/bref/issues/2222","https://bref.sh/news/06-php-security-release-october-2026"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched","action":"","detail":"Reconciled with the official Bref security release notice published 2026-10-21: https://bref.sh/news/06-php-security-release-october-2026\nAction statement: Rebuild derived Docker images with --pull, push and redeploy; verify PHP 8.2.35, 8.3.36 or 8.4.27 in the selected image."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched","action":"","detail":"Reconciled with the official Bref security release notice published 2026-10-21: https://bref.sh/news/06-php-security-release-october-2026\nAction statement: Rebuild derived Docker images with --pull, push and redeploy; verify PHP 8.2.35, 8.3.36 or 8.4.27 in the selected image."}}},{"id":"PHP-0412","name":"Bref PHP serverless application adapter","vendor":"Bref project","category":"Frameworks and packages","version":"bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0412\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0642\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP adapter package and serverless configuration plugin\nPHP version scope: bref/bref 3.0.14 and 2.4.22 select the patched Lambda layers; PHP>=8.2 and ext-curl remain adapter requirements\nExtensions: Required root module curl; full transitive/native runtime module set unresolved\nLimitations: The vendor confirms runtime-layer updates selected by these adapter releases, not an independent adapter-code defect. Layer ARN/version, region, architecture, dependency lockfile and redeployment must be verified; no deployment was tested.\nPatch owner: Bref maintainers for package; customer for dependency lockfile, runtime mapping and deployment\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Official security release notice: bref/bref 3.0.14 and 2.4.22; exact deployed dependency and layer ARN not measured\nSource accessed: 2026-10-21\nAliases: bref/bref\nConditional downstream consequence: A matching runtime/parser flaw reached by this adapter’s event, HTTP or task inputs could affect its PHP process and accessible workload data or credentials. The deployed runtime, loaded modules, invocation path and permissions must match; a PHP package does not prove the implementation of the remote AWS or hosting control plane.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://bref.sh/news/06-php-security-release-october-2026\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Bref maintainers for package; customer for dependency lockfile, runtime mapping and deployment","links":["https://packagist.org/packages/bref/bref","https://github.com/brefphp/bref/blob/master/composer.json","https://bref.sh/news/06-php-security-release-october-2026"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://bref.sh/news/06-php-security-release-october-2026\nAction statement: Update bref/bref and redeploy with the patched layers; rebuild and redeploy container-based functions using refreshed base images."},"CVE-2026-109619":{"status":"Fix","notes":"Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://bref.sh/news/06-php-security-release-october-2026\nAction statement: Update bref/bref and redeploy with the patched layers; rebuild and redeploy container-based functions using refreshed base images."}}},{"id":"PHP-0413","name":"AWS Lambda customer PHP custom-runtime option","vendor":"Amazon Web Services; third-party/customer PHP runtime publisher","category":"Hosting and cloud","version":"Not specified","summary":"Bref explains that its PHP runtime names resolve to provided.al2023 plus a PHP layer, rather than native AWS PHP support.","scope":"Inventory record: PHP-0413\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0642\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: provided.al2023 custom runtime with third-party PHP Lambda layer or PHP container image\nPHP version scope: Bref guide demonstrates PHP8.2–8.5 custom runtime layers/images; not AWS-native PHP runtime families\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: One documented custom PHP path does not make all Lambda functions, AWS control planes or other AWS services PHP-dependent. AWS OS updates alone do not establish PHP layer refresh. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: AWS for generic platform/runtime API; Bref or customer for PHP binaries/layers; function owner updates references or images and redeploys\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: aws-lambda:php-custom-runtime\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"AWS for generic platform/runtime API; Bref or customer for PHP binaries/layers; function owner updates references or images and redeploys","links":["https://bref.sh/docs/runtimes","https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0414","name":"Netlify PHP build environment and Composer integration","vendor":"Netlify","category":"Development and build","version":"Not specified","summary":"Netlify documents PHP_VERSION for building a site and Composer handling when composer.json is present.","scope":"Inventory record: PHP-0414\nCategory: Development and build\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Build-image PHP_VERSION selection and Composer dependency preparation; exact CLI binary build unknown\nPHP version scope: Selected PHP_VERSION and build image determine version; current exact patch not established\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: This proves a PHP build toolchain, not request-time PHP in Netlify Functions, CDN delivery or provider backend. Build-image availability and actual configured PHP remain separate. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Netlify for managed build images; project owner for selected PHP/build image, dependencies and rebuild\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: netlify:php-build-toolchain\nConditional downstream consequence: A matching PHP or loaded-parser flaw reached through project, dependency or build input could affect the build job’s availability, files, output integrity or accessible CI credentials. Build-time PHP does not establish a public request-time PHP service or an escape from the build sandbox.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Netlify for managed build images; project owner for selected PHP/build image, dependencies and rebuild","links":["https://docs.netlify.com/build/configure-builds/manage-dependencies/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0415","name":"Cloudflare Pages v1 legacy PHP build image","vendor":"Cloudflare","category":"Development and build","version":"Not specified","summary":"The build-image page retains a legacy PHP row and separately dates v1 migration to v3 before this retrieval.","scope":"Inventory record: PHP-0415\nCategory: Development and build\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Legacy v1 build-image PHP_VERSION tool selection\nPHP version scope: v1 table: default5.6; choices5.6,7.2,7.4. Official migration policy moved v1 to v3 on2026-09-15\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Page updated2026-10-16 still mentions PHP broadly, but v2/v3 tables show no PHP row. Current preinstalled PHP and request-time Pages/Workers PHP are not established; provider migration completion was not independently measured. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Cloudflare for historical build-image lifecycle; project owner for migration/custom build toolchain and dependency rebuilds\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Historical Pages v1 scope; published migration date2026-09-15; doc updated2026-10-16\nSource accessed: 2026-10-17\nAliases: cloudflare-pages:v1-php-build\nConditional downstream consequence: A matching PHP or loaded-parser flaw reached through project, dependency or build input could affect the build job’s availability, files, output integrity or accessible CI credentials. Build-time PHP does not establish a public request-time PHP service or an escape from the build sandbox.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Cloudflare for historical build-image lifecycle; project owner for migration/custom build toolchain and dependency rebuilds","links":["https://developers.cloudflare.com/pages/configuration/build-image/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0416","name":"TransIP shared webhosting PHP option","vendor":"TransIP","category":"Hosting and cloud","version":"Not specified","summary":"TransIP states its webhosting packages include PHP and documents changing the package’s selected version.","scope":"Inventory record: PHP-0416\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Provider-managed server-side PHP selection for webhosting package\nPHP version scope: Official guide lists8.0,8.1,8.2,8.3,8.4,8.5; exact patches/backport policy unresolved\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: A Dutch hosting-service role is evidenced, not any critical-sector customer deployment, installation total or PHP implementation of the TransIP portal. Legacy availability is not upstream support. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: TransIP for hosted runtime distribution; site owner for version selection and application compatibility\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: transip:shared-webhosting-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"TransIP for hosted runtime distribution; site owner for version selection and application compatibility","links":["https://www.transip.nl/knowledgebase/5987-wil-php-versie-mijn-website-wijzigen"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0417","name":"Antagonist DirectAdmin PHP hosting selector","vendor":"Antagonist","category":"Hosting and cloud","version":"Not specified","summary":"Antagonist documents a PHP selector covering all sites in one hosting package, per-version modules and extended support.","scope":"Inventory record: PHP-0417\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0386\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Package-wide PHP version and version-specific extension selection in DirectAdmin\nPHP version scope: Exact PHP menu values/builds not established; optional PHP Extended Support described for older versions\nExtensions: Version-specific selectable modules; imagick given as optional example, not universally enabled\nLimitations: Provider extended-support policy does not identify every backport/covered build. Public hosting-package counts are not PHP installations and were not imported. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Antagonist and its runtime/backport suppliers for hosted PHP; customer for selected version/modules and website compatibility\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: antagonist:php-selector\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Antagonist and its runtime/backport suppliers for hosted PHP; customer for selected version/modules and website compatibility","links":["https://help.antagonist.nl/hc/nl/articles/8523972848401-Wat-kan-ik-met-de-PHP-selector-in-DirectAdmin"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0418","name":"IONOS webhosting PHP and CLI options","vendor":"IONOS","category":"Hosting and cloud","version":"Not specified","summary":"IONOS documents per-domain PHP versions and a separate CLI version/path table.","scope":"Inventory record: PHP-0418\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Per-domain PHP hosting selection; separate versioned PHP CLI binaries in webspace\nPHP version scope: CLI table includes8.5–8.0,7.4–7.0,5.6 and older legacy entries; CLI paths differ for contracts before/from2026-07-21\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: CLI availability is not necessarily the web handler catalogue. The guide’s statement that only pre8.1 versions are upstream-unmaintained is not accepted as current lifecycle truth. Managed WordPress/MyWebsite have separate applicability notes. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: IONOS for hosting/extended-support runtimes; customer for domain/CLI version choice and application compatibility\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: ionos:webhosting-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"IONOS for hosting/extended-support runtimes; customer for domain/CLI version choice and application compatibility","links":["https://www.ionos.com/help/hosting/managing-php-versions-in-the-control-panel/displaying-or-changing-php-versions/","https://www.ionos.com/help/hosting/using-php-for-web-projects/executing-php-files-via-the-command-line-php-cli/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0419","name":"OVHcloud webhosting PHP / .ovhconfig runtime","vendor":"OVHcloud","category":"Hosting and cloud","version":"Not specified","summary":"OVHcloud documents PHP hosting families, environment/architecture boundaries and provider versus website-owner responsibilities.","scope":"Inventory record: PHP-0419\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Provider PHP-FPM or phpcgi options and .ovhconfig version/environment settings\nPHP version scope: Guide lists PHP5.4–8.5 with runtime compatibility;7.4–8.5 require Stable64. Exact patches/backports unknown\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: The sample8.0 default is not a current universal runtime default. PHP-FPM is a SAPI/process manager, not evidence of the guide’s marketing performance claims. No control-plane or customer-sector PHP inference. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: OVHcloud installs managed runtimes; website owner maintains compatible application/code and selected configuration\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: ovhcloud:webhosting-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OVHcloud installs managed runtimes; website owner maintains compatible application/code and selected configuration","links":["https://docs.ovhcloud.com/en/guides/web-cloud/web-hosting/configure-your-web-hosting"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0420","name":"Render customer PHP Docker hosting","vendor":"Render; customer/base-image publisher","category":"Hosting and cloud","version":"Not specified","summary":"Render’s PHP deployment guide uses Docker and nginx/php-fpm for a Laravel application.","scope":"Inventory record: PHP-0420\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Customer Docker runtime; official Laravel11 example uses nginx/php-fpm\nPHP version scope: No native PHP runtime per Docker guide; customer Dockerfile/base image sets PHP branch and patch\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: A rebuilt container does not guarantee a fresh base image when tags are cached. PHP is scoped to selected workload images, not Render’s native runtime catalogue or backend implementation. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Customer/base-image publisher for PHP image refresh; customer for rebuild/deployment; Render for platform infrastructure\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: render:php-docker-hosting\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Customer/base-image publisher for PHP image refresh; customer for rebuild/deployment; Render for platform infrastructure","links":["https://render.com/docs/deploy-php-laravel-docker","https://render.com/docs/docker"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0421","name":"Fly.io customer Laravel/PHP Machines deployment","vendor":"Fly.io; customer runtime-image publisher","category":"Hosting and cloud","version":"Not specified","summary":"Fly.io documents Laravel detection, generated nginx/php-fpm container configuration and PHP CLI job/release processes.","scope":"Inventory record: PHP-0421\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0017\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Generated customer Dockerfile with nginx/php-fpm; PHP Artisan release/queue/scheduler processes\nPHP version scope: Customer image chooses PHP branch/patch; no universal Fly.io PHP build established\nExtensions: Required/available/loaded module inventory unknown; resolve the selected version and configuration\nLimitations: Only configured customer workload images are PHP. Database/private-network neighbours and provider control plane are not inferred PHP; optional Octane modes require their own installed servers. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied.\nPatch owner: Customer/runtime-image supplier for PHP and dependency refresh; customer rebuilds/deploys; Fly.io maintains Machines infrastructure\nDownstream surface: Only customer workloads configured to use this PHP option\nRelease pin: Moving official documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: fly.io:laravel-php-workloads\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Customer/runtime-image supplier for PHP and dependency refresh; customer rebuilds/deploys; Fly.io maintains Machines infrastructure","links":["https://fly.io/laravel/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0422","name":"TuxCare ELS PHP distribution family","vendor":"TuxCare / CloudLinux","category":"Containers and distribution","version":"Not specified","summary":"CloudLinux scopes TuxCare PHP ELS as affected by both CVEs and reports several fixed ELS packages, while the broader family remains only partially remediated.","scope":"Inventory record: PHP-0422\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected family\nDeployment status: Not measured\nPHP surface: Vendor PHP ELS packages for supported Linux and Windows platforms\nPHP version scope: TuxCare documentation lists supported PHP families across EL, Ubuntu, Debian, Alpine Linux and Windows; the CloudLinux status incident separately reports fixed ELS package releases for selected CentOS and Ubuntu scopes.\nExtensions: Built-in and loadable sets differ by PHP version, platform and package; enablement must be verified\nLimitations: The status page reports only selected fixed ELS package releases and does not establish complete remediation for every supported PHP/OS combination. Optional ELS installation does not put PHP on all hosts. No package/image was installed, pulled, built, executed or tested. No deployment, loaded-module set, reachability or exploitation was measured.\nPatch owner: TuxCare for licensed PHP backport builds; system administrator for selected package/runtime update and service rollout\nDownstream surface: Only the named PHP component and its callers\nRelease pin: CloudLinux status incident updated 2026-10-21; scoped fixed ELS rows pinned separately; broader family not fully pinned\nSource accessed: 2026-10-21\nAliases: tuxcare:els-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Affected: CloudLinux identifies TuxCare PHP ELS as affected; scoped fixed ELS package rows are recorded separately.\nCVE-2026-109618: Affected for the broader TuxCare PHP ELS family; scoped fixed rows recorded separately\nCVE-2026-109619: Affected for the broader TuxCare PHP ELS family; scoped fixed rows recorded separately\nCVE assessment limit: Vendor notice confirms affected TuxCare PHP ELS family scope and partial fixed-package releases, not complete family remediation or deployment status.","owner":"TuxCare for licensed PHP backport builds; system administrator for selected package/runtime update and service rollout","links":["https://docs.tuxcare.com/els-for-runtimes/php/","https://cloudlinux.zendesk.com/hc/en-us/articles/31194180517916-PHP-CVE-2026-109618-CVE-2026-109619-reported-pre-disclosure-RCEs-updated-package-availability","https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately","action":"Apply updated CloudLinux or TuxCare PHP packages when available.","detail":"Added from the CloudLinux knowledge base article and incident status page updated 2026-10-21."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately","action":"Apply updated CloudLinux or TuxCare PHP packages when available.","detail":"Added from the CloudLinux knowledge base article and incident status page updated 2026-10-21."}}},{"id":"PHP-0423","name":"Synology PHP 8.4 package distribution","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"Fresh archive metadata confirms the existing8.4 package identity. It is one of ten PHP branch families, not PHP installed by default throughout DSM.","scope":"Inventory record: PHP-0423\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Architecture-specific PHP SPK runtime packages; exact SAPI unverified\nPHP version scope: Archive family8.4 lists8.4.19-0050 and8.4.14-0003. Selected8.4.19-0050 lists five SPKs, with archive modification timestamps24 March2026. These are catalogue timestamps, not release/support dates.\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Package availability and filenames do not establish model/DSM support, exact payload, signatures, enabled extensions or active services. Release-note reads returned footer-only bodies, so search-snippet minimum DSM claims were not adopted. No package was downloaded, extracted or executed.\nPatch owner: Synology package maintainer; NAS administrator for installation and rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Archive build8.4.19-0050; SPK filenames/timestamps read, no bytes/digest verification\nSource accessed: 2026-10-19\nAliases: synology:php8.4-package\nConditional downstream consequence: A matching PHP or enabled-module flaw could propagate to applications selecting this distributed runtime. Actual impact depends on the installed build, reachable code and service identity; package availability alone establishes no exposed installation or successful exploitation.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology package maintainer; NAS administrator for installation and rollout","links":["https://archive.synology.com/download/Package/PHP8.4/8.4.19-0050","https://archive.synology.com/download/Package/PHP8.4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0424","name":"Synology Web Station optional PHP hosting","vendor":"Synology","category":"Appliances and embedded","version":"Not specified","summary":"Web Station supports separately installed PHP backends and PHP profiles for hosted sites.","scope":"Inventory record: PHP-0424\nCategory: Appliances and embedded\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0423\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Optional Package Center PHP backend with nginx or Apache web hosting\nPHP version scope: DSM7.4 Web Station specification; PHP backend version selected separately\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Optional hosting capability does not prove PHP in the Web Station implementation or all DSM services. The specification supplies no patch-level backend catalogue. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Synology for runtime packages; NAS/site administrator for backend selection and updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: synology:web-station-php-option\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for runtime packages; NAS/site administrator for backend selection and updates","links":["https://www.synology.com/en-global/dsm/7.4/software_spec/web_station"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0425","name":"QNAP QTS built-in PHP runtime","vendor":"QNAP","category":"Appliances and embedded","version":"QTS 6.1.0; QTS 5.2.11 and earlier","summary":"QNAP QSA-26-18 lists QTS 6.1.0 and QTS 5.2.11 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed versions are to be announced.","scope":"Inventory record: PHP-0425\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: Firmware-bundled PHP; QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications.\nPHP version scope: QSA-26-18 lists QTS 6.1.0 and QTS 5.2.11 and earlier as affected; fixed versions are to be announced. Earlier QNAP FAQ mapping retained: QTS 4.2.6-4.3.6 -> PHP 5.6; 4.4.x -> 7.3; 5.0.1 -> 7.4; 5.1 -> 8.2.\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: QSA-26-18 establishes affected QTS release scope, not a live deployment, exact embedded PHP patch build, enabled feature set, reachable path or exploitation. The optional PHP7.4 app remains separately scoped as PHP-0610. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP through firmware releases; NAS administrator for exposure reduction and update rollout\nDownstream surface: QNAP web components in the named QTS releases\nRelease pin: QSA-26-18 published 2026-10-22; earlier built-in mapping FAQ 2024-03-05 retained in source references\nSource accessed: 2026-10-22\nAliases: qnap:qts-built-in-php\nVulnerability status: QNAP QSA-26-18 lists the QTS release scope as affected; fixed versions are to be announced.\nCVE-2026-109618: Vendor-confirmed affected QTS scope; fixed versions to be announced\nCVE-2026-109619: Vendor-confirmed affected QTS scope; fixed versions to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP through firmware releases; NAS administrator for exposure reduction and update rollout","links":["https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520","https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero","https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0426","name":"QNAP QuTS hero built-in PHP runtime","vendor":"QNAP","category":"Appliances and embedded","version":"QuTS hero h6.1.0; QuTS hero h6.0.x; QuTS hero h5.2.11 and earlier","summary":"QNAP QSA-26-18 lists QuTS hero h6.1.0, QuTS hero h6.0.x and QuTS hero h5.2.11 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed versions are to be announced.","scope":"Inventory record: PHP-0426\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: Firmware-bundled PHP; QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications.\nPHP version scope: QSA-26-18 lists QuTS hero h6.1.0, QuTS hero h6.0.x and QuTS hero h5.2.11 and earlier as affected; fixed versions are to be announced. Earlier QNAP FAQ mapping retained: QuTS hero h4.5.4 -> PHP 7.3; h5.0.1 -> 7.4; h5.1 -> 8.2.\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: QSA-26-18 establishes affected QuTS hero release scope, not a live deployment, exact embedded PHP patch build, enabled feature set, reachable path or exploitation. The optional PHP7.4 app remains separately scoped as PHP-0610. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP through firmware releases; NAS administrator for exposure reduction and update rollout\nDownstream surface: QNAP web components in the named QuTS hero releases\nRelease pin: QSA-26-18 published 2026-10-22; earlier built-in mapping FAQ 2024-03-05 retained in source references\nSource accessed: 2026-10-22\nAliases: qnap:quts-hero-built-in-php\nVulnerability status: QNAP QSA-26-18 lists the QuTS hero release scope as affected; fixed versions are to be announced.\nCVE-2026-109618: Vendor-confirmed affected QuTS hero scope; fixed versions to be announced\nCVE-2026-109619: Vendor-confirmed affected QuTS hero scope; fixed versions to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP through firmware releases; NAS administrator for exposure reduction and update rollout","links":["https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520","https://www.qnap.com/en/how-to/faq/article/can-i-update-the-built-in-php-version-on-qts-and-quts-hero","https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0427","name":"openmediavault PHP management backend","vendor":"openmediavault project","category":"Appliances and embedded","version":"Not specified","summary":"The official web GUI deployment state configures a dedicated PHP-FPM pool running as openmediavault-webgui.","scope":"Inventory record: PHP-0427\nCategory: Appliances and embedded\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP8.4-FPM web GUI pool on a local Unix socket\nPHP version scope: Inspected master Salt configuration selects php8.4-fpm; released build/patch unknown\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Moving master is not an installed/released firmware pin. A PHP management pool does not establish PHP in SMB/NFS data handling or root privileges for every worker. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: openmediavault for web GUI/pool configuration; OS PHP packager and administrator for runtime updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: openmediavault:php-webgui-backend\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"openmediavault for web GUI/pool configuration; OS PHP packager and administrator for runtime updates","links":["https://github.com/openmediavault/openmediavault/blob/master/deb/openmediavault/srv/salt/omv/deploy/phpfpm/10webgui.sls"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0428","name":"Unraid PHP management runtime distribution","vendor":"Lime Technology / Unraid","category":"Appliances and embedded","version":"Not specified","summary":"Unraid release notes identify its PHP package and PHP web GUI files.","scope":"Inventory record: PHP-0428\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled PHP runtime used by the web management UI; exact SAPI unverified\nPHP version scope: 7.3.2 release lists php8.4.23-1;7.4.0-rc.1 lists PHP8.4.26\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: 7.4.0-rc.1 is a prerelease, not stable7.4. Disk/VM data planes and arbitrary containers do not inherit PHP implementation. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Unraid OS maintainer for bundled packages; operator for release rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Unraid7.3.2 release notes; separate7.4.0-rc.1 scope\nSource accessed: 2026-10-17\nAliases: unraid:php-management-runtime\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Unraid OS maintainer for bundled packages; operator for release rollout","links":["https://docs.unraid.net/unraid-os/release-notes/7.3.2/","https://docs.unraid.net/unraid-os/release-notes/7.4.0/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0429","name":"Unraid libvirt-php management binding","vendor":"libvirt-php contributors / Unraid distribution","category":"PHP external extensions","version":"Not specified","summary":"Unraid independently lists libvirt-php alongside its matching PHP package.","scope":"Inventory record: PHP-0429\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0428\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Named libvirt-php PHP binding package; loaded module/ABI/call graph unverified\nPHP version scope: Unraid7.3.2 lists libvirt-php0.5.8-8.4.23;7.4.0-rc.1 lists0.5.8-8.4.26_LT\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: A PHP binding does not make the native libvirt library dependent on PHP. Exact binding calls, module enablement and native ABI remain unverified. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Binding maintainer and Unraid package builder; operator for OS update rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Unraid7.3.2 and7.4.0-rc.1 package declarations; no binary hash\nSource accessed: 2026-10-17\nAliases: unraid:libvirt-php\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Binding maintainer and Unraid package builder; operator for OS update rollout","links":["https://docs.unraid.net/unraid-os/release-notes/7.3.2/","https://docs.unraid.net/unraid-os/release-notes/7.4.0/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0430","name":"XigmaNAS bundled PHP components","vendor":"XigmaNAS project","category":"Appliances and embedded","version":"Not specified","summary":"XigmaNAS lists PHP and PHP-based administration tools among software used.","scope":"Inventory record: PHP-0430\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled server-side PHP components with a lighttpd web environment\nPHP version scope: Official features/software-used page modified2024-07-16; current firmware PHP patch unknown\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: An older feature list is not a current image manifest. FreeNAS/m0n0wall ancestry does not establish PHP in all later forks or TrueNAS editions. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: XigmaNAS firmware/package maintainers; appliance operator for release updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: xigmanas:php-components\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"XigmaNAS firmware/package maintainers; appliance operator for release updates","links":["https://www.xigmanas.com/wiki/doku.php?id=features"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0431","name":"phpVirtualBox server-side administration application","vendor":"phpVirtualBox project","category":"Monitoring and administration","version":"Not specified","summary":"The project describes a PHP web administration interface for VirtualBox.","scope":"Inventory record: PHP-0431\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP application; browser HTML/JavaScript is a separate client\nPHP version scope: README declares PHP8.X and VirtualBox7.2.x; PHP8.4 compatibility remains a roadmap item\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: PHP8.X is not verified compatibility with every minor. Required native extensions were not established; Oracle VirtualBox core is not inferred to use PHP. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: phpVirtualBox maintainer for app; runtime packager/operator for server PHP\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: phpvirtualbox:server\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"phpVirtualBox maintainer for app; runtime packager/operator for server PHP","links":["https://github.com/phpvirtualbox/phpvirtualbox"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0432","name":"FreePBX 17 management framework","vendor":"Sangoma / FreePBX project","category":"Appliances and embedded","version":"Not specified","summary":"FreePBX17 documents PHP8.2 as its supported tested platform, distinct from its installer minimum guard.","scope":"Inventory record: PHP-0432\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP administration and installer/CLI; exact web SAPI not pinned\nPHP version scope: Official17FAQ: PHP8.2.x tested/default; inspected release/17.0 installer only rejects PHP<7.4\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: A permissive installer guard does not override supported-platform or commercial-module constraints. Asterisk SIP/media processing is a separate implementation. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: FreePBX/Sangoma for framework/modules and supported distribution; operator for runtime and module updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: FreePBX17 vendor FAQ plus moving release/17.0 installer; no immutable build pin\nSource accessed: 2026-10-17\nAliases: freepbx:17-management-framework\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"FreePBX/Sangoma for framework/modules and supported distribution; operator for runtime and module updates","links":["https://sangomakb.atlassian.net/wiki/spaces/FP/pages/279052296","https://github.com/FreePBX/framework/blob/release/17.0/install.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0433","name":"PBXact 17 PHP management edition","vendor":"Sangoma","category":"Appliances and embedded","version":"Not specified","summary":"Sangoma describes PBXact17 as its commercial FreePBX-based system with PHP8.2.","scope":"Inventory record: PHP-0433\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0432\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Commercial PHP-based FreePBX management application; web SAPI unknown\nPHP version scope: PBXact17 GA announcement specifies PHP8.2 and Debian12\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Edition and base framework overlap. Appliance model/module compatibility and deployed PHP patches require separate qualification. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Sangoma for supported edition/firmware/modules; administrator for applicable update rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: PBXact17 GA announcement; exact appliance build not pinned\nSource accessed: 2026-10-17\nAliases: sangoma:pbxact17\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Sangoma for supported edition/firmware/modules; administrator for applicable update rollout","links":["https://www.freepbx.org/pbxact-17-general-availability-announcement/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0434","name":"FusionPBX PHP management application","vendor":"FusionPBX project","category":"Appliances and embedded","version":"Not specified","summary":"FusionPBX publishes a PHP CLI/FPM installation recipe with version-specific package choices.","scope":"Inventory record: PHP-0434\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Nginx with PHP-FPM and PHP CLI in the Debian installation recipe\nPHP version scope: Inspected moving recipe has PHP8.2/8.3/8.4 branches; exact selected patch and OS build unknown\nExtensions: Selected recipe branches install database, XML, image, LDAP, SNMP and other modules; this is not an all-platform required-extension list\nLimitations: Older recipe branches are not current support promises. FreeSWITCH media/signalling and browser clients are not thereby PHP. Architecture-specific loaders need independent validation. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: FusionPBX for application/recipe; OS PHP repository and operator for runtime selection and rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: fusionpbx:php-management\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"FusionPBX for application/recipe; OS PHP repository and operator for runtime selection and rollout","links":["https://github.com/fusionpbx/fusionpbx-install.sh/blob/master/debian/resources/php.sh"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0435","name":"Issabel 5 PHP communications management","vendor":"Issabel","category":"Appliances and embedded","version":"Not specified","summary":"Issabel identifies PHP7.4 as a component of its version5 release.","scope":"Inventory record: PHP-0435\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP administration components in the Issabel distribution; exact SAPI unknown\nPHP version scope: Issabel5 release announcement specifies PHP7.4 with Rocky Linux8.8\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Release evidence is not a current ISO patch pin, vendor-backport verdict or PHP implementation of Asterisk. Do not assume an unpatched installation from a minor-version label. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Issabel distribution maintainer and OS PHP packager; operator for product-specific updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Issabel5 vendor release announcement; exact image revision unverified\nSource accessed: 2026-10-17\nAliases: issabel:5-management\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Issabel distribution maintainer and OS PHP packager; operator for product-specific updates","links":["https://www.issabel.com/en/release-of-issabel-5-innovation-and-advancement-in-unified-communications/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0436","name":"VitalPBX 4.0 PHP management runtime","vendor":"VitalPBX","category":"Appliances and embedded","version":"Not specified","summary":"The vendor’s4.0.0R4 announcement explicitly records a PHP8.1 upgrade.","scope":"Inventory record: PHP-0436\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Version-scoped bundled PHP for communications management; SAPI unknown\nPHP version scope: Official4.0.0R4 announcement,2022-10-10: PHP8.1 upgrade\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: This confirms the named release, not the current4.5 core PHP version. A VitXi release requirement must not be inherited by the whole VitalPBX product. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: VitalPBX distribution maintainer; administrator for applicable release and runtime rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Vendor4.0.0R4 announcement dated2022-10-10; current branch unresolved\nSource accessed: 2026-10-17\nAliases: vitalpbx:4.0-php-management\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"VitalPBX distribution maintainer; administrator for applicable release and runtime rollout","links":["https://forums.vitalpbx.org/t/vitalpbx-4-0-0-r4-is-now-available/1863/1"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0437","name":"VitXi server-side PHP component","vendor":"VitalPBX","category":"Appliances and embedded","version":"Not specified","summary":"The VitXi changelog separately documents PHP8.2 support and later Swoole integration.","scope":"Inventory record: PHP-0437\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0436\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP with nginx; release-specific Swoole integration, not browser/mobile PHP\nPHP version scope: VitXi4.5.0-1 (2024-10-22) adds PHP8.2 support;4.6.0-0 (2025-11-18) integrates Swoole\nExtensions: Swoole integration is release-scoped; complete required/optional native module inventory unknown\nLimitations: This is a server dependency, not PHP embedded in WebRTC browsers or mobile clients. Exact patch, worker mode and broader VitalPBX core requirements remain unknown. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: VitalPBX/VitXi maintainer for app and supported stack; operator for runtime/module updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Version-labelled vendor changelog entries4.5.0-1 and4.6.0-0\nSource accessed: 2026-10-17\nAliases: vitalpbx:vitxi-server-php\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"VitalPBX/VitXi maintainer for app and supported stack; operator for runtime/module updates","links":["https://vitalpbx.com/cbxchangelog/vitxi-v4-5-vitalpbx-4-5/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0438","name":"ASTPP v7 PHP billing and management application","vendor":"iNextrix / ASTPP","category":"Appliances and embedded","version":"Not specified","summary":"ASTPP’s vendor explicitly identifies PHP8.2 in version7.","scope":"Inventory record: PHP-0438\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP billing/administration application; exact SAPI unknown\nPHP version scope: Vendor v7 webinar FAQ states PHP8.2 update; patch and edition-specific builds unknown\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Deployment options and billing features do not prove PHP inside FreeSWITCH media/signalling, every hosted service or all proprietary edition components. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: ASTPP/iNextrix for application/edition packages; runtime provider/operator for applicable updates\nDownstream surface: Billing, routing configuration and application-accessible account/tenant data\nRelease pin: Version7 vendor FAQ; immutable source/package pin unavailable\nSource accessed: 2026-10-17\nAliases: astpp:v7-php-management\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"ASTPP/iNextrix for application/edition packages; runtime provider/operator for applicable updates","links":["https://astppbilling.org/your-top-questions-from-the-astpp-v7-webinar-answered"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0439","name":"MISP 2.5 core PHP server","vendor":"MISP project / CIRCL","category":"Monitoring and administration","version":"Not specified","summary":"Official requirements distinguish mandatory PHP extensions from recommended modules for MISP2.5.","scope":"Inventory record: PHP-0439\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web/API server and background/CLI tasks; web SAPI deployment-specific\nPHP version scope: MISP2.5 requirements: PHP>=8.1,<9; installers select8.3\nExtensions: Required: json,mbstring,xml,dom,simplexml,pcre,curl. Recommended modules are not mandatory or measured as loaded.\nLimitations: Moving requirements do not pin all deployments. PyMISP and Python enrichment workers are separate clients/components, not evidence that their own code is PHP. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: MISP maintainers for app; OS/runtime maintainer and service operator for PHP/modules\nDownstream surface: Threat-intelligence records, sharing permissions, API credentials and feed integrity\nRelease pin: Version2.5-scoped moving requirements; immutable app manifest fetch unavailable\nSource accessed: 2026-10-17\nAliases: misp:2.5-php-server\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"MISP maintainers for app; OS/runtime maintainer and service operator for PHP/modules","links":["https://www.circl.lu/doc/misp/requirements/","https://github.com/MISP/MISP"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0440","name":"SimpleRisk PHP GRC application","vendor":"SimpleRisk","category":"Business applications","version":"Not specified","summary":"SimpleRisk publishes PHP version and extension requirements plus supported Apache/nginx execution modes.","scope":"Inventory record: PHP-0440\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache/mod_php or nginx/PHP-FPM web application\nPHP version scope: Current requirements use PHP^8.3 / platform8.3.0; PHP9 compatibility not implied\nExtensions: Twelve required modules including LDAP even when LDAP authentication is unused\nLimitations: Moving requirements are not verified installed binaries. Public self-hosted requirements do not establish an unseen SaaS backend build or every downloadable VM image. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: SimpleRisk for app; PHP/OS packager and service administrator for runtime updates\nDownstream surface: GRC records, uploaded evidence and application-accessible credentials\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: simplerisk:php-grc-server\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SimpleRisk for app; PHP/OS packager and service administrator for runtime updates","links":["https://support.simplerisk.com/kb/01-01-system-requirements"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0441","name":"daloRADIUS PHP web management application","vendor":"daloRADIUS project","category":"Monitoring and administration","version":"Not specified","summary":"daloRADIUS describes its PHP web application and current PDO database integration.","scope":"Inventory record: PHP-0441\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP RADIUS/billing administration using native PDO database access\nPHP version scope: Inspected master README; exact released PHP floor/patch unknown\nExtensions: PDO with MySQL driver stated; PEAR DB no longer required; Mail/Mime are userland dependencies\nLimitations: Older multi-database wording is not validation of every database engine. FreeRADIUS daemon and authentication protocol handling are separate from the PHP web app. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: daloRADIUS project for app; runtime packager/operator for PHP and database-driver updates\nDownstream surface: RADIUS account/billing records, management settings and accessible database credentials\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: daloradius:web-application\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"daloRADIUS project for app; runtime packager/operator for PHP and database-driver updates","links":["https://github.com/lirantal/daloradius/blob/master/README.md"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0442","name":"daloRADIUS official Docker distribution recipe","vendor":"daloRADIUS project","category":"Containers and distribution","version":"Not specified","summary":"The official Dockerfile declares an Apache PHP package stack separately from the application.","scope":"Inventory record: PHP-0442\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0441\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Debian13 Apache/mod_php plus PHP CLI packages in the official Dockerfile\nPHP version scope: Moving Dockerfile labels Debian13/PHP8.4; resolved package patches and image digest unknown\nExtensions: Recipe installs gd,curl,ldap,mbstring and mysql support; not a universal required-module list\nLimitations: A moving build recipe is not a pulled/pinned image. PHP mail packages in the recipe are not automatically native extensions; derived image and application rows overlap. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: daloRADIUS image maintainer and Debian PHP packager; deployer for rebuild, cached base and rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: daloradius:official-docker-recipe\nConditional downstream consequence: A matching PHP or enabled-module flaw could propagate to applications selecting this distributed runtime. Actual impact depends on the installed build, reachable code and service identity; package availability alone establishes no exposed installation or successful exploitation.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"daloRADIUS image maintainer and Debian PHP packager; deployer for rebuild, cached base and rollout","links":["https://github.com/lirantal/daloradius/blob/master/Dockerfile"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0443","name":"RaspAP PHP network-management web GUI","vendor":"RaspAP project","category":"Appliances and embedded","version":"Not specified","summary":"RaspAP’s manual installation configures a PHP-CGI web management interface.","scope":"Inventory record: PHP-0443\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: lighttpd FastCGI with PHP-CGI; configured restricted service-management sudo commands\nPHP version scope: Manual recipe uses php8.2-cgi; documented Bullseye alternative7.4; current patch unpinned\nExtensions: OPcache described as an optional optimization; complete required module list unknown\nLimitations: Recipe scope varies by OS. Selected sudo permissions are not unrestricted root access; hostapd/dnsmasq networking is not inferred to execute PHP. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: RaspAP for application/configuration; OS PHP packager and administrator for runtime updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: raspap:php-webgui\nConditional downstream consequence: If a matching PHP or enabled-extension flaw is reachable in this management interface, possible effects include worker denial of service, disclosure of accessible credentials, configuration modification or code execution as the service account. Root access, packet/media-plane compromise, tenant escape and lateral movement require separate privilege, reachability and isolation evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"RaspAP for application/configuration; OS PHP packager and administrator for runtime updates","links":["https://docs.raspap.com/get-started/manual/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0444","name":"ZoneMinder PHP web and API components","vendor":"ZoneMinder project","category":"Monitoring and administration","version":"Not specified","summary":"The official packaging spec separately declares PHP dependencies for web frontends.","scope":"Inventory record: PHP-0444\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web/API; RPM nginx profile uses FPM and httpd profile uses PHP packages\nPHP version scope: Inspected moving Red Hat spec; exact PHP floor/patch and other distributions unresolved\nExtensions: RPM common requirements include mysqli,gd,intl,json,process and APCu; package profile, not all-platform app requirement\nLimitations: Native capture, ffmpeg and Perl processes are independent components. The packaging dependency list is not evidence PHP parses all camera/media data. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: ZoneMinder application and distro package maintainers; operator for PHP/module rollout\nDownstream surface: Camera administration, recording metadata, API credentials and application-accessible media\nRelease pin: Moving official source/documentation; immutable runtime build pin pending\nSource accessed: 2026-10-17\nAliases: zoneminder:php-web-api\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"ZoneMinder application and distro package maintainers; operator for PHP/module rollout","links":["https://github.com/ZoneMinder/zoneminder/blob/master/distros/redhat/zoneminder.spec"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0445","name":"Adiscon LogAnalyzer PHP web application","vendor":"Adiscon / LogAnalyzer project","category":"Monitoring and administration","version":"Not specified","summary":"The project identifies LogAnalyzer as a PHP syslog web application; its Composer platform value is only a resolution target.","scope":"Inventory record: PHP-0445\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web interface for syslog file/database data; exact SAPI unknown\nPHP version scope: Master composer config.platform.php=8.1.0; require is empty, so no runtime minimum inferred\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: PHPUnit is require-dev, not production runtime proof. Neither rsyslog daemon nor Windows Agent implementation is established by this web UI. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Adiscon/project for app; OS/runtime maintainer and administrator for PHP updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Moving repository and composer.json; no immutable release pin\nSource accessed: 2026-10-17\nAliases: adiscon:loganalyzer-php-web\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Adiscon/project for app; OS/runtime maintainer and administrator for PHP updates","links":["https://github.com/rsyslog/loganalyzer","https://github.com/rsyslog/loganalyzer/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0446","name":"TurnKey Linux LAMP appliance PHP stack","vendor":"TurnKey Linux","category":"Appliances and embedded","version":"Not specified","summary":"The LAMP appliance page includes PHP, CLI tooling and an upstream Composer installation.","scope":"Inventory record: PHP-0446\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache PHP stack, PHP CLI and Composer in a named appliance profile\nPHP version scope: Product page advertises19.0-trixie; exact PHP patch/ISO contents not verified\nExtensions: Full required and enabled module inventory unknown; bundled developer tools are not all native extensions\nLimitations: Product-page inclusion is not a verified ISO manifest. This profile does not establish PHP in all TurnKey appliances; no restricted binary download was pursued. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: TurnKey appliance builder and Debian PHP maintainer; operator for OS/app updates and upstream Composer updates\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Advertised19.0-trixie appliance release; ISO hash/contents not verified\nSource accessed: 2026-10-17\nAliases: turnkeylinux:lamp-php-stack\nConditional downstream consequence: A matching PHP or enabled-module flaw could propagate to applications selecting this distributed runtime. Actual impact depends on the installed build, reachable code and service identity; package availability alone establishes no exposed installation or successful exploitation.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"TurnKey appliance builder and Debian PHP maintainer; operator for OS/app updates and upstream Composer updates","links":["https://www.turnkeylinux.org/lamp/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0447","name":"TurnKey Linux LAPP appliance PHP stack","vendor":"TurnKey Linux","category":"Appliances and embedded","version":"Not specified","summary":"The LAPP appliance page documents PHP and PostgreSQL client support with Debian-packaged Composer.","scope":"Inventory record: PHP-0447\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache PHP/PostgreSQL stack with PHP CLI and distro Composer\nPHP version scope: Product page advertises19.0-trixie; exact PHP patch/ISO payload unknown\nExtensions: PostgreSQL PHP client libraries documented; exact module package and loaded set unknown\nLimitations: LAPP and LAMP are different profiles but can overlap upstream runtimes. Older screenshots do not establish19.0 payloads or all TurnKey catalogue requirements. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: TurnKey appliance builder and Debian PHP/Composer packagers; operator for update rollout\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Advertised19.0-trixie profile; ISO contents/digest unverified\nSource accessed: 2026-10-17\nAliases: turnkeylinux:lapp-php-stack\nConditional downstream consequence: A matching PHP or enabled-module flaw could propagate to applications selecting this distributed runtime. Actual impact depends on the installed build, reachable code and service identity; package availability alone establishes no exposed installation or successful exploitation.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"TurnKey appliance builder and Debian PHP/Composer packagers; operator for update rollout","links":["https://www.turnkeylinux.org/lapp/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0448","name":"Pi-hole v5 legacy PHP web interface","vendor":"Pi-hole project","category":"Appliances and embedded","version":"Not specified","summary":"Pi-hole’s version6 announcement explicitly removes the former lighttpd/PHP dependency.","scope":"Inventory record: PHP-0448\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Legacy PHP web UI; v6 replaces the former web stack with FTL/Lua\nPHP version scope: Historical v5-era PHP interface; official2025-02-18 v6 migration removes the PHP requirement\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Do not count currentv6 as a PHP-dependent interface. An upgraded host can retain PHP/lighttpd for other applications; DNS processing is a separate component. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: Operator of a retained legacy interface and runtime; successor update path does not establish all packages removed\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Official v6 migration announcement2025-02-18\nSource accessed: 2026-10-17\nAliases: pi-hole:v5-legacy-php-web\nConditional downstream consequence: A matching flaw could affect a retained legacy PHP management deployment only if its actual runtime, input path and privileges match. Historical inclusion establishes neither present installation nor current exploitability; successor and native data-plane implementations require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Operator of a retained legacy interface and runtime; successor update path does not establish all packages removed","links":["https://pi-hole.net/blog/2025/02/18/introducing-pi-hole-v6/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0449","name":"m0n0wall legacy PHP-CGI management appliance","vendor":"m0n0wall project","category":"Appliances and embedded","version":"Not specified","summary":"The project’s facts page lists PHP-CGI; its closure announcement ends further development/releases.","scope":"Inventory record: PHP-0449\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Bundled PHP-CGI with mini_httpd for appliance management\nPHP version scope: Legacy appliance; project ended2015-02-15; PHP patch level unknown\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Historical inclusion is not a current installed fleet. Fork ancestry does not impose the same runtime on later pfSense, OPNsense, FreeNAS or other descendants. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: No further upstream project releases after closure; retained-system operator owns local update/migration decisions\nDownstream surface: Only the named management component and its documented callers\nRelease pin: Archived project facts and end announcement2015-02-15\nSource accessed: 2026-10-17\nAliases: m0n0wall:legacy-php-cgi\nConditional downstream consequence: A matching flaw could affect a retained legacy PHP management deployment only if its actual runtime, input path and privileges match. Historical inclusion establishes neither present installation nor current exploitability; successor and native data-plane implementations require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"No further upstream project releases after closure; retained-system operator owns local update/migration decisions","links":["https://m0n0.ch/wall/facts.php","https://m0n0.ch/wall/end_announcement.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0450","name":"CIRCL-operated MISP threat-sharing service","vendor":"CIRCL, Luxembourg","category":"Monitoring and administration","version":"Not specified","summary":"CIRCL publicly states it operates multiple MISP instances; MISP’s server PHP relationship is independently documented.","scope":"Inventory record: PHP-0450\nCategory: Monitoring and administration\nOriginal relationship: transitive\nRelationship direction: depends_on_php_via_named_application_family\nParent component: PHP-0439\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Provider-operated MISP web and REST API service; transitive server PHP relationship\nPHP version scope: Provider confirms MISP operation; installed MISP/PHP versions and instance count unknown\nExtensions: Required/optional extensions and enabled modules: unknown\nLimitations: Transitive application-family inference, not a2.5 release or exact-runtime measurement. No service endpoint, account, customer asset or restricted community was queried. No deployment total, loaded-module set, reachability or exploitation was measured; no specific CVE was supplied. Public documents/static source only; no retrieved code or appliance image was installed, executed, built or tested.\nPatch owner: CIRCL for operated platform/runtime rollout; MISP upstream and OS packagers for source fixes\nDownstream surface: Threat-intelligence exchange, sharing permissions and service-accessible API credentials\nRelease pin: Public service description plus MISP requirements; no installed-build pin\nSource accessed: 2026-10-17\nAliases: circl:misp-threat-sharing-service\nConditional downstream consequence: A matching PHP/parser or enabled native-extension flaw reached through this application could affect worker availability, accessible secrets, stored-data integrity or execution with the worker identity. Scope depends on the deployed build, input path and permissions; this is not a finding of a current flaw or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"CIRCL for operated platform/runtime rollout; MISP upstream and OS packagers for source fixes","links":["https://www.circl.lu/services/misp-malware-information-sharing-platform/","https://www.circl.lu/doc/misp/requirements/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0451","name":"Pest PHP testing framework","vendor":"PestPHP / Nuno Maduro and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for pestphp/pest v5.3.2 declares PHP ^8.4 for this tool/library.","scope":"Inventory record: PHP-0451\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v5.3.2: PHP ^8.4\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: Pest5 documentation and package metadata are distinct from older major branches. The selected release requires PHPUnit^13.4.2 but conflicts with versions above13.4.2; do not substitute the newest PHPUnit patch into this graph. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v5.3.2; advertised source 73fe04f8c30a734fe2e269a71d4628cdf7131062; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: pestphp/pest\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/pestphp/pest","https://pestphp.com/docs/installation"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0452","name":"PHPStan static analyzer","vendor":"PHPStan / Ondřej Mirtes and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpstan/phpstan 2.3.1 declares PHP ^7.4|^8.0 for this tool/library.","scope":"Inventory record: PHP-0452\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 2.3.1: PHP ^7.4|^8.0\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: Tool execution PHP differs from the analyzed project target. Older prose about a PHP7.x environment must not exclude the registry’s PHP8 alternative. Bootstrap files/plugins need separate trust analysis; static parsing is not ordinary execution of all analyzed source. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 2.3.1; advertised source 6155239b488e95d26d1ebd95c6b4bb294d7f09db; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpstan/phpstan\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpstan/phpstan","https://phpstan.org/user-guide/getting-started"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0453","name":"Psalm PHP static analyzer","vendor":"Psalm project / Matthew Brown, Daniil Gentili and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for vimeo/psalm 7.0.0-rc2 declares PHP ~8.1.31 || ~8.2.27 || ~8.3.16 || ~8.4.3 || ~8.5.0 for this tool/library.","scope":"Inventory record: PHP-0453\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 7.0.0-rc2: PHP ~8.1.31 || ~8.2.27 || ~8.3.16 || ~8.4.3 || ~8.5.0\nExtensions: Declared required subset: ctype, dom, json, libxml, mbstring, simplexml, tokenizer; optional/loaded sets require separate checks\nLimitations: The installation guide’s generic PHP>=8.2 and selected7RC patch ranges have different scopes. Extension stubs describe analyzed code, not proof a module is loaded. Exact stable6-series requirements were not retrieved. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 7.0.0-rc2; advertised source 20339e3fe5b8d03bcd8061030eb2a83ad50e5783; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: vimeo/psalm\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/vimeo/psalm","https://psalm.dev/docs/running_psalm/installation/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0454","name":"Rector automated PHP refactoring tool","vendor":"Rector project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for rector/rector 2.7.0 declares PHP ^7.4|^8.0 for this tool/library.","scope":"Inventory record: PHP-0454\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 2.7.0: PHP ^7.4|^8.0\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: Running Rector, the syntax it accepts and the PHP version generated by a refactoring are separate. Conflicts with component packages must not be added as runtime requirements. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 2.7.0; advertised source 4d6a39b7fff302cac0ce90cd959a53c2f6a32776; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: rector/rector\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/rector/rector"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0455","name":"PHP_CodeSniffer and PHP Code Beautifier/Fixer","vendor":"PHPCSStandards / PHP_CodeSniffer project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for squizlabs/php_codesniffer 4.0.4 declares PHP >=7.2.0 for this tool/library.","scope":"Inventory record: PHP-0455\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 4.0.4: PHP >=7.2.0\nExtensions: Declared required subset: libxml, simplexml, tokenizer, xmlwriter; optional/loaded sets require separate checks\nLimitations: Both registry names identify the same source/version; the phpcsstandards package is marked abandoned in favor of squizlabs, not abandonment of the tool. phpcs and phpcbf are two scripts in one project. Optional sniffs/external tools add requirements. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 4.0.4; advertised source bbdc3d0532623e21838b7041a4364383a8126f96; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: squizlabs/php_codesniffer, phpcsstandards/php_codesniffer, phpcs.phar, phpcbf.phar\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/squizlabs/php_codesniffer","https://packagist.org/packages/phpcsstandards/php_codesniffer"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0456","name":"Phing PHP build system","vendor":"Phing project / Michiel Rook and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phing/phing 3.1.2 declares PHP >=8.1 for this tool/library.","scope":"Inventory record: PHP-0456\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 3.1.2: PHP >=8.1\nExtensions: Declared required subset: dom, json, libxml, simplexml, xml; optional/loaded sets require separate checks\nLimitations: Optional task dependencies and require-dev extensions are not all required by every build. Twenty-five replaces entries denote bundled/replacement task packages, not25 independent installations or mandatory external packages. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 3.1.2; advertised source b83482ca629bc4d3073c3f6939fcaa2cacd3f0bf; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phing/phing\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phing/phing"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0457","name":"Deployer PHP deployment automation","vendor":"Deployer / Anton Medvedev and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for deployer/deployer v8.0.5 declares PHP ^8.3 for this tool/library.","scope":"Inventory record: PHP-0457\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v8.0.5: PHP ^8.3\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: PHP runs the deployment controller; the implementation language of every managed target is not established. Recipes, remote commands and available credentials determine authority. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Deployment controller jobs and configured remote application management\nRelease pin: Publisher registry v8.0.5; advertised source 199273500b4f14ff5eafd76bea524e5d44bcaff3; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: deployer/deployer\nConditional downstream consequence: A matching reachable PHP or enabled-extension flaw in this administrative CLI could expose application-accessible credentials, change managed data/configuration or execute with the operator/service account. Authority depends on the selected account and command path; PHP presence does not establish remote access, root privileges or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/deployer/deployer"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0458","name":"Codeception PHP test framework","vendor":"Codeception / Michael Bodnarchuk and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for codeception/codeception 5.3.7 declares PHP ^8.2 for this tool/library.","scope":"Inventory record: PHP-0458\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 5.3.7: PHP ^8.2\nExtensions: Declared required subset: curl, json, mbstring; optional/loaded sets require separate checks\nLimitations: Optional module packages, browser/WebDriver processes and the tested remote application are distinct. The tool’s test dependencies do not prove every test target is PHP. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 5.3.7; advertised source 5740d838bce16d04b2e48cb68aaf9e40e5c57f2a; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: codeception/codeception\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/codeception/codeception"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0459","name":"Behat behavior-driven test framework","vendor":"Behat project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for behat/behat v4.0.0 declares PHP >=8.2 <8.6 for this tool/library.","scope":"Inventory record: PHP-0459\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v4.0.0: PHP >=8.2 <8.6\nExtensions: Declared required subset: mbstring; optional/loaded sets require separate checks\nLimitations: DOM is suggested for JUnit output, not universally mandatory. PHP executes the runner; a scenario’s browser/service target need not execute PHP. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v4.0.0; advertised source 3f65b57a8e52c7d2c45e219ecaf5900a995946bf; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: behat/behat\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/behat/behat"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0460","name":"PhpSpec specification test runner","vendor":"PhpSpec project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpspec/phpspec 9.0.0-rc.4.4 declares PHP 8.3.* || 8.4.* || 8.5.* || 8.6.* for this tool/library.","scope":"Inventory record: PHP-0460\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 9.0.0-rc.4.4: PHP 8.3.* || 8.4.* || 8.5.* || 8.6.*\nExtensions: Declared required subset: mbstring, sockets, tokenizer; optional/loaded sets require separate checks\nLimitations: The old PHP7.1+ tagline is not the selected9RC constraint. An8.6 compatibility declaration is not proof PHP8.6 is generally released. Optional AI/coverage integrations and their remote backends are separate. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 9.0.0-rc.4.4; advertised source e473de459b84df795a444cb0b058253fc7c9c7d2; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpspec/phpspec\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpspec/phpspec"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0461","name":"Infection PHP mutation-testing tool","vendor":"Infection project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for infection/infection 0.35.8 declares PHP ^8.3 for this tool/library.","scope":"Inventory record: PHP-0461\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 0.35.8: PHP ^8.3\nExtensions: Declared required subset: dom, json, libxml, mbstring; optional/loaded sets require separate checks\nLimitations: Mutation testing intentionally invokes a test framework and code under test. Coverage-driver and adapter choices require separate resolution; a tool/runtime flaw is not established by ordinary test execution. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 0.35.8; advertised source 642f7974a73713e7a2219baea0cd9b0856afba4b; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: infection/infection\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/infection/infection"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0462","name":"ParaTest parallel PHPUnit runner","vendor":"ParaTest / Brian Scaturro, Filippo Tessarotto and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for brianium/paratest v7.27.2 declares PHP ~8.4.0 || ~8.5.0 || ~8.6.0 for this tool/library.","scope":"Inventory record: PHP-0462\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v7.27.2: PHP ~8.4.0 || ~8.5.0 || ~8.6.0\nExtensions: Declared required subset: dom, pcre, reflection, simplexml; optional/loaded sets require separate checks\nLimitations: pcntl,pcov,posix occur in require-dev in the selected metadata, not the displayed runtime subset. Separate worker processes, test-suite PHP and future8.6 declarations need their own scope. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v7.27.2; advertised source 3b1189e2e36ac3e958d8cb362433862123eb7566; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: brianium/paratest\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/brianium/paratest"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0463","name":"PHPBench benchmarking framework","vendor":"PHPBench / Daniel Leech and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpbench/phpbench 1.7.0 declares PHP ^8.2 for this tool/library.","scope":"Inventory record: PHP-0463\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 1.7.0: PHP ^8.2\nExtensions: Declared required subset: dom, json, pcre, reflection, spl, tokenizer; optional/loaded sets require separate checks\nLimitations: Xdebug is optional for profiling. The benchmark runner’s PHP requirements differ from the deployment being measured; no benchmark was executed. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 1.7.0; advertised source 3d13c0d5dcf8730a67b70fa7fb03b4556b5cc0fe; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpbench/phpbench\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpbench/phpbench"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0464","name":"PHPMD PHP Mess Detector","vendor":"PHPMD project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpmd/phpmd 3.0.0 declares PHP ^8.1 for this tool/library.","scope":"Inventory record: PHP-0464\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 3.0.0: PHP ^8.1\nExtensions: Declared required subset: xml; optional/loaded sets require separate checks\nLimitations: PHPMD depends on PHP Depend; Java PMD ancestry/analogy does not make the PHP tool Java-based. Parallel-mode pcntl is optional; transitive requirements can raise the effective floor. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 3.0.0; advertised source b0f328de45f7af9a7355f794cf016779a763955c; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpmd/phpmd\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpmd/phpmd"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0465","name":"PHP Depend source-metrics analyzer","vendor":"PHP Depend project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for pdepend/pdepend 3.0.0 declares PHP >=8.1 with php-64bit capability for this tool/library.","scope":"Inventory record: PHP-0465\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 3.0.0: PHP >=8.1 with php-64bit capability\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: php-64bit is a platform capability, not a native extension package. Sockets are suggested for Windows multiprocessing; the mbstring polyfill is not proof native mbstring is loaded. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 3.0.0; advertised source 7088704510ba42729dc86cfb023640a4b8c26458; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: pdepend/pdepend\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/pdepend/pdepend"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0466","name":"phpDocumentor documentation generator","vendor":"phpDocumentor project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpdocumentor/phpdocumentor v3.10.0 declares PHP ^8.1 for this tool/library.","scope":"Inventory record: PHP-0466\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v3.10.0: PHP ^8.1\nExtensions: Declared required subset: ctype, hash, iconv, json, mbstring, simplexml, xml; optional/loaded sets require separate checks\nLimitations: PHP is required by the generator, not necessarily by the web server delivering generated static documentation. Optional renderer/external tool requirements remain separate. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v3.10.0; advertised source 0cd9a39454aadddcdd1e1f32194914e5d0871733; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpdocumentor/phpdocumentor\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpdocumentor/phpdocumentor"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0467","name":"Doctum PHP API documentation generator","vendor":"Code LTS / William Desportes and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for code-lts/doctum v5.6.0 declares PHP ^8.1 for this tool/library.","scope":"Inventory record: PHP-0467\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v5.6.0: PHP ^8.1\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: The publisher identifies Doctum as a Sami fork. Fork ancestry does not define current Sami requirements; generated static output does not itself require this PHP tool. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v5.6.0; advertised source fc3cd98ab569f8ad3f060010a2f627c1777409bf; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: code-lts/doctum\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/code-lts/doctum"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0468","name":"Roave backward-compatibility checker","vendor":"Roave","category":"Development and build","version":"Not specified","summary":"Publisher metadata for roave/backward-compatibility-check 8.23.0 declares PHP ~8.4.0 || ~8.5.0 for this tool/library.","scope":"Inventory record: PHP-0468\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 8.23.0: PHP ~8.4.0 || ~8.5.0\nExtensions: Declared required subset: dom, json, libxml, simplexml; optional/loaded sets require separate checks\nLimitations: The tool compares API revisions; its PHP runtime does not define the minimum of either compared library. Composer/plugin/bootstrap trust and transitive parser dependencies need separate resolution. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 8.23.0; advertised source f7573e3d1e3d012096f04aa7fe4de99b42aaf01d; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: roave/backward-compatibility-check\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/roave/backward-compatibility-check"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0469","name":"Box PHAR build and packaging tool","vendor":"Box / Humbug project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for humbug/box 4.7.0 declares PHP ^8.2 for this tool/library.","scope":"Inventory record: PHP-0469\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 4.7.0: PHP ^8.2\nExtensions: Declared required subset: iconv, mbstring, phar; optional/loaded sets require separate checks\nLimitations: Box’s build interpreter and a produced PHAR’s target runtime are different. XML in require-dev is not universally runtime-required; optional OpenSSL acceleration is separate. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 4.7.0; advertised source 9c2a430118f61ba4a20bc4969931494503f5da6a; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: humbug/box\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/humbug/box"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0470","name":"Phive PHAR installation and verification tool","vendor":"PHAR.io / Arne Blankerts, Sebastian Heuer and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phar-io/phive 0.16.0 declares PHP ^8.0 for this tool/library.","scope":"Inventory record: PHP-0470\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 0.16.0: PHP ^8.0\nExtensions: Declared required subset: curl, dom, mbstring, xml; optional/loaded sets require separate checks\nLimitations: phar-io/gnupg is a required userland package while ext-gnupg is suggested; do not conflate them. Signature-verification capability is not evidence a downloaded artifact was verified in this research. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 0.16.0; advertised source f7e9fc54edef96646ea16685027d77d175df0b61; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phar-io/phive\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phar-io/phive"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0471","name":"PsySH interactive PHP shell","vendor":"PsySH / Justin Hileman and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for psy/psysh v0.12.24 declares PHP ^8.0 || ^7.4 for this tool/library.","scope":"Inventory record: PHP-0471\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v0.12.24: PHP ^8.0 || ^7.4\nExtensions: Declared required subset: json, tokenizer; optional/loaded sets require separate checks\nLimitations: An interactive REPL intentionally executes operator input. PHP-parser/library dependencies and optional process-control support do not establish a public shell or production installation. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v0.12.24; advertised source ca0fdcf8a7617afa3adfdf1b5fef573dffb69ca1; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: psy/psysh\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/psy/psysh"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0472","name":"Drush Drupal administration CLI","vendor":"Drush project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for drush/drush 13.8.0 declares PHP >=8.3 for this tool/library.","scope":"Inventory record: PHP-0472\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 13.8.0: PHP >=8.3\nExtensions: Declared required subset: dom; optional/loaded sets require separate checks\nLimitations: Drush’s PHP floor differs from the selected Drupal site and command modules. Drupal packages listed as tool require-dev are not universal runtime requirements of every Drush deployment. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Configured Drupal administration, database/configuration access and deployment jobs\nRelease pin: Publisher registry 13.8.0; advertised source a5529118232c722c052ad6ae3be587df43c7d6fa; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: drush/drush\nConditional downstream consequence: A matching reachable PHP or enabled-extension flaw in this administrative CLI could expose application-accessible credentials, change managed data/configuration or execute with the operator/service account. Authority depends on the selected account and command path; PHP presence does not establish remote access, root privileges or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/drush/drush"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0473","name":"WP-CLI WordPress administration framework","vendor":"WP-CLI / WordPress project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for wp-cli/wp-cli v2.12.0 declares PHP ^5.6 || ^7.0 || ^8.0 for this tool/library.","scope":"Inventory record: PHP-0473\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v2.12.0: PHP ^5.6 || ^7.0 || ^8.0\nExtensions: Declared required subset: curl; optional/loaded sets require separate checks\nLimitations: The v2.12 core package declaration differs from the current handbook’s PHP>=7.2.24 and a full command bundle. Do not adopt5.6 as a current supported system recommendation or inherit every command package’s requirements. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v2.12.0; advertised source 03d30d4138d12b4bffd8b507b82e56e129e0523f; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: wp-cli/wp-cli\nConditional downstream consequence: A matching reachable PHP or enabled-extension flaw in this administrative CLI could expose application-accessible credentials, change managed data/configuration or execute with the operator/service account. Authority depends on the selected account and command path; PHP presence does not establish remote access, root privileges or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/wp-cli/wp-cli","https://make.wordpress.org/cli/handbook/guides/installing/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0474","name":"GrumPHP Git quality-check orchestration","vendor":"PHPro / GrumPHP contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpro/grumphp v2.26.0 declares PHP ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 for this tool/library.","scope":"Inventory record: PHP-0474\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: v2.26.0: PHP ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0\nExtensions: Declared required subset: json; optional/loaded sets require separate checks\nLimitations: Composer plugin API and Git hooks are execution/integration boundaries. Suggested task tools are not all mandatory dependencies; a hook being configured does not establish production PHP. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v2.26.0; advertised source c469dc05dcb81d6893bda31ff87eb48512c30fc7; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpro/grumphp\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpro/grumphp"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0475","name":"CaptainHook PHP Git-hook manager","vendor":"CaptainHook / Sebastian Feldmann and contributors","category":"Development and build","version":"Not specified","summary":"Publisher metadata for captainhook/captainhook 5.29.2 declares PHP >=8.0 for this tool/library.","scope":"Inventory record: PHP-0475\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 5.29.2: PHP >=8.0\nExtensions: Declared required subset: json, spl, xml; optional/loaded sets require separate checks\nLimitations: The replaces entry denotes the former package identity, not an additional product/deployment. Hook commands may invoke other languages; configured local execution does not imply Git service backend PHP. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 5.29.2; advertised source 805d44b0de8ed143f4acfb8c6bcb788cdbc42963; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: captainhook/captainhook, sebastianfeldmann/captainhook\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/captainhook/captainhook"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0476","name":"Easy Coding Standard PHP style tool","vendor":"Symplify","category":"Development and build","version":"Not specified","summary":"Publisher metadata for symplify/easy-coding-standard 13.3.7 declares PHP >=7.2 for this tool/library.","scope":"Inventory record: PHP-0476\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: 13.3.7: PHP >=7.2\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: The selected scoped distribution’s PHP declaration is distinct from separately installed PHPCS/Fixer requirements. Conflict entries are version exclusions, not mandatory package dependencies; exact bundled/native contents are unverified. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 13.3.7; advertised source 3716728056141c461b9f16e1facf55eb2d776449; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: symplify/easy-coding-standard\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/symplify/easy-coding-standard"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0477","name":"Satis Composer repository generator","vendor":"Composer / Satis maintainers","category":"Development and build","version":"Not specified","summary":"Publisher metadata for composer/satis 1.0.0 legacy tag declares PHP ^5.6 || ^7.0 for this tool/library.","scope":"Inventory record: PHP-0477\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI; Composer package and/or documented PHAR distribution\nPHP version scope: Legacy tagged1.0.0 requires PHP^5.6|^7.0; current dev-main README requires a recent supported PHP, exact main floor unresolved\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: The2017 stable tag is not a current dev-main requirement. Repository generation uses PHP; generated static metadata can be served independently. The private service named in the README has no inferred backend language. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 1.0.0 legacy tag; advertised source f66ff72ce4e788e95827404888fd53b3c9d29f82; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: composer/satis\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/composer/satis","https://github.com/composer/satis"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0478","name":"Mockery PHP test-double framework","vendor":"Mockery project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for mockery/mockery 1.6.15 declares PHP >=7.3 for this tool/library.","scope":"Inventory record: PHP-0478\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Userland PHP library within test runners or separately embedded callers\nPHP version scope: 1.6.15: PHP >=7.3\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: The library can overlap with PHPUnit/Pest environments. Its documented old HHVM3/PHP5 support ended with1.3; no HHVM4+ compatibility is implied. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 1.6.15; advertised source 967a801bd188989a5669bd280f252d51c0fdc9ee; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: mockery/mockery\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/mockery/mockery"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0479","name":"Prophecy PHP mocking library","vendor":"Prophecy / PhpSpec project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpspec/prophecy v1.26.1 declares PHP 8.2.* || 8.3.* || 8.4.* || 8.5.* for this tool/library.","scope":"Inventory record: PHP-0479\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Userland PHP test-double library in a consuming PHP process\nPHP version scope: v1.26.1: PHP 8.2.* || 8.3.* || 8.4.* || 8.5.*\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: The selected release’s PHP ranges supersede the old PHP5.3+ tagline and generic PHP7.2 README for this scope. PHPUnit in require-dev does not make that version mandatory for every consumer. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry v1.26.1; advertised source 09c2e5949d676286358a62af818f8407167a9dd6; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpspec/prophecy\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpspec/prophecy"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0480","name":"PHPUnit PHP code-coverage library","vendor":"PHPUnit project / Sebastian Bergmann","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpunit/php-code-coverage 14.4.1 declares PHP >=8.4 for this tool/library.","scope":"Inventory record: PHP-0480\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Userland PHP coverage collection/report processing; optional native drivers\nPHP version scope: 14.4.1: PHP >=8.4\nExtensions: Declared required subset: dom, libxml, mbstring, xmlwriter; optional/loaded sets require separate checks\nLimitations: Coverage library, test runner and native drivers are distinct overlapping components. Suggested drivers do not prove both modules are installed or simultaneously enabled. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 14.4.1; advertised source f1e54f06b6b4cea73cd6104ba3c0cfa0efa6d73f; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpunit/php-code-coverage\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpunit/php-code-coverage"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0481","name":"PHPStan PHPDoc parser library","vendor":"PHPStan project","category":"Development and build","version":"Not specified","summary":"Publisher metadata for phpstan/phpdoc-parser 2.3.6 declares PHP ^7.4 || ^8.0 for this tool/library.","scope":"Inventory record: PHP-0481\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Userland PHP parser within analyzer/documentation consumers\nPHP version scope: 2.3.6: PHP ^7.4 || ^8.0\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: This userland PHPDoc parser is distinct from the PHP core parser and native Tokenizer. Dependencies listed only for its development do not prove consumer runtime requirements. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Publisher registry 2.3.6; advertised source 1427af4647235b4a73b13940b1f1258d3584f36e; source bytes/signatures and installed build not independently verified\nSource accessed: 2026-10-18\nAliases: phpstan/phpdoc-parser\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://packagist.org/packages/phpstan/phpdoc-parser"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0482","name":"Xdebug PHP Zend instrumentation extension","vendor":"Xdebug / Derick Rethans and contributors","category":"PHP external extensions","version":"Not specified","summary":"Xdebug documents loading its Zend extension into the chosen PHP SAPI configuration.","scope":"Inventory record: PHP-0482\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Zend extension loaded separately for PHP CLI/web SAPIs; mode and ABI specific\nPHP version scope: Installation docs list Xdebug3.5.3; compatibility matrix is version/ABI scoped and includes future-labelled branches\nExtensions: This record is Xdebug itself; optional OPcache interaction and mode selection are not a complete host-module inventory\nLimitations: CLI and FPM can use different php.ini files. A matrix row for future PHP/Xdebug is not a released build assertion; loaded debugger modes and exposure are unmeasured. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Xdebug maintainer plus PHP/native package or image builder; developer/operator for matching ABI, loaded modes and process rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Documented3.5.3 release label; no downloaded binary/signature verification\nSource accessed: 2026-10-18\nAliases: xdebug:zend-extension, ext-xdebug\nConditional downstream consequence: A matching flaw in the loaded PHP/native development module could affect its host process availability, accessible data or execution identity when the relevant instrumentation path is reached. Loaded mode, ABI, request/CLI path and privileges must match; installing a debugger or coverage tool does not establish an exposed listener or current vulnerability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Xdebug maintainer plus PHP/native package or image builder; developer/operator for matching ABI, loaded modes and process rollout","links":["https://xdebug.org/docs/install","https://xdebug.org/docs/compat"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0483","name":"PCOV PHP native code-coverage driver","vendor":"PCOV / Joe Watkins and contributors","category":"PHP external extensions","version":"Not specified","summary":"The official release catalogue requires PHP for PCOV; upstream documents enabled versus disabled executor hooks.","scope":"Inventory record: PHP-0483\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native PHP executor/Zend hooks controlled by pcov.enabled\nPHP version scope: PECL stable1.0.12 (2024-12-04), PHP>=7.1.0; exact build/ABI and newer-branch compatibility unverified\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: Enabled PCOV is not interoperable with Xdebug/phpdbg/Blackfire in the documented configuration. PEAR installer metadata is not a required application runtime; a broad minimum does not prove every future PHP build works. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: PCOV and runtime package/image maintainers; test-environment operator for ABI and enablement\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: PCOV1.0.12 release metadata; no package/DLL bytes verified\nSource accessed: 2026-10-18\nAliases: krakjoe/pcov, ext-pcov\nConditional downstream consequence: A matching flaw in the loaded PHP/native development module could affect its host process availability, accessible data or execution identity when the relevant instrumentation path is reached. Loaded mode, ABI, request/CLI path and privileges must match; installing a debugger or coverage tool does not establish an exposed listener or current vulnerability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PCOV and runtime package/image maintainers; test-environment operator for ABI and enablement","links":["https://pecl.php.net/package/pcov","https://github.com/krakjoe/pcov","https://github.com/krakjoe/pcov/blob/develop/INSTALL.md"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0484","name":"Psalm official custom-PHP container image","vendor":"Psalm project / Daniil Gentili","category":"Containers and distribution","version":"Not specified","summary":"Psalm’s official installation guide describes an image containing a custom PHP build and its analyzer.","scope":"Inventory record: PHP-0484\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0453\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Custom-built PHP CLI with Psalm inside the image\nPHP version scope: Guide advertises latest and example6.9.1 tags; exact PHP patch, digest and current stable image unresolved\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: Example6.9.1 is not an exact7RC runtime or newest-image pin. The guide’s performance figures were not treated as measured deployment evidence; no image was pulled. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Moving official documentation/source; immutable artifact pin pending\nSource accessed: 2026-10-18\nAliases: ghcr.io/danog/psalm\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://psalm.dev/docs/running_psalm/installation/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0485","name":"PHP CS Fixer official PHP container image family","vendor":"PHP CS Fixer project","category":"Containers and distribution","version":"Not specified","summary":"The installation guide documents PHP-version-qualified fixer images for local, GitHub and GitLab CI use.","scope":"Inventory record: PHP-0485\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0021\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI plus fixer in a selected container image\nPHP version scope: Guide describes <fixer-version>-php<php-version> tags;3-php8.3 and older combinations are examples, not current digests\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: A selected formatting image does not prove PHP inside the CI service or generated/edited product. Tagged Dockerfile retrieval failed; exact released image contents remain unverified. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Moving official documentation/source; immutable artifact pin pending\nSource accessed: 2026-10-18\nAliases: ghcr.io/php-cs-fixer/php-cs-fixer\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://cs.symfony.com/doc/installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0486","name":"CircleCI cimg/php CI runtime image family","vendor":"CircleCI","category":"Containers and distribution","version":"Not specified","summary":"CircleCI states each cimg/php tag contains PHP and Composer for CI jobs.","scope":"Inventory record: PHP-0486\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Complete PHP CLI/Composer environment; optional Node/browser-oriented variants\nPHP version scope: Current guide example8.5.11; full/minor tags and optional variants differ; exact digest/modules unknown\nExtensions: No complete native-extension inventory established; empty subsets do not mean no extensions are used\nLimitations: Rolling minor tags change. Old README7.4.26 examples and browser/browsers suffix wording are not current patch/support promises. This image does not prove CircleCI control-plane PHP. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Moving official documentation/source; immutable artifact pin pending\nSource accessed: 2026-10-18\nAliases: cimg/php\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://circleci.com/developer/images/image/cimg/php","https://github.com/CircleCI-Public/cimg-php/blob/main/README.md"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0487","name":"Satis official PHP container build recipe","vendor":"Composer / Satis maintainers","category":"Containers and distribution","version":"Not specified","summary":"The official Dockerfile uses a Composer build stage and PHP8.4 CLI final runtime.","scope":"Inventory record: PHP-0487\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0477\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: composer:latest build stage; final php:8.4-cli-alpine stage\nPHP version scope: Inspected moving main Dockerfile selects PHP8.4 CLI Alpine; exact PHP patch/base digest unknown\nExtensions: Recipe adds bz2,sockets,zip; not universal Satis application requirements\nLimitations: Moving recipe and legacy1.0.0 package constraints are different. Advertised helper hash is not a verified PHP image digest; generated static repositories do not inherit a server PHP requirement. No deployment, loaded-module set or reachability was measured; no specific PHP CVE was supplied. Static public evidence only; no retrieved code/image was installed, run, built or tested.\nPatch owner: Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout\nDownstream surface: Developer machines, selected CI jobs and build artifacts using this named tool\nRelease pin: Moving official documentation/source; immutable artifact pin pending\nSource accessed: 2026-10-18\nAliases: composer/satis:official-image, ghcr.io/composer/satis\nConditional downstream consequence: A matching PHP or enabled native-parser/extension flaw reached through source, package metadata, archives or build input could affect the tool process, its files, CI credentials or generated artifact integrity. Normal configured plugin/test execution is not itself a PHP vulnerability. Production impact needs a separate artifact/deployment or credential-propagation path; sandbox or tenant escape is not automatic.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Project maintainer for tool/library code; PHP/OS/image maintainer and developer or CI operator for compatible runtime/modules and rollout","links":["https://github.com/composer/satis/blob/main/Dockerfile"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0488","name":"Google Cloud PHP client monolith","vendor":"Google / googleapis contributors","category":"SDKs and integrations","version":"Not specified","summary":"Publisher metadata declares PHP ^8.2 and PHP RPC/serialization dependencies. The project recommends individual client packages and distinguishes optional versus required gRPC transports.","scope":"Inventory record: PHP-0488\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v0.350.0: PHP ^8.2\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: protobuf\nLimitations: This monolith replaces many component packages; those names are not independent required installations. Not every Google service requires PHP or the same transport. Only selected independent clients are separately validated here. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v0.350.0; advertised source 5ef43714f339fdcc260ef1e5433711958da76311; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: google/cloud\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/google/cloud"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0489","name":"Google APIs Client Library for PHP","vendor":"Google","category":"SDKs and integrations","version":"Not specified","summary":"The PHP API client requires PHP ^8.1, generated API service classes and Google Auth, with PHP HTTP/JWT dependencies.","scope":"Inventory record: PHP-0489\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v2.20.1: PHP ^8.1\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: The API client, generated service definitions and Cloud monolith overlap but are not identical packages. Generated APIs do not prove the remote backend language. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v2.20.1; advertised source 31b577e7012c4e68d5289d63aaf7e6d471ec1ff1; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: google/apiclient\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/google/apiclient"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0490","name":"Google Auth Library for PHP","vendor":"Google","category":"SDKs and integrations","version":"Not specified","summary":"Publisher metadata declares PHP ^8.1 for OAuth/JWT credential and HTTP client support. phpseclib is suggested for some signing/token paths.","scope":"Inventory record: PHP-0490\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v1.55.2: PHP ^8.1\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: Shared authentication code can be included by multiple clients or the monolith. A suggested userland cryptography package is not a native extension inventory. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v1.55.2; advertised source 293fdf064cfc5b77a22bb7406b59f149b3fb70e8; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: google/auth\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/google/auth"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0491","name":"Google Cloud Storage PHP client","vendor":"Google","category":"SDKs and integrations","version":"Not specified","summary":"The client requires PHP ^8.2 and google/cloud-core. Pub/Sub notifications and phpseclib signing are suggestions, not universal requirements.","scope":"Inventory record: PHP-0491\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v2.6.1: PHP ^8.2\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: No direct ext-grpc requirement appears in this package scope. Do not apply Firestore's transport requirement to Storage; full cloud-core/transitive graph remains unreviewed. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v2.6.1; advertised source cf14f967fa45113e2a239fe9103bada8d7b92021; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: google/cloud-storage\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/google/cloud-storage"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0492","name":"Google Cloud Firestore PHP client","vendor":"Google","category":"SDKs and integrations","version":"Not specified","summary":"Firestore client metadata requires ext-grpc and PHP ^8.2, while ext-protobuf is suggested to improve throughput over pure-PHP serialization.","scope":"Inventory record: PHP-0492\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v2.3.4: PHP ^8.2\nExtensions: Declared required subset: grpc; optional: protobuf\nLimitations: Required gRPC and optional native Protobuf have different statuses. Neither package establishes PHP in the Firestore service backend. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v2.3.4; advertised source 5c072d4c626b2e948fed9d06b23cd6f2d8cee3f8; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: google/cloud-firestore\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/google/cloud-firestore"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0493","name":"Microsoft Graph PHP SDK","vendor":"Microsoft Graph Client Tooling","category":"SDKs and integrations","version":"Not specified","summary":"The SDK declares PHP ^8.2 and microsoft/microsoft-graph-core ^3.0.0 for caller-side Graph access.","scope":"Inventory record: PHP-0493\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v3.8.0: PHP ^8.2\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: Graph Core and its transport/serialization dependencies are not yet individually enumerated. Microsoft cloud backend implementation remains unknown from this SDK. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v3.8.0; advertised source 463dedf077debec000c643526430137300ab7644; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: microsoft/microsoft-graph\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/microsoft/microsoft-graph"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0494","name":"Stripe PHP client library","vendor":"Stripe and contributors","category":"SDKs and integrations","version":"Not specified","summary":"The displayed beta release requires PHP >=7.4.0 and curl, json and mbstring extensions in the PHP caller.","scope":"Inventory record: PHP-0494\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v22.1.0-beta.1 prerelease: PHP >=7.4.0\nExtensions: Declared required subset: curl, json, mbstring\nLimitations: Selecting the stable version link still displayed beta metadata; the v22.0.0 manifest retrieval failed. Stable-release requirements and installed versions remain unresolved. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v22.1.0-beta.1; advertised source 86c540c886a4b205d5673067cd1489fd1a94c644; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: stripe/stripe-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/stripe/stripe-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0495","name":"Twilio PHP helper SDK","vendor":"Twilio API Team","category":"SDKs and integrations","version":"Not specified","summary":"The helper SDK declares PHP >=7.1.0; Guzzle is suggested as an HTTP client and appears separately in require-dev.","scope":"Inventory record: PHP-0495\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 8.13.0: PHP >=7.1.0\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: A suggested transport is not a universally mandatory runtime dependency. The declared compatibility floor does not assert upstream PHP security support or provider backend PHP. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 8.13.0; advertised source 0cb66196f3c017dae395661e0cf1fc8197cb6d34; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: twilio/sdk\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/twilio/sdk"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0496","name":"Auth0 PHP SDK","vendor":"Auth0","category":"SDKs and integrations","version":"Not specified","summary":"The SDK requires PHP ^8.2, json, mbstring, openssl and PSR HTTP implementations. Cache/event-dispatcher implementations are suggested.","scope":"Inventory record: PHP-0496\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 9.4.0: PHP ^8.2\nExtensions: Declared required subset: json, mbstring, openssl\nLimitations: PSR virtual implementations and concrete transports need host resolution. Auth0 SDK code is not proof of PHP in Auth0's identity service. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 9.4.0; advertised source deff7367eb206a2a3f6369b06385267f9e17aab5; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: auth0/auth0-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/auth0/auth0-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0497","name":"PayPal Server SDK for PHP","vendor":"PayPal","category":"SDKs and integrations","version":"Not specified","summary":"The PHP Server SDK requires curl/json and APIMatic support packages. Its README names five supported controller groups.","scope":"Inventory record: PHP-0497\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 2.4.0: PHP ^7.2 || ^8.0\nExtensions: Declared required subset: curl, json\nLimitations: 'Server SDK' means a library in a merchant-side server, not PayPal backend language evidence. Five controller groups are not exhaustive PayPal endpoint coverage. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 2.4.0; advertised source b6be767b759ac3e3ad1d32dde7143a0927f5892b; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: paypal/paypal-server-sdk\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/paypal/paypal-server-sdk"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0498","name":"Shopify App PHP package","vendor":"Shopify","category":"SDKs and integrations","version":"Not specified","summary":"The app package declares PHP >=8.2 with Firebase JWT and Guzzle dependencies for PHP Shopify app integration.","scope":"Inventory record: PHP-0498\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v1.0.2: PHP >=8.2\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: This is the separately versioned replacement client package, not Shopify's commerce service implementation or an installed merchant app. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v1.0.2; advertised source 0f84ecd4177107c09100f8eeadfe32eb6e9b03c5; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: shopify/shopify-app-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/shopify/shopify-app-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0499","name":"Shopify API Library for PHP deprecated line","vendor":"Shopify","category":"SDKs and integrations","version":"Not specified","summary":"Published metadata identifies the PHP client and its extension subset. The README marks it deprecated and directs users to shopify/shopify-app-php.","scope":"Inventory record: PHP-0499\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v6.1.1: PHP ^8.1; deprecated client line\nExtensions: Declared required subset: ctype, hash, json, mbstring; optional: apcu\nLimitations: Existing users may still run this library. Historical-only labels the retired maintenance line, not absence of current deployments. Fork/replacement ancestry is not a current dependency on the successor. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v6.1.1; advertised source 80e89587db4c6f111b52029a29a0f26277300b76; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: shopify/shopify-api, shopify-api-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.","links":["https://packagist.org/packages/shopify/shopify-api"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0500","name":"Mollie API PHP client","vendor":"Mollie B.V.","category":"SDKs and integrations","version":"Not specified","summary":"Mollie's PHP client declares PHP ^8.2, curl/json/openssl and PSR transport interfaces. A separate Mollie OAuth package is suggested for some endpoints.","scope":"Inventory record: PHP-0500\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v4.0.0: PHP ^8.2\nExtensions: Declared required subset: curl, json, openssl\nLimitations: Merchant plugins and this SDK can overlap. Optional OAuth support and SDK availability do not establish Mollie's backend language or any Dutch merchant deployment. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v4.0.0; advertised source 265dfcb58339ec4fec726012ca40c672316bf8de; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: mollie/mollie-api-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/mollie/mollie-api-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0501","name":"Adyen API PHP library","vendor":"Adyen","category":"SDKs and integrations","version":"Not specified","summary":"Adyen's library metadata requires PHP >=7.3 and ctype, curl, json, mbstring and openssl in the calling application.","scope":"Inventory record: PHP-0501\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v30.1.0: PHP >=7.3\nExtensions: Declared required subset: ctype, curl, json, mbstring, openssl\nLimitations: The package compatibility floor is not an upstream PHP lifecycle recommendation. Existing payment plugins and the API SDK must not be summed as unique merchants. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v30.1.0; advertised source 7eda6b3956a61d41a1fb87ab6d4ef30c7d6712cb; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: adyen/php-api-library\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/adyen/php-api-library"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0502","name":"Twilio SendGrid PHP client","vendor":"Twilio SendGrid","category":"SDKs and integrations","version":"Not specified","summary":"The client declares PHP >=7.3, five extensions, HTTP-client and ECDSA packages; it replaces the sendgrid/sendgrid-php package name.","scope":"Inventory record: PHP-0502\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 8.1.11: PHP >=7.3\nExtensions: Declared required subset: curl, gmp, json, mbstring, openssl\nLimitations: The replaced package name is an alias, not a second independent SDK/deployment. SMTP/mail-service backend language is not determined here. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 8.1.11; advertised source 1ed29bffffaec0216dc1330bb437d3b305428a11; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: sendgrid/sendgrid, sendgrid/sendgrid-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/sendgrid/sendgrid"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0503","name":"Microsoft Azure Storage PHP common client package (retired)","vendor":"Microsoft Azure Storage","category":"SDKs and integrations","version":"Not specified","summary":"The published common package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","scope":"Inventory record: PHP-0503\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 1.5.2: PHP >=5.6.0; retired client family\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: curl\nLimitations: Family-level extension requirements differ from direct split metadata. Neither is a resolved effective graph. Retired does not mean zero remaining deployments. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.5.2; advertised source 8ca7b1bf4c9ca7c663e75a02a0035b05b37196a0; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: microsoft/azure-storage-common\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.","links":["https://packagist.org/packages/microsoft/azure-storage-common","https://github.com/Azure/azure-storage-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0504","name":"Microsoft Azure Storage PHP blob client package (retired)","vendor":"Microsoft Azure Storage","category":"SDKs and integrations","version":"Not specified","summary":"The published blob package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","scope":"Inventory record: PHP-0504\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 1.5.4: PHP >=5.6.0; retired client family\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: curl\nLimitations: Family-level extension requirements differ from direct split metadata. Neither is a resolved effective graph. Retired does not mean zero remaining deployments. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.5.4; advertised source 1023ce1dbf062351a32ca5ec72ad1fd4a504f1bf; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: microsoft/azure-storage-blob\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.","links":["https://packagist.org/packages/microsoft/azure-storage-blob","https://github.com/Azure/azure-storage-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0505","name":"Microsoft Azure Storage PHP queue client package (retired)","vendor":"Microsoft Azure Storage","category":"SDKs and integrations","version":"Not specified","summary":"The published queue package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","scope":"Inventory record: PHP-0505\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 1.3.4: PHP >=5.6.0; retired client family\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: curl\nLimitations: Family-level extension requirements differ from direct split metadata. Neither is a resolved effective graph. Retired does not mean zero remaining deployments. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.3.4; advertised source 750974f7a888bb7a93cacb873b3280c45e970a23; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: microsoft/azure-storage-queue\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.","links":["https://packagist.org/packages/microsoft/azure-storage-queue","https://github.com/Azure/azure-storage-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0506","name":"Microsoft Azure Storage PHP table client package (retired)","vendor":"Microsoft Azure Storage","category":"SDKs and integrations","version":"Not specified","summary":"The published table package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","scope":"Inventory record: PHP-0506\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 1.1.6: PHP >=5.6.0; retired client family\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: curl\nLimitations: Family-level extension requirements differ from direct split metadata. Neither is a resolved effective graph. Retired does not mean zero remaining deployments. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.1.6; advertised source 6e3361c36a3f3ce0603faac58d27ab7c066539e1; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: microsoft/azure-storage-table\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.","links":["https://packagist.org/packages/microsoft/azure-storage-table","https://github.com/Azure/azure-storage-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0507","name":"Microsoft Azure Storage PHP file client package (retired)","vendor":"Microsoft Azure Storage","category":"SDKs and integrations","version":"Not specified","summary":"The published file package declares PHP >=5.6.0. The official family notice marks the Storage PHP clients retired; this is a caller-side legacy package.","scope":"Inventory record: PHP-0507\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 1.2.5: PHP >=5.6.0; retired client family\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: curl\nLimitations: Family-level extension requirements differ from direct split metadata. Neither is a resolved effective graph. Retired does not mean zero remaining deployments. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.2.5; advertised source 75432805ba5849ad81e455a449273ab544ff8212; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: microsoft/azure-storage-file\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Legacy SDK publisher; no active upstream fixes assumed. Calling application and PHP/OS/image owners for replacement, compatible runtimes and rollout.","links":["https://packagist.org/packages/microsoft/azure-storage-file","https://github.com/Azure/azure-storage-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0508","name":"MongoDB PHP userland library","vendor":"MongoDB PHP driver team","category":"SDKs and integrations","version":"Not specified","summary":"The userland library requires PHP ^8.1 and ext-mongodb ^2.5; its metadata replaces mongodb/builder.","scope":"Inventory record: PHP-0508\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 2.5.0: PHP ^8.1; ext-mongodb ^2.5\nExtensions: Declared required subset: mongodb\nLimitations: The userland library and native driver are separate components. A library requirement cannot substitute for the native extension's own ABI/minimum declaration or establish PHP in MongoDB servers. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 2.5.0; advertised source d70875dbb897a1cc7de15b6d21ceed43706f1937; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: mongodb/mongodb, mongodb/builder\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/mongodb/mongodb"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0509","name":"Predis PHP Redis and Valkey client","vendor":"Predis project / Till Krüss and contributors","category":"SDKs and integrations","version":"Not specified","summary":"Predis declares PHP compatibility and a PSR message interface; Relay is suggested as an optional faster connection implementation.","scope":"Inventory record: PHP-0509\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v3.7.0: PHP ^7.2 || ^8.0\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: relay\nLimitations: Predis does not declare ext-redis as a direct requirement. It and PhpRedis are distinct client choices, not proof that every application uses both or that a Redis server runs PHP. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v3.7.0; advertised source 4d91f3b08a60c3bacc2afbd8dc41724559b7626a; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: predis/predis\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/predis/predis"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0510","name":"Elasticsearch official PHP client","vendor":"Elastic","category":"SDKs and integrations","version":"Not specified","summary":"Fresh v9.5.0 registry review corroborates PHP ^8.1 and transport ^9.0, and separates yaml/zip development dependencies from the runtime list. The broad guide still says PHP 7.4.","scope":"Inventory record: PHP-0510\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v9.5.0: PHP ^8.1; broad installation guide says 7.4\nExtensions: No direct runtime ext-* require in v9.5.0 metadata. ext-yaml and ext-zip are require-dev only. Transitive/transport and loaded extensions remain unresolved.\nLimitations: Use the selected release's stricter declaration, not the broad guide, for this scope. The initial elastic/elasticsearch package URL was incorrect; no second package or backend PHP relationship is inferred. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed. Q17 rechecked the development/runtime distinction; pinned tag composer retrieval failed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v9.5.0; advertised source 6fe5f99ea3a8b697f8c098399cc84d2339a9508d; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: elasticsearch/elasticsearch\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/elasticsearch/elasticsearch","https://www.elastic.co/docs/reference/elasticsearch/clients/php/installation"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0511","name":"OpenSearch PHP client","vendor":"OpenSearch Contributors; inherited Elastic client lineage","category":"SDKs and integrations","version":"Not specified","summary":"The PHP client declares PHP ^8.2, curl/json and PSR HTTP implementations. AWS SDK is suggested for the signing decorator and appears in require-dev.","scope":"Inventory record: PHP-0511\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 2.7.1: PHP ^8.2\nExtensions: Declared required subset: curl, json\nLimitations: The optional AWS decorator is not a universal dependency or evidence the service backend is PHP. OpenSearch and Elasticsearch client lineages are separate versioned packages. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 2.7.1; advertised source ba3219959531501abfb4fbdcea06fff05cc0082f; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: opensearch-project/opensearch-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/opensearch-project/opensearch-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0512","name":"gRPC PHP Composer support library","vendor":"gRPC project","category":"SDKs and integrations","version":"Not specified","summary":"The Composer mirror contains PHP support files and declares PHP >=7.1.0. Official quickstart separately requires the native grpc extension for PHP clients.","scope":"Inventory record: PHP-0512\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified; official PHP tutorial documents client usage only, with a server in another language\nPHP version scope: Composer package 1.82.0: PHP >=7.1.0; not native gRPC 1.83.1\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: protobuf\nLimitations: Composer metadata does not list ext-grpc in require. Functional client execution still needs the documented extension. Official quickstart limits its PHP path to clients; the server example is another language. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed. Fresh tutorial scope: PHP clients only; this does not prove absence of every low-level server symbol or alternative PHP RPC implementation. Tutorial prerequisite PHP 7.0 is not substituted for the selected Composer/native release minimum.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.82.0; advertised source be984cb608f21e96453b3cfe54c748cc7b192250; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: grpc/grpc\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/grpc/grpc","https://grpc.io/docs/languages/php/quickstart/","https://grpc.io/docs/languages/php/basics/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0513","name":"Protocol Buffers PHP userland runtime","vendor":"Google / Protocol Buffers project","category":"SDKs and integrations","version":"Not specified","summary":"The PHP runtime declares PHP >=8.2.0 and suggests bcmath for JSON deserialization. It is separate from the native protobuf extension and protoc generator.","scope":"Inventory record: PHP-0513\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v5.37.0RC1 prerelease: PHP >=8.2.0\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: bcmath\nLimitations: The stable selector still displayed RC metadata, and its immutable source retrieval failed. A PHP-generated artifact does not mean the protoc compiler itself executes PHP. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: PHP application serialization/deserialization and generated PHP message classes\nRelease pin: Publisher registry v5.37.0RC1; advertised source b18a774441f96267f66768d6506775e008dcc5a5; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: google/protobuf\nConditional downstream consequence: If a matching PHP/runtime or enabled extension flaw is reached while encoding or decoding configured messages/JSON, caller-process information disclosure, denial of service, code execution or data integrity loss could result within actual permissions. This does not establish a flaw in protoc, the remote peer, or the named package itself.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/google/protobuf"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0514","name":"gRPC native PHP extension","vendor":"gRPC project","category":"PHP external extensions","version":"Not specified","summary":"PECL identifies a stable PHP extension release. The Windows catalogue distinguishes PHP versions, TS/NTS and x86/x64 builds; quickstart requires it for PHP client calls.","scope":"Inventory record: PHP-0514\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension loaded into a compatible PHP process; not a remote-service implementation; official PHP tutorial documents client usage only, with a server in another language\nPHP version scope: PECL gRPC 1.83.1 stable; Windows DLL catalogue advertises PHP 8.0–8.5 variants; exact minimum/ABI not established\nExtensions: Native PHP module; PHP/Zend ABI and build dependencies separate; additional extension requirements not fully enumerated\nLimitations: The rendered release dependency section did not supply a PHP minimum. Broad quickstart's 7.0 floor is not validated against this release. Generic gRPC implementations are not PHP-dependent products. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed. Fresh tutorial scope: PHP clients only; this does not prove absence of every low-level server symbol or alternative PHP RPC implementation. Tutorial prerequisite PHP 7.0 is not substituted for the selected Composer/native release minimum.\nPatch owner: Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: PECL release 1.83.1; package.xml/bytes/signatures not verified\nSource accessed: 2026-10-18\nAliases: ext-grpc, pecl:gRPC\nConditional downstream consequence: A matching flaw in this enabled native binding or a reached PHP/native parser could conditionally cause caller-process information disclosure, denial of service, memory corruption or code execution. The exact build, ABI, options, input path and privileges must match. Remote server compromise and tenant escape do not follow from binding presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout","links":["https://pecl.php.net/package/gRPC/1.83.1","https://pecl.php.net/package/gRPC/1.83.1/windows","https://grpc.io/docs/languages/php/quickstart/","https://grpc.io/docs/languages/php/basics/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0515","name":"Protocol Buffers native PHP extension","vendor":"Google / Protocol Buffers project","category":"PHP external extensions","version":"Not specified","summary":"The PECL release declares PHP >=8.2.0 for the native extension. Firestore's independent metadata suggests it for throughput rather than requiring it.","scope":"Inventory record: PHP-0515\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension loaded into a compatible PHP process; not a remote-service implementation\nPHP version scope: PECL protobuf 5.36.2 stable: PHP >=8.2.0\nExtensions: Native PHP module; PHP/Zend ABI and build dependencies separate; additional extension requirements not fully enumerated\nLimitations: Native and pure-PHP implementations are distinct choices. The extension's release numbering, generated-code compatibility and actual loaded ABI must be qualified separately. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: PECL release 5.36.2 / upstream release v36.2 declaration; bytes/signatures unverified\nSource accessed: 2026-10-18\nAliases: ext-protobuf, pecl:protobuf\nConditional downstream consequence: A matching flaw in this enabled native binding or a reached PHP/native parser could conditionally cause caller-process information disclosure, denial of service, memory corruption or code execution. The exact build, ABI, options, input path and privileges must match. Remote server compromise and tenant escape do not follow from binding presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout","links":["https://pecl.php.net/package/protobuf/5.36.2"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0516","name":"MongoDB native PHP driver extension","vendor":"MongoDB PHP driver team","category":"PHP external extensions","version":"Not specified","summary":"PECL identifies the native glue layer and native-library updates; the PHP manual supplies a version-qualified family minimum and default bundled/native options. Userland mongodb/mongodb requirements remain separate.","scope":"Inventory record: PHP-0516\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension loaded into a compatible PHP process; not a remote-service implementation\nPHP version scope: PECL 2.5.0 release page has no rendered PHP minimum. The moving PHP manual says extension versions from 1.21.0 require PHP >=8.1. Treat this as documented family guidance, not independently checked 2.5.0 package.xml/ABI compatibility.\nExtensions: Native PHP module; PHP/Zend ABI and build dependencies separate; additional extension requirements not fully enumerated\nLimitations: The current manual is not a frozen 2.5.0 build manifest; its broad minimum does not replace package.xml, ABI, platform or upper-version checks. libbson/libmongoc default bundles, optional TLS and Cyrus SASL are native dependencies used BY the extension, not downstream PHP applications. No loaded build, transport, deployment count or vulnerability verdict.\nPatch owner: Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: PECL release 2.5.0; native dependency update declarations, not verified archive/build\nSource accessed: 2026-10-18\nAliases: ext-mongodb, pecl:mongodb\nConditional downstream consequence: A matching flaw in this enabled native binding or a reached PHP/native parser could conditionally cause caller-process information disclosure, denial of service, memory corruption or code execution. The exact build, ABI, options, input path and privileges must match. Remote server compromise and tenant escape do not follow from binding presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout","links":["https://pecl.php.net/package/mongodb/2.5.0","https://www.php.net/manual/en/mongodb.requirements.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0517","name":"PhpRedis native PHP client extension","vendor":"PhpRedis project / Michael Grunder and contributors","category":"PHP external extensions","version":"Not specified","summary":"The develop build declarations make native compression conditional. The installation guide distinguishes optional serializer builds from the feature-limited initial Windows PIE binaries.","scope":"Inventory record: PHP-0517\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension loaded into a compatible PHP process; not a remote-service implementation\nPHP version scope: PECL redis 6.3.0 stable: PHP >=7.4.0\nExtensions: Optional serializers: igbinary, msgpack (>=2.0.3 per moving guide), phpser (>=0.9.0 and PHP>=8.2, loaded first). Optional native compression: LZF, LZ4, Zstd. Documented initial Windows PIE DLLs omit these features and JSON serialization.\nLimitations: The 6.3.0 tag could not be read; develop feature declarations are not attributed to every released 6.3.0 build. Optional native libraries are upstream edges, not Redis server dependencies on PHP. Windows guide scope is not a measurement of all Windows DLLs. Exact ABI, selected serializer/compressor, installed modules, linked versions, inputs and deployments remain unknown. No CVE or compromise is inferred.\nPatch owner: Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: PECL 6.3.0 baseline retained; fresh build-feature evidence is moving develop, not a verified6.3.0 source pin\nSource accessed: 2026-10-18\nAliases: ext-redis, phpredis/phpredis, pecl:redis\nConditional downstream consequence: A matching flaw in this enabled native binding or a reached PHP/native parser could conditionally cause caller-process information disclosure, denial of service, memory corruption or code execution. The exact build, ABI, options, input path and privileges must match. Remote server compromise and tenant escape do not follow from binding presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout","links":["https://pecl.php.net/package/redis/6.3.0","https://github.com/phpredis/phpredis/blob/develop/INSTALL.md","https://github.com/phpredis/phpredis/blob/develop/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0518","name":"Phpactor PHP language server and refactoring tool","vendor":"Phpactor project","category":"Development and build","version":"Not specified","summary":"Phpactor's manifest requires PHP ^8.2, mbstring, posix and tokenizer. Its README describes language-server/refactoring functionality and Linux/macOS or WSL.","scope":"Inventory record: PHP-0518\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI language server/refactoring process\nPHP version scope: 2026.10.07.0: PHP ^8.2\nExtensions: Declared required subset: mbstring, posix, tokenizer\nLimitations: The README's shorter extension list does not replace the manifest. Parsing PHP code does not establish production execution or PHP in every LSP editor. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Developer workspace files, code navigation/refactoring and generated edits\nRelease pin: Publisher registry 2026.10.07.0; advertised source ac2857bdf1c52424d753e328606511242c6ba694; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: phpactor/phpactor\nConditional downstream consequence: A matching runtime/parser flaw reached through analyzed source or metadata could affect the Phpactor process, developer files or edit integrity. Production impact requires a separate artifact or credential path; source analysis is not proof the analyzed application executes.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/phpactor/phpactor"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0519","name":"setup-php GitHub Action external PHP provisioning","vendor":"Shivam Mathur / setup-php project","category":"Development and build","version":"Patched setup-php v2-provisioned PHP builds announced 2026-10-21","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0519\nCategory: Development and build\nOriginal relationship: integrates\nRelationship direction: external_php_integration\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: Node action provisions external PHP runtime, modules and CLI tools\nPHP version scope: Moving main action declares Node24; selected PHP versions/extensions are independent job inputs\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: PHP is provisioned for selected jobs; this is not PHP in GitHub Actions platform or the action's JavaScript implementation. Provisioned runtime/tool/image versions need independent job evidence. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Integration/IDE/action maintainer for host code; developer or CI operator and PHP/OS/image maintainer for selected external engine and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Moving main action.yml; no immutable action commit or selected PHP build pinned\nSource accessed: 2026-10-18\nAliases: shivammathur/setup-php\nConditional downstream consequence: Only an invoked PHP interpreter, selected extension or PHP-executed tool inherits a matching PHP flaw. Effects could include developer/CI file or credential disclosure, denial of service, code execution or artifact integrity loss within actual permissions. A PHP flaw does not directly become a flaw in the non-PHP host implementation; production propagation needs separate evidence.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://github.com/shivammathur/setup-php/issues/1139\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Integration/IDE/action maintainer for host code; developer or CI operator and PHP/OS/image maintainer for selected external engine and rollout","links":["https://github.com/shivammathur/setup-php/blob/main/action.yml","https://github.com/shivammathur/setup-php/issues/1139"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require update=true, and pre-installed disables updates.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/shivammathur/setup-php/issues/1139\nAction statement: Re-run workflows with an explicit PHP version and updates enabled where required. Verify vendor build information because EOL backports retain upstream version numbers."},"CVE-2026-109619":{"status":"Fix","notes":"The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require update=true, and pre-installed disables updates.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://github.com/shivammathur/setup-php/issues/1139\nAction statement: Re-run workflows with an explicit PHP version and updates enabled where required. Verify vendor build information because EOL backports retain upstream version numbers."}}},{"id":"PHP-0520","name":"PhpStorm external PHP interpreter integration","vendor":"JetBrains","category":"Development and build","version":"Not specified","summary":"The guide requires a separately installed PHP engine and configures its executable/php.ini, interpreter selection and optional Xdebug integration.","scope":"Inventory record: PHP-0520\nCategory: Development and build\nOriginal relationship: integrates\nRelationship direction: external_php_integration\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: External local PHP engine/CLI; remote/container interpreters referenced; optional Xdebug\nPHP version scope: PhpStorm 2026.2 documentation, dated 14 August 2026; external selected PHP engine, version unspecified\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: xdebug\nLimitations: This boundary establishes external interpreter use, not PHP inside the IDE core or a bundled interpreter. The chosen engine, debugger and project are separate patch scopes. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Integration/IDE/action maintainer for host code; developer or CI operator and PHP/OS/image maintainer for selected external engine and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Moving PhpStorm 2026.2 guide dated 2026-08-14; IDE/runtime bytes not pinned\nSource accessed: 2026-10-18\nAliases: phpstorm:external-php-interpreter\nConditional downstream consequence: Only an invoked PHP interpreter, selected extension or PHP-executed tool inherits a matching PHP flaw. Effects could include developer/CI file or credential disclosure, denial of service, code execution or artifact integrity loss within actual permissions. A PHP flaw does not directly become a flaw in the non-PHP host implementation; production propagation needs separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Optional PHP path; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Optional PHP path; CVE match unknown\nCVE-2026-109619: Optional PHP path; CVE match unknown\nCVE assessment limit: Requires the specific PHP integration to be configured and invoked. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Integration/IDE/action maintainer for host code; developer or CI operator and PHP/OS/image maintainer for selected external engine and rollout","links":["https://www.jetbrains.com/help/phpstorm/configuring-local-interpreter.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0521","name":"VS Code PHP Debug adapter external PHP/Xdebug integration","vendor":"Xdebug / vscode-php-debug contributors","category":"Development and build","version":"Not specified","summary":"The debug-adapter descriptor uses node and out/phpDebug.js. Official README describes Xdebug connections, PHP CLI launch and built-in PHP web-server launch.","scope":"Inventory record: PHP-0521\nCategory: Development and build\nOriginal relationship: integrates\nRelationship direction: external_php_integration\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: Node debug adapter integrates external PHP CLI/built-in server or a PHP process with Xdebug\nPHP version scope: Moving main manifest: 0.0.0-development, Node runtime ^20.18.2; separate PHP/Xdebug target\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved; optional: xdebug\nLimitations: The adapter's development version is not a released client pin. Debugging targets and the Node adapter are separate components; no exposed debug listener or active session was measured. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: Integration/IDE/action maintainer for host code; developer or CI operator and PHP/OS/image maintainer for selected external engine and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Moving main manifest, not a released Marketplace version or PHP target build\nSource accessed: 2026-10-18\nAliases: xdebug/vscode-php-debug\nConditional downstream consequence: Only an invoked PHP interpreter, selected extension or PHP-executed tool inherits a matching PHP flaw. Effects could include developer/CI file or credential disclosure, denial of service, code execution or artifact integrity loss within actual permissions. A PHP flaw does not directly become a flaw in the non-PHP host implementation; production propagation needs separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Optional PHP path; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Optional PHP path; CVE match unknown\nCVE-2026-109619: Optional PHP path; CVE match unknown\nCVE assessment limit: Requires the specific PHP integration to be configured and invoked. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Integration/IDE/action maintainer for host code; developer or CI operator and PHP/OS/image maintainer for selected external engine and rollout","links":["https://github.com/xdebug/vscode-php-debug/blob/main/package.json","https://github.com/xdebug/vscode-php-debug"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0522","name":"TransIP API PHP client","vendor":"TransIP","category":"SDKs and integrations","version":"Not specified","summary":"The client declares PHP, json/openssl and HTTP dependencies. A Guzzle adapter and Symfony cache are suggested separately.","scope":"Inventory record: PHP-0522\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 6.54.10: PHP ^7.4 || ^8.0\nExtensions: Declared required subset: json, openssl\nLimitations: This SDK and TransIP's independently documented PHP hosting option are different boundaries. Neither establishes PHP in TransIP's control-plane implementation or an actual customer's stack. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 6.54.10; advertised source 7827bc7f709759419c4d28acd463ec2e7c035d93; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: transip/transip-api-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/transip/transip-api-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0523","name":"bunq PHP API SDK","vendor":"bunq","category":"SDKs and integrations","version":"Not specified","summary":"The vendor SDK declares PHP compatibility, curl/json/mbstring, Guzzle and a Composer plugin API constraint.","scope":"Inventory record: PHP-0523\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 1.28.0: PHP ^7.3 || ^8.0; composer-plugin-api ~1.0 || ~2.0\nExtensions: Declared required subset: curl, json, mbstring\nLimitations: The 2025 published release is not proof of current maintenance or the bank's internal runtime. Composer/plugin loading and the calling app phase need separate lock/usage evidence. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 1.28.0; advertised source c0a1697f2d50e5028b75a484c97c6663593098cc; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: bunq/sdk_php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/bunq/sdk_php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0524","name":"MessageBird PHP REST API client","vendor":"MessageBird","category":"SDKs and integrations","version":"Not specified","summary":"The publisher client requires PHP >=8.0, curl/json and Firebase JWT support.","scope":"Inventory record: PHP-0524\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v4.0.1: PHP >=8.0\nExtensions: Declared required subset: curl, json\nLimitations: Retain the package's MessageBird identity. Wider Bird platform branding, current endpoint coverage, other SDKs and backend language are not established. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v4.0.1; advertised source 7386390396bfc8c74451ecc58cf2017b597cbbc9; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: messagebird/php-rest-api\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/messagebird/php-rest-api"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0525","name":"Matomo PHP tracking client","vendor":"Matomo team","category":"SDKs and integrations","version":"Not specified","summary":"The tracking package requires PHP ^8.1 and json, and suggests curl for HTTPS tracking requests.","scope":"Inventory record: PHP-0525\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 4.0.1: PHP ^8.1\nExtensions: Declared required subset: json; optional: curl\nLimitations: This PHP tracker is distinct from Matomo's JavaScript/browser and mobile clients. A Matomo server relationship is independently evidenced, not inferred from the SDK or an endpoint measurement. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry 4.0.1; advertised source 4818aa947dac9216b43fe479988b7df96119d049; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: matomo/matomo-php-tracker\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/matomo/matomo-php-tracker"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0526","name":"AWS Common Runtime PHP userland binding package","vendor":"AWS SDK Common Runtime team","category":"SDKs and integrations","version":"Not specified","summary":"The Composer package declares PHP >=5.5 and suggests ext-awscrt while explicitly stating that the native extension is needed to use its functionality.","scope":"Inventory record: PHP-0526\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: v1.2.7: PHP >=5.5 in Composer metadata; native extension needed for functionality\nExtensions: No direct ext-* requirement in the inspected package declaration; transitive/transport requirements not exhaustively resolved\nLimitations: A dependency on the userland package does not prove the native extension is loaded or that every AWS SDK request uses CRT. The wrapper's broad PHP floor does not establish native build compatibility. No installation, configured transport, loaded-module set, reachability or deployment count was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved package, binary, source, image or test was installed or executed.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Publisher registry v1.2.7; advertised source d71d9906c7bb63a28295447ba12e74723bd3730e; source bytes/signatures and installed build not verified\nSource accessed: 2026-10-18\nAliases: aws/aws-crt-php\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/aws/aws-crt-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0527","name":"AWS Common Runtime native PHP extension","vendor":"AWS SDK Common Runtime team","category":"PHP external extensions","version":"Not specified","summary":"Publisher requirements distinguish UNIX and Windows PHP minima and document OpenSSL-linked builds versus an AWS-LC build option.","scope":"Inventory record: PHP-0527\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension loaded into a compatible PHP process; not a remote-service implementation\nPHP version scope: PECL 1.2.7 declares PHP>=5.5.0. Moving publisher README distinguishes UNIX PHP 5.5+ from Windows 7.2+; exact ABI/release support unverified.\nExtensions: Native PHP binding. README documents platform-specific PHP floors and alternative OpenSSL/AWS-LC native builds; no ext-openssl requirement inferred from native OpenSSL linkage.\nLimitations: Tagged native manifests and crt build directory were unavailable. Full aws-c-* submodule graph and versions remain unknown. A native TLS library is not the PHP openssl extension. Alternative OpenSSL/AWS-LC builds are not proof both are linked. Remote AWS service language, installed bytes/options, ABI, inputs and deployments remain unknown. No CVE was supplied.\nPatch owner: Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: PECL awscrt 1.2.7 baseline; fresh platform/TLS evidence from moving main README, not a verified selected release graph\nSource accessed: 2026-10-18\nAliases: ext-awscrt, pecl:awscrt\nConditional downstream consequence: A matching flaw in this enabled native binding or a reached PHP/native parser could conditionally cause caller-process information disclosure, denial of service, memory corruption or code execution. The exact build, ABI, options, input path and privileges must match. Remote server compromise and tenant escape do not follow from binding presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension project for binding code; PHP/OS/image owner and application operator for compatible build, native dependencies and rollout","links":["https://pecl.php.net/package/awscrt/1.2.7","https://github.com/awslabs/aws-crt-php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0528","name":"HHVM 3.30 PHP-compatible legacy line","vendor":"Facebook / HHVM project","category":"Embedded runtimes","version":"Not specified","summary":"The 3.30 announcement identifies the final PHP-compatible release family.","scope":"Inventory record: PHP-0528\nCategory: Embedded runtimes\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Independent HHVM virtual machine; not the PHP Group Zend engine or a PHP SAPI\nPHP version scope: HHVM 3.30, released 2018-12-17, was the final line aiming at PHP compatibility. PHP compatibility ceased in 4.0 on 2019-02-11; 3.30 support ended 2019-11-19.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Do not classify current Hack-only HHVM as a current PHP-compatible runtime. Historical Composer workflows can separately invoke PHP. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: Independent HHVM virtual machine; not the PHP Group Zend engine or a PHP SAPI\nRelease pin: Dated HHVM 3.30 / 4.0 / 4.32 release announcements, 2018-12-17 through 2019-11-19\nSource accessed: 2026-10-18\nAliases: HHVM PHP-compatible line, HHVM <=3.30\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://hhvm.com/blog/2018/12/17/hhvm-3.30.html","https://hhvm.com/blog/2019/02/11/hhvm-4.0.0.html","https://hhvm.com/blog/2019/11/19/hhvm-4.32.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0529","name":"HipHop for PHP compiler (HPHPc)","vendor":"Facebook / HipHop project","category":"Development and build","version":"Not specified","summary":"Facebook describes replacing its PHP-to-C++ HipHop compiler with HHVM in early 2013.","scope":"Inventory record: PHP-0529\nCategory: Development and build\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: PHP source translated to C++ with its own compiled runtime, not PHP-FPM\nPHP version scope: Historical compiler replaced by HHVM in early 2013, as documented retrospectively on 2016-09-22.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: The historical Facebook example is not proof of current Facebook/Meta backend PHP, identical libraries, or current installations. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: PHP source translated to C++ with its own compiled runtime, not PHP-FPM\nRelease pin: Primary engineering retrospective dated 2016-09-22; transition precision is early 2013, not an invented exact day\nSource accessed: 2026-10-18\nAliases: HPHPc, HipHop PHP-to-C++ compiler\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://engineering.fb.com/2016/09/22/networking-traffic/redesigning-the-hhvm-jit-compiler-for-better-performance/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0530","name":"KPHP compiler and native runtime","vendor":"VK / VKCOM KPHP project","category":"Development and build","version":"Not specified","summary":"The architecture separates a compiler, native runtime, HTTP server and development extension.","scope":"Inventory record: PHP-0530\nCategory: Development and build\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: PHP subset translated to C++, linked into a Linux executable with its own runtime and server\nPHP version scope: Moving KPHP architecture and difference documentation; exact compiler release and full PHP-language compatibility unpinned.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Not a drop-in claim for Composer frameworks, native Zend extensions or all PHP syntax. The development binding is recorded independently. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: PHP subset translated to C++, linked into a Linux executable with its own runtime and server\nRelease pin: Moving project architecture/difference documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: VK KPHP, kphp2cpp\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/","https://vkcom.github.io/kphp/kphp-language/kphp-vs-php/kphp-vs-php-differences.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0531","name":"KPHP vkext development PHP extension","vendor":"VK / VKCOM KPHP project","category":"PHP external extensions","version":"Not specified","summary":"vkext exposes network and TL/RPC functions to PHP for development and is separate from the compiler.","scope":"Inventory record: PHP-0531\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native C/C++ extension loaded into the matching standard PHP/Zend process\nPHP version scope: Moving install documentation lists matching vkext packages for PHP 7.4, 8.0, 8.1 and 8.2; this is not an exhaustive current support or ABI statement.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: KPHP compilation and execution remain possible without vkext. An installed KPHP compiler does not establish this extension is enabled. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.\nDownstream surface: Native C/C++ extension loaded into the matching standard PHP/Zend process\nRelease pin: Moving KPHP vkext and installation docs, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: vkext, PHP vkext\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.","links":["https://vkcom.github.io/kphp/kphp-internals/kphp-architecture/internals-vkext.html","https://vkcom.github.io/kphp/kphp-basics/installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0532","name":"PeachPie PHP compiler and .NET runtime","vendor":"PeachPie / iolevel","category":"Development and build","version":"Not specified","summary":"PeachPie compiles PHP programs to assemblies using its reimplemented .NET runtime.","scope":"Inventory record: PHP-0532\nCategory: Development and build\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: Reimplemented PeachPie runtime hosted by .NET/.NET Core, not a Zend PHP SAPI\nPHP version scope: Architecture documented in moving About page; 1.1.10 release dated 2024-08-22 is an independently scoped example, not a latest-release claim.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Compatibility is not identical code or security behavior. Managed hosting and marketing claims are not an immunity or sandbox proof. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: Reimplemented PeachPie runtime hosted by .NET/.NET Core, not a Zend PHP SAPI\nRelease pin: Moving architecture docs plus dated PeachPie 1.1.10 announcement (2024-08-22)\nSource accessed: 2026-10-18\nAliases: PeachPie, peachpiecompiler/peachpie\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://docs.peachpie.io/about/","https://www.peachpie.io/blog/2024/08/22/peachpie-1110/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0533","name":"Phalanger PHP 5.4 compiler for .NET/Mono","vendor":"DEVSENSE / Phalanger project","category":"Development and build","version":"Not specified","summary":"The archived repository identifies a PHP 5.4 implementation and its PeachPie succession.","scope":"Inventory record: PHP-0533\nCategory: Development and build\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Independent PHP compiler/runtime hosted by .NET Framework or Mono\nPHP version scope: Archived project describes PHP 5.4 support; repository archived 2019-10-23 and identifies PeachPie as successor.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Do not carry PHP 5.4 claims into PeachPie or infer present-day compatibility, maintenance, absence of installations or identical Zend internals. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: Independent PHP compiler/runtime hosted by .NET Framework or Mono\nRelease pin: Archived DEVSENSE/Phalanger repository, archive date 2019-10-23; exact compiled build unknown\nSource accessed: 2026-10-18\nAliases: Phalanger, PHP.NET Phalanger\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://github.com/DEVSENSE/Phalanger"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0534","name":"JPHP JVM compiler and runtime","vendor":"JPHP Group","category":"Embedded runtimes","version":"Not specified","summary":"JPHP compiles PHP source to JVM bytecode and distinguishes its own runtime library from Zend PHP.","scope":"Inventory record: PHP-0534\nCategory: Embedded runtimes\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: JVM bytecode and JPHP runtime/own extension library, including non-web desktop/mobile uses\nPHP version scope: Moving master README claims PHP 7.1+ and selected later features; complete PHP 8 compatibility and a current release are unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: A Java GUI or Android capability is not a server-PHP dependency. Project feature claims do not establish every library, extension or deployment works. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: JVM bytecode and JPHP runtime/own extension library, including non-web desktop/mobile uses\nRelease pin: Moving jphp-group/jphp master README, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: JPHP, jphp-group/jphp\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://github.com/jphp-group/jphp"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0535","name":"HippyVM RPython PHP implementation","vendor":"HippyVM contributors","category":"Embedded runtimes","version":"Not specified","summary":"The project implements PHP using RPython and lists php5-cli among its build prerequisites.","scope":"Inventory record: PHP-0535\nCategory: Embedded runtimes\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: RPython/PyPy-derived implementation with its own hippy-c executable\nPHP version scope: Moving README documents x86-64 Linux and Ubuntu 14.04-era build instructions; current maintenance, release and modern PHP compatibility unknown.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Do not infer absence of PHP anywhere in the build environment. Legacy documentation is not proof of current deployment or an official end-of-life date. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: RPython/PyPy-derived implementation with its own hippy-c executable\nRelease pin: Moving hippyvm/hippyvm README with explicitly legacy build instructions\nSource accessed: 2026-10-18\nAliases: HippyVM, hippy-c\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://github.com/hippyvm/hippyvm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0536","name":"Quercus CleverCloud development branch","vendor":"Clever Cloud fork of Caucho Technology Quercus","category":"Embedded runtimes","version":"Not specified","summary":"The branch maintainer identifies a Java PHP implementation copied from Caucho Quercus/Resin.","scope":"Inventory record: PHP-0536\nCategory: Embedded runtimes\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: Java implementation from a separately maintained development branch of the Resin/Quercus lineage\nPHP version scope: Inspected default branch cc-4.0.14.2-dev; exact Java/PHP compatibility, current Resin builds and maintenance status not established.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Caucho documentation retrievals failed. The fork README does not establish every current Resin package includes identical Quercus code or is maintained. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: Java implementation from a separately maintained development branch of the Resin/Quercus lineage\nRelease pin: Moving CleverCloud/Quercus branch cc-4.0.14.2-dev; not a verified vendor Resin release\nSource accessed: 2026-10-18\nAliases: CleverCloud/Quercus, Quercus cc-4.0.14.2-dev\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://github.com/CleverCloud/Quercus"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0537","name":"Uniter PHP-to-JavaScript runtime stack","vendor":"Dan Phillimore / Uniter project","category":"Embedded runtimes","version":"Not specified","summary":"Uniter combines JavaScript parser, transpiler and runtime components to run PHP code.","scope":"Inventory record: PHP-0537\nCategory: Embedded runtimes\nOriginal relationship: implements\nRelationship direction: implements_php_language\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: PHP parsing to AST and JavaScript execution using reimplemented PHP built-ins\nPHP version scope: Moving official overview; library subset explicitly incomplete. LiveCodes separately documents an embedded Uniter v2.18.0 scope.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Limited built-ins are not native PHP extensions. Browser PHP here is not evidence of a PHP server. The unsuccessful uniter/uniter repository retrieval was not treated as source evidence. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.\nDownstream surface: PHP parsing to AST and JavaScript execution using reimplemented PHP built-ins\nRelease pin: Moving Uniter project overview, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: Uniter, npm:uniter\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"Implementation project for its compiler/runtime and integrations; host JVM/.NET/JavaScript/native-library maintainers and deploying operator for matching components and rollout. A Zend PHP update alone may not patch this implementation.","links":["https://phptojs.com/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0538","name":"WpDotNet compiled WordPress on PeachPie","vendor":"PeachPie / WpDotNet project","category":"CMS and publishing","version":"Not specified","summary":"The release announcement describes WpDotNet executing compiled WordPress without a php executable.","scope":"Inventory record: PHP-0538\nCategory: CMS and publishing\nOriginal relationship: uses alternative runtime\nRelationship direction: uses_alternative_php_implementation\nParent component: PHP-0532\nEvidence status: Alternative implementation\nDeployment status: Not measured\nPHP surface: WordPress PHP source compiled into .NET assemblies through PeachPie\nPHP version scope: Dated example: WordPress 6.5.4 with PeachPie 1.1.10; NuGet Peachpied.WordPress.AspNetCore 6.5.4-rc-020 targets at least .NET 6.0.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Do not generalize this older named build to WordPress 7 or every plugin. This consumer overlaps the WordPress and PeachPie families and is not an extra installation. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: WpDotNet and PeachPie maintainers for compiled code/runtime; .NET host and operator for rebuild/redeployment\nDownstream surface: WordPress PHP source compiled into .NET assemblies through PeachPie\nRelease pin: PeachPie 1.1.10 announcement, 2024-08-22; WpDotNet 6.5.4-rc-020 example, not current WordPress compatibility\nSource accessed: 2026-10-18\nAliases: WpDotNet, Peachpied.WordPress.AspNetCore\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"WpDotNet and PeachPie maintainers for compiled code/runtime; .NET host and operator for rebuild/redeployment","links":["https://www.peachpie.io/blog/2024/08/22/peachpie-1110/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0539","name":"WordPress Playground PHP.wasm binary family","vendor":"WordPress Playground contributors","category":"Embedded runtimes","version":"Not specified","summary":"The architecture compiles the PHP interpreter to WebAssembly rather than reimplementing it in JavaScript.","scope":"Inventory record: PHP-0539\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Actual PHP interpreter compiled by Emscripten to WebAssembly with a C/JavaScript API\nPHP version scope: Moving source declares supported minors 8.5,8.4,8.3,8.2,8.1,8.0,7.4; legacy 5.2 and next pseudo-version are separate. Exact PHP patch/build and published matrix unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Documentation examples naming older files are not the current build catalogue. Supported here is project build coverage, not PHP Group security support. No Wasm hashes, binaries, extension artifacts or npm lock graph verified. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Playground PHP.wasm build publisher plus PHP/upstream maintainers; package consumers must refresh JS/Wasm assets together\nDownstream surface: Actual PHP interpreter compiled by Emscripten to WebAssembly with a C/JavaScript API\nRelease pin: Architecture page updated 2026-10-14; moving supported-php-versions.ts inspected 2026-10-18\nSource accessed: 2026-10-18\nAliases: WordPress PHP.wasm binaries, @php-wasm/node-X-Y, @php-wasm/web-X-Y\nConditional downstream consequence: A matching PHP/Wasm flaw may conditionally crash the sandboxed runtime or affect its PHP data and granted browser/Node capabilities. Native server RCE, host escape or tenant compromise does not follow without a separate sandbox/bridge flaw and reachable path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Playground PHP.wasm build publisher plus PHP/upstream maintainers; package consumers must refresh JS/Wasm assets together","links":["https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/","https://github.com/WordPress/wordpress-playground/blob/trunk/packages/php-wasm/universal/src/lib/supported-php-versions.ts"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0540","name":"WordPress Playground browser and local runtime","vendor":"WordPress Playground contributors","category":"Embedded runtimes","version":"Not specified","summary":"Playground uses a WebAssembly build of the PHP interpreter to run WordPress.","scope":"Inventory record: PHP-0540\nCategory: Embedded runtimes\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0539\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: WordPress executed with the actual PHP.wasm interpreter; a remote PHP server is not required for browser execution\nPHP version scope: Moving architecture/docs updated 2026-10-14; selected WordPress/PHP releases and deployed hosted instance versions unknown.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: A browser demo, Node.js process and hosted service are distinct boundaries. The WordPress, runtime-family and adapter entries overlap. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Playground project and PHP.wasm publisher; embedding application/operator for selecting and refreshing builds\nDownstream surface: WordPress executed with the actual PHP.wasm interpreter; a remote PHP server is not required for browser execution\nRelease pin: Moving Playground architecture page, updated 2026-10-14; no instance measurement\nSource accessed: 2026-10-18\nAliases: WordPress Playground\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Playground project and PHP.wasm publisher; embedding application/operator for selecting and refreshing builds","links":["https://developer.wordpress.org/playground/developers/architecture/wasm-php-overview/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0541","name":"PHP.wasm universal JavaScript API","vendor":"WordPress Playground contributors","category":"SDKs and integrations","version":"Not specified","summary":"The universal package supplies the shared API without choosing a platform-specific PHP binary.","scope":"Inventory record: PHP-0541\nCategory: SDKs and integrations\nOriginal relationship: integrates\nRelationship direction: integrates_with_php\nParent component: PHP-0539\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Shared JavaScript API for an explicitly supplied PHP.wasm module, browser or Node.js\nPHP version scope: Moving package-layer documentation; npm release and exact selected PHP binary not pinned.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Do not label this JavaScript package alone as a bundled PHP engine or infer backend PHP from API presence. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: API package maintainer and host integration owner; binary publisher for the separately selected PHP runtime\nDownstream surface: Shared JavaScript API for an explicitly supplied PHP.wasm module, browser or Node.js\nRelease pin: Moving package-layer docs, updated 2026-10-14\nSource accessed: 2026-10-18\nAliases: @php-wasm/universal\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"API package maintainer and host integration owner; binary publisher for the separately selected PHP runtime","links":["https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0542","name":"PHP.wasm Node.js platform adapter","vendor":"WordPress Playground contributors","category":"SDKs and integrations","version":"Not specified","summary":"The Node adapter loads version-specific compiled PHP packages.","scope":"Inventory record: PHP-0542\nCategory: SDKs and integrations\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0539\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: JavaScript loader and Node-specific setup for selected PHP.wasm packages\nPHP version scope: Moving platform-adapter documentation; selected minor, patch, npm version and loaded extensions unknown.\nExtensions: Declared required subset: none separately declared here; optional documented examples: intl, redis, memcached, xdebug. Full build/transitive/loading inventory unverified.\nLimitations: Not a universal browser-to-server PHP claim. Optional extension examples do not prove loaded modules, and direct single-version loading can bypass adapter conveniences. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Adapter and PHP.wasm package publishers; consuming application/operator for lockfile, asset refresh and host permission choices\nDownstream surface: JavaScript loader and Node-specific setup for selected PHP.wasm packages\nRelease pin: Moving official platform/package-layer docs, updated 2026-10-14\nSource accessed: 2026-10-18\nAliases: @php-wasm/node\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Adapter and PHP.wasm package publishers; consuming application/operator for lockfile, asset refresh and host permission choices","links":["https://developer.wordpress.org/playground/developers/local-development/php-wasm-node/","https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0543","name":"PHP.wasm browser platform adapter","vendor":"WordPress Playground contributors","category":"SDKs and integrations","version":"Not specified","summary":"The web adapter selects a browser-specific compiled PHP package.","scope":"Inventory record: PHP-0543\nCategory: SDKs and integrations\nOriginal relationship: transitive\nRelationship direction: depends_on_php\nParent component: PHP-0539\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: JavaScript browser loader and worker/storage/network setup for selected PHP.wasm packages\nPHP version scope: Moving platform-adapter documentation; selected minor, patch, npm version and loaded extensions unknown.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Not a universal browser-to-server PHP claim. Optional extension examples do not prove loaded modules, and direct single-version loading can bypass adapter conveniences. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Adapter and PHP.wasm package publishers; consuming application/operator for lockfile, asset refresh and host permission choices\nDownstream surface: JavaScript browser loader and worker/storage/network setup for selected PHP.wasm packages\nRelease pin: Moving official platform/package-layer docs, updated 2026-10-14\nSource accessed: 2026-10-18\nAliases: @php-wasm/web\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Adapter and PHP.wasm package publishers; consuming application/operator for lockfile, asset refresh and host permission choices","links":["https://developer.wordpress.org/playground/developers/architecture/php-wasm-packages/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0544","name":"RoadRunner configured PHP worker-pool integration","vendor":"RoadRunner project","category":"Hosting and cloud","version":"Not specified","summary":"The documented pool starts PHP CLI processes and applies only to six named plugin paths.","scope":"Inventory record: PHP-0544\nCategory: Hosting and cloud\nOriginal relationship: integrates\nRelationship direction: integrates_with_php\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: Go supervisor launches PHP CLI processes; the selected worker plugins determine PHP use\nPHP version scope: Moving v3 worker-pool docs name http,gRPC,tcp,roadrunner-temporal,jobs,centrifuge. Exact Go binary, PHP version and enabled plugins unknown.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: RoadRunner itself need not be PHP-based. Worker pooling does not establish cross-tenant access, shared credentials or a tenant-isolation flaw. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: RoadRunner for supervision/transport; PHP publisher, worker-package owner and operator for runtime/worker changes and pool restart\nDownstream surface: Go supervisor launches PHP CLI processes; the selected worker plugins determine PHP use\nRelease pin: Moving RoadRunner worker-pool documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: RoadRunner PHP worker pool\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Optional PHP path; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Optional PHP path; CVE match unknown\nCVE-2026-109619: Optional PHP path; CVE match unknown\nCVE assessment limit: Requires the specific PHP integration to be configured and invoked. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"RoadRunner for supervision/transport; PHP publisher, worker-package owner and operator for runtime/worker changes and pool restart","links":["https://docs.roadrunner.dev/docs/php-worker/pool"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0545","name":"RoadRunner common PHP worker package","vendor":"RoadRunner PHP community","category":"Frameworks and packages","version":"Not specified","summary":"The common worker declares PHP and extension requirements; the old Composer name is replaced.","scope":"Inventory record: PHP-0545\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP worker communicating with the Go supervisor through Goridge\nPHP version scope: v3.8.0 requires PHP >=8.2, json and sockets; published 2026-10-10. It replaces spiral/roadrunner-worker at the same version.\nExtensions: Declared required subset: json, sockets. Full build/transitive/loading inventory unverified.\nLimitations: Requires-dev tools and the optional RoadRunner management CLI are not runtime requirements. Advertised replacement metadata is not proof every old lockfile has migrated. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.\nDownstream surface: PHP worker communicating with the Go supervisor through Goridge\nRelease pin: v3.8.0; advertised source reference 209132269fa4f33f6f017727aeee42a204046d04; pinned source retrieval failed\nSource accessed: 2026-10-18\nAliases: roadrunner/worker, spiral/roadrunner-worker\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.","links":["https://packagist.org/packages/roadrunner/worker","https://packagist.org/packages/spiral/roadrunner-worker"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0546","name":"PHP-PM process manager","vendor":"PHP-PM project","category":"Runtime interfaces","version":"Not specified","summary":"The release declares PHP and pcntl and describes retaining application bootstraps in worker processes.","scope":"Inventory record: PHP-0546\nCategory: Runtime interfaces\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP/ReactPHP worker processes; not the native PHP-FPM SAPI\nPHP version scope: 2.4.0 requires PHP ^7.3 || ^8.0 and pcntl; release dated 2022-03-16.\nExtensions: Declared required subset: pcntl. Full build/transitive/loading inventory unverified.\nLimitations: The inspected README has old framework and WordPress compatibility caveats. Do not infer compatibility for every contemporary application or reuse its performance figures as deployments. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.\nDownstream surface: PHP/ReactPHP worker processes; not the native PHP-FPM SAPI\nRelease pin: 2.4.0; advertised source b0aae62d995e03dd0cf523b8292404549bc793d5; pinned source retrieval failed\nSource accessed: 2026-10-18\nAliases: php-pm/php-pm, PPM PHP-PM\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.","links":["https://packagist.org/packages/php-pm/php-pm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0547","name":"Swoole native PHP extension","vendor":"Swoole project","category":"PHP external extensions","version":"Not specified","summary":"The release identifies an asynchronous PHP networking engine and explicit PHP-version bounds.","scope":"Inventory record: PHP-0547\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Extension loaded into a matching PHP process; programmatic servers/coroutines\nPHP version scope: PECL stable 6.2.3 declares PHP >=8.2.0 and <=8.5.99; optional native features and exact ABI/build unknown.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Protocol/TLS/cURL hooks and reactor features vary by build and configuration. Swoole and OpenSwoole have distinct releases and are not interchangeable version aliases. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.\nDownstream surface: Extension loaded into a matching PHP process; programmatic servers/coroutines\nRelease pin: PECL Swoole release 6.2.3; artifact bytes and enabled options unverified\nSource accessed: 2026-10-18\nAliases: ext-swoole, pecl:swoole\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.","links":["https://pecl.php.net/package/swoole/6.2.3"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0548","name":"OpenSwoole native PHP extension","vendor":"OpenSwoole project","category":"PHP external extensions","version":"Not specified","summary":"The release declares PHP >=8.3 and documents its native Zend Fiber integration.","scope":"Inventory record: PHP-0548\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP extension with programmatic servers, coroutines and optional native-Fiber context\nPHP version scope: PECL stable 26.2.0 requires PHP >=8.3.0, adds PHP 8.5 support and drops PHP 8.2 support.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Optional io_uring, Fiber context and parser/backend changes are build/configuration-specific. A Swoole version number or advisory is not automatically an OpenSwoole scope. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.\nDownstream surface: PHP extension with programmatic servers, coroutines and optional native-Fiber context\nRelease pin: PECL OpenSwoole release 26.2.0; native-feature activation not measured\nSource accessed: 2026-10-18\nAliases: ext-openswoole, pecl:openswoole\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Component/extension maintainer for integration code; PHP/OS/image or runtime-binary publisher and deploying operator for compatible engine updates and restart/redeployment.","links":["https://pecl.php.net/package/openswoole/26.2.0"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0549","name":"LiveCodes PHP (Uniter) browser mode","vendor":"LiveCodes project","category":"SDKs and integrations","version":"Not specified","summary":"The php language mode uses Uniter in the browser and lists version 2.18.0.","scope":"Inventory record: PHP-0549\nCategory: SDKs and integrations\nOriginal relationship: integrates\nRelationship direction: uses_alternative_php_implementation\nParent component: PHP-0537\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: Uniter JavaScript interpreter/transpiler with browser DOM interoperation, not remote PHP\nPHP version scope: Moving LiveCodes documentation names Uniter v2.18.0. Its separate PHP (Wasm) mode has a different runtime/version scope.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Do not transfer PHP.wasm 8.2.4 or native Zend-extension assumptions into this mode. A browser programming interface is not backend-PHP evidence. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: LiveCodes and Uniter maintainers; embedding application/browser host for permissions and deployment\nDownstream surface: Uniter JavaScript interpreter/transpiler with browser DOM interoperation, not remote PHP\nRelease pin: Moving LiveCodes PHP-mode documentation; documented Uniter v2.18.0, not a measured hosted build\nSource accessed: 2026-10-18\nAliases: LiveCodes language php, LiveCodes Uniter mode\nConditional downstream consequence: An application-language flaw or a matching defect in this implementation or a shared upstream library could conditionally affect data, credentials or availability in its host process. A PHP Group/Zend-engine flaw does not transfer solely because PHP syntax is supported. Code identity, native dependencies, enabled features and input paths need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Independent engine; no automatic inheritance. No affected deployment established.\nCVE-2026-109618: Independent engine; no automatic inheritance\nCVE-2026-109619: Independent engine; no automatic inheritance\nCVE assessment limit: Independent implementation/consumer scope. This is not a vendor-confirmed unaffected finding. Shared affected code, optional standard-PHP dependencies and current deployments need separate review.","owner":"LiveCodes and Uniter maintainers; embedding application/browser host for permissions and deployment","links":["https://livecodes.io/docs/languages/php/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Independent engine; no automatic inheritance","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0550","name":"Sean Morris php-wasm runtime package","vendor":"Sean Morris / php-wasm project","category":"Embedded runtimes","version":"Not specified","summary":"The project documents embedded PHP WebAssembly packages.","scope":"Inventory record: PHP-0550\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP compiled to WebAssembly and loaded by JavaScript entrypoints\nPHP version scope: Moving project README discusses 0.2.0 entrypoints; actual binary PHP patch/options must be resolved separately. LiveCodes pins an older 0.0.7/8.2.4 scope.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Distinct package publisher and release graph from WordPress @php-wasm. Same language or shared ancestry is not the same artifact. Catalogue names do not prove all entrypoints or versions were installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Sean Morris php-wasm build publisher and PHP maintainers; consumers for matched JS/Wasm asset replacement\nDownstream surface: PHP compiled to WebAssembly and loaded by JavaScript entrypoints\nRelease pin: Moving Sean Morris php-wasm README, retrieved 2026-10-18; not WordPress @php-wasm package identity\nSource accessed: 2026-10-18\nAliases: seanmorris/php-wasm, npm:php-wasm\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Sean Morris php-wasm build publisher and PHP maintainers; consumers for matched JS/Wasm asset replacement","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0551","name":"LiveCodes PHP (Wasm) browser mode","vendor":"LiveCodes project","category":"SDKs and integrations","version":"Not specified","summary":"The Wasm mode names its php-wasm and PHP versions separately.","scope":"Inventory record: PHP-0551\nCategory: SDKs and integrations\nOriginal relationship: integrates\nRelationship direction: integrates_with_php\nParent component: PHP-0550\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: Browser PHP WebAssembly runtime with optional JavaScript interoperation\nPHP version scope: Moving LiveCodes page specifies php-wasm v0.0.7 running PHP v8.2.4; this is documentation, not a live instance observation.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Separate from LiveCodes Uniter mode and from WordPress @php-wasm. Optional VRZNO interoperation does not establish unrestricted browser/host control. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: LiveCodes and selected php-wasm publisher; embedding application/browser host for asset updates and granted capabilities\nDownstream surface: Browser PHP WebAssembly runtime with optional JavaScript interoperation\nRelease pin: Moving LiveCodes Wasm-mode docs: php-wasm 0.0.7 / PHP 8.2.4; not a current-project version claim\nSource accessed: 2026-10-18\nAliases: LiveCodes language php-wasm, LiveCodes phpwasm mode\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"LiveCodes and selected php-wasm publisher; embedding application/browser host for asset updates and granted capabilities","links":["https://livecodes.io/docs/languages/php-wasm/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0552","name":"php-cgi-wasm package (Sean Morris)","vendor":"Sean Morris / php-wasm project","category":"Embedded runtimes","version":"Not specified","summary":"The publisher lists php-cgi-wasm as a separate package.","scope":"Inventory record: PHP-0552\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0550\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: CGI-like WebAssembly runtime; not an installed host php-cgi executable\nPHP version scope: Moving package catalogue; exact npm and PHP patch versions unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Overlaps the parent family. A package listing does not establish every named platform capability is enabled, that the host uses PHP internally, or that this package is installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment\nDownstream surface: CGI-like WebAssembly runtime; not an installed host php-cgi executable\nRelease pin: Moving publisher package catalogue, retrieved 2026-10-18; no release/artifact verification\nSource accessed: 2026-10-18\nAliases: npm:php-cgi-wasm\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0553","name":"php-cli-wasm package (Sean Morris)","vendor":"Sean Morris / php-wasm project","category":"Embedded runtimes","version":"Not specified","summary":"The publisher lists php-cli-wasm as a separate package.","scope":"Inventory record: PHP-0553\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0550\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: WebAssembly CLI entrypoint; not proof of a native PHP CLI installation\nPHP version scope: Moving package catalogue; exact npm and PHP patch versions unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Overlaps the parent family. A package listing does not establish every named platform capability is enabled, that the host uses PHP internally, or that this package is installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment\nDownstream surface: WebAssembly CLI entrypoint; not proof of a native PHP CLI installation\nRelease pin: Moving publisher package catalogue, retrieved 2026-10-18; no release/artifact verification\nSource accessed: 2026-10-18\nAliases: npm:php-cli-wasm\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0554","name":"php-dbg-wasm package (Sean Morris)","vendor":"Sean Morris / php-wasm project","category":"Embedded runtimes","version":"Not specified","summary":"The publisher lists php-dbg-wasm as a separate package.","scope":"Inventory record: PHP-0554\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0550\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Debugger Wasm package; exact debugger controls/remote interfaces unverified\nPHP version scope: Moving package catalogue; exact npm and PHP patch versions unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Overlaps the parent family. A package listing does not establish every named platform capability is enabled, that the host uses PHP internally, or that this package is installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment\nDownstream surface: Debugger Wasm package; exact debugger controls/remote interfaces unverified\nRelease pin: Moving publisher package catalogue, retrieved 2026-10-18; no release/artifact verification\nSource accessed: 2026-10-18\nAliases: npm:php-dbg-wasm\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0555","name":"php-sdl-wasm package (Sean Morris)","vendor":"Sean Morris / php-wasm project","category":"Embedded runtimes","version":"Not specified","summary":"The publisher lists php-sdl-wasm as a separate package.","scope":"Inventory record: PHP-0555\nCategory: Embedded runtimes\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0550\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Browser SDL-oriented Wasm runtime; backend features/permissions unverified\nPHP version scope: Moving package catalogue; exact npm and PHP patch versions unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Overlaps the parent family. A package listing does not establish every named platform capability is enabled, that the host uses PHP internally, or that this package is installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment\nDownstream surface: Browser SDL-oriented Wasm runtime; backend features/permissions unverified\nRelease pin: Moving publisher package catalogue, retrieved 2026-10-18; no release/artifact verification\nSource accessed: 2026-10-18\nAliases: npm:php-sdl-wasm\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0556","name":"php-cloud-wasm package (Sean Morris)","vendor":"Sean Morris / php-wasm project","category":"Hosting and cloud","version":"Not specified","summary":"The publisher lists php-cloud-wasm as a separate package.","scope":"Inventory record: PHP-0556\nCategory: Hosting and cloud\nOriginal relationship: bundles\nRelationship direction: depends_on_php\nParent component: PHP-0550\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Static ES-module PHP build for the named edge runtime; no Cloudflare control-plane PHP claim\nPHP version scope: Moving package catalogue; exact npm and PHP patch versions unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Overlaps the parent family. A package listing does not establish every named platform capability is enabled, that the host uses PHP internally, or that this package is installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment\nDownstream surface: Static ES-module PHP build for the named edge runtime; no Cloudflare control-plane PHP claim\nRelease pin: Moving publisher package catalogue, retrieved 2026-10-18; no release/artifact verification\nSource accessed: 2026-10-18\nAliases: npm:php-cloud-wasm\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0557","name":"php-wasm-builder package (Sean Morris)","vendor":"Sean Morris / php-wasm project","category":"Development and build","version":"Not specified","summary":"The publisher lists php-wasm-builder as a separate package.","scope":"Inventory record: PHP-0557\nCategory: Development and build\nOriginal relationship: builds\nRelationship direction: builds_php\nParent component: PHP-0550\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Build tooling for PHP WebAssembly artifacts; host tools and exact output payload unverified\nPHP version scope: Moving package catalogue; exact npm and PHP patch versions unverified.\nExtensions: Extension/backend inventory not fully enumerated for the scoped implementation/build\nLimitations: Overlaps the parent family. A package listing does not establish every named platform capability is enabled, that the host uses PHP internally, or that this package is installed. No installed artifact, loaded-module set, input reachability, deployment total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public static evidence only; no retrieved code, package, image or test was installed, built or executed.\nPatch owner: Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment\nDownstream surface: Build tooling for PHP WebAssembly artifacts; host tools and exact output payload unverified\nRelease pin: Moving publisher package catalogue, retrieved 2026-10-18; no release/artifact verification\nSource accessed: 2026-10-18\nAliases: npm:php-wasm-builder\nConditional downstream consequence: A matching flaw in the selected PHP engine, enabled extension or integration path could conditionally affect worker availability, confidentiality or integrity, and code execution only where the flaw class and privileges permit it. Presence does not establish a reachable path. Host control, credentials, tenant isolation and lateral movement require separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP Wasm scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP Wasm scope; CVE match unknown\nCVE-2026-109619: PHP Wasm scope; CVE match unknown\nCVE assessment limit: Read browser, Node, edge and build-only boundaries separately. A PHP runtime flaw does not establish sandbox/tenant escape. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Package/build publisher and PHP upstream; consuming application for selected artifact rebuild/redeployment","links":["https://github.com/seanmorris/php-wasm"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP Wasm scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0558","name":"OpenConext EngineBlock SAML proxy","vendor":"OpenConext / SURF","category":"Frameworks and packages","version":"Not specified","summary":"The SAML proxy manifest declares PHP ^8.5 and runtime extensions.","scope":"Inventory record: PHP-0558\nCategory: Frameworks and packages\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web proxy and Symfony CLI; actual production SAPI is not specified by this manifest\nPHP version scope: Moving main composer.json: PHP ^8.5. README retains PHP 7.2 prose. Advertised 7.2.1 release commit was identified, but its manifest could not be retrieved.\nExtensions: Direct runtime: dom, json, mbstring, openssl, pdo. Direct require-dev: zlib; not promoted to a runtime requirement.\nLimitations: A branch requirement and an advertised release do not prove that SURFconext or SRAM runs that branch. Older README minima are not current tested support. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: OpenConext/SURF for application; PHP/package maintainer and service operator for runtime rollout\nDownstream surface: Federated identity proxy, assertions, consent and session processing\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: openconext/engineblock, OpenConext-engineblock\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/parser/session flaw could disrupt sign-in or affect assertions, session material or configuration. Code execution requires the matching flaw class and process privileges. Trust in connected services, credential access and cross-tenant effects need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OpenConext/SURF for application; PHP/package maintainer and service operator for runtime rollout","links":["https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json","https://github.com/OpenConext/OpenConext-engineblock","https://github.com/OpenConext/OpenConext-engineblock/releases","https://openconext.org/openconext-building-blocks/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0559","name":"SURFconext Service Provider Dashboard","vendor":"SURF / SURFnet","category":"Monitoring and administration","version":"Not specified","summary":"The registration/management application declares PHP ^8.2 in its root manifest.","scope":"Inventory record: PHP-0559\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP web application and CLI; development PHP-FPM documented, production SAPI unknown\nPHP version scope: Moving main manifest: PHP ^8.2; Composer platform.php 8.2 is a dependency-resolution setting, not a measured runtime.\nExtensions: Manifest runtime: ctype, curl, dom, gd, iconv, intl, json, libxml, mbstring, openssl, simplexml, xml. No full resolved graph or deployed modules.\nLimitations: This SP Dashboard is not the Java OpenConext IdP Dashboard. Development setup and package constraints do not identify a production release or installed extension set. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: SURF application maintainers; runtime distributor and operator\nDownstream surface: Service-provider registration and federation-management configuration\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nAliases: surfnet/sp-dashboard, SURFnet/sp-dashboard\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/parser/session flaw could disrupt sign-in or affect assertions, session material or configuration. Code execution requires the matching flaw class and process privileges. Trust in connected services, credential access and cross-tenant effects need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SURF application maintainers; runtime distributor and operator","links":["https://github.com/SURFnet/sp-dashboard/blob/main/composer.json","https://github.com/SURFnet/sp-dashboard"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0560","name":"SURFdrive Nextcloud server component","vendor":"SURF","category":"Collaboration and storage","version":"Not specified","summary":"SURF states that SURFdrive is based on Nextcloud.","scope":"Inventory record: PHP-0560\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator/project identifies software family only; deployed application/PHP versions and backports unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Only the named application tier is covered, not the operator’s whole infrastructure or native/browser/mobile clients. Parent release minima are not inherited as deployed versions. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Dutch education/research file synchronisation and sharing\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable PHP or enabled-extension flaw could affect file/metadata confidentiality, integrity or service availability. Code execution requires a suitable flaw and privileges. Storage credentials, tenant boundaries and other services are not automatically compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://www.surf.nl/diensten/opslag-datamanagement/surfdrive","https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0561","name":"SURF Research Drive Nextcloud server component","vendor":"SURF","category":"Collaboration and storage","version":"Not specified","summary":"SURF’s domain-vision PDF identifies Research Drive among Nextcloud-based services.","scope":"Inventory record: PHP-0561\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0015\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator/project identifies software family only; deployed application/PHP versions and backports unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Only the named application tier is covered, not the operator’s whole infrastructure or native/browser/mobile clients. Parent release minima are not inherited as deployed versions. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Research-team data storage, sharing and collaboration\nRelease pin: Public 38-page domain-vision PDF, page 23; nearby storage roadmap page 24 dated 4 June 2026; not a deployed-build pin\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable PHP or enabled-extension flaw could affect file/metadata confidentiality, integrity or service availability. Code execution requires a suitable flaw and privileges. Storage credentials, tenant boundaries and other services are not automatically compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://www.surf.nl/files/2026-04/surf-dienstdomeinvisies-slidedeck.pdf","https://docs.nextcloud.com/server/stable/admin_manual/installation/system_requirements.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0562","name":"SURFfilesender FileSender server component","vendor":"SURF","category":"Collaboration and storage","version":"Not specified","summary":"SURF identifies FileSender as the origin of SURFfilesender.","scope":"Inventory record: PHP-0562\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0212\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator/project identifies software family only; deployed application/PHP versions and backports unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Only the named application tier is covered, not the operator’s whole infrastructure or native/browser/mobile clients. Parent release minima are not inherited as deployed versions. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Federated research/education large-file transfer\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable upload/parser/session flaw could affect transfer metadata, authorisation or availability. File disclosure and code execution depend on the actual flaw, encryption path and process privileges. No connected organisation or user is presumed affected.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://www.surf.nl/diensten/opslag-datamanagement/surffilesender","https://docs.filesender.org/filesender/v3.0/install/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0563","name":"SURF Research Access Management EngineBlock proxy","vendor":"SURF","category":"Monitoring and administration","version":"Not specified","summary":"SURF’s architecture names EngineBlock as the SRAM proxy.","scope":"Inventory record: PHP-0563\nCategory: Monitoring and administration\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0558\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator/project identifies software family only; deployed application/PHP versions and backports unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: SBS is separately Python-based; this is not a claim that the whole SRAM platform is PHP. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Federated access proxy for research collaborations\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/parser/session flaw could disrupt sign-in or affect assertions, session material or configuration. Code execution requires the matching flaw class and process privileges. Trust in connected services, credential access and cross-tenant effects need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://servicedesk.surf.nl/wiki/spaces/IAM/pages/74226103/Conceptual%2Boverview%2Bof%2BSURF%2BResearch%2BAccess%2BManagement","https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json","https://github.com/SURFscz/SBS"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0564","name":"SURFconext OpenConext EngineBlock proxy role","vendor":"SURF","category":"Monitoring and administration","version":"Not specified","summary":"Project showcase and architecture connect SURFconext with OpenConext’s EngineBlock proxy.","scope":"Inventory record: PHP-0564\nCategory: Monitoring and administration\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0558\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator/project identifies software family only; deployed application/PHP versions and backports unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Only the named application tier is covered, not the operator’s whole infrastructure or native/browser/mobile clients. Parent release minima are not inherited as deployed versions. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Education/research single-sign-on federation proxy\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/parser/session flaw could disrupt sign-in or affect assertions, session material or configuration. Code execution requires the matching flaw class and process privileges. Trust in connected services, credential access and cross-tenant effects need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SURF for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://openconext.org/openconext-showcases/","https://openconext.org/openconext-building-blocks/","https://github.com/OpenConext/OpenConext-engineblock/blob/main/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0565","name":"Belnet FileSender research/education service","vendor":"Belnet","category":"Collaboration and storage","version":"Not specified","summary":"Belnet documents a FileSender service for federation members.","scope":"Inventory record: PHP-0565\nCategory: Collaboration and storage\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0212\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator/project identifies software family only; deployed application/PHP versions and backports unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Only the named application tier is covered, not the operator’s whole infrastructure or native/browser/mobile clients. Parent release minima are not inherited as deployed versions. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: Belnet for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Belgian research/education federated file transfer\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable upload/parser/session flaw could affect transfer metadata, authorisation or availability. File disclosure and code execution depend on the actual flaw, encryption path and process privileges. No connected organisation or user is presumed affected.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Belnet for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://belnet.be/nl/communities-diensten/alle-diensten/identity-mobility-federation/filesender","https://docs.filesender.org/filesender/v3.0/install/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0566","name":"Wikimedia MediaWiki application-server PHP tier","vendor":"Wikimedia Foundation","category":"Education and knowledge","version":"Not specified","summary":"Wikimedia documents MediaWiki request execution through PHP-FPM.","scope":"Inventory record: PHP-0566\nCategory: Education and knowledge\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0014\nEvidence status: Confirmed relationship\nDeployment status: Publicly documented service/software relationship; not independently measured or probed\nPHP surface: PHP-FPM / FastCGI application tier; surrounding CDN/cache/database systems are separate\nPHP version scope: Current primary compatibility page reports production PHP 8.3. Older operator examples retain php7.4 build strings. Exact deployed patch/build, backports and heterogeneous rollout unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Moving operational documentation has mixed-age examples. Do not infer vulnerable PHP 7.4 installations from old instructions or treat every request as PHP execution. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: Wikimedia Foundation for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: Dynamic Wikimedia wiki request processing\nRelease pin: Moving primary documentation, retrieved 2026-10-18\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/application integration flaw could affect publication integrity, credentials or availability. Arbitrary code execution depends on flaw class and process authority, not product presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Wikimedia Foundation for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://wikitech.wikimedia.org/wiki/Application_servers","https://www.mediawiki.org/wiki/Compatibility/en"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0567","name":"OpenEuropa Authentication Drupal module","vendor":"European Commission / OpenEuropa contributors","category":"CMS and publishing","version":"Not specified","summary":"Publisher metadata declares PHP and Drupal; the module integrates with EU Login.","scope":"Inventory record: PHP-0567\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Drupal/PHP module acting as an EU Login CAS client; not the remote login server\nPHP version scope: Registry 1.22.0: PHP >=8.3, Drupal ^10.3 || ^11.0, drupal/cas ^3.0; effective host floor may be higher.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: No complete lock or deployed site was examined. This does not prove PHP in EU Login or all Commission sites. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: OpenEuropa/Drupal and PHP maintainers; consuming site operator\nDownstream surface: Drupal site authentication integration\nRelease pin: Publisher registry 1.22.0, 2026-09-10; advertised source cb2bdf35104b5e3dd74f833dc6c46cea19a2046e; bytes/signature unverified\nSource accessed: 2026-10-18\nAliases: openeuropa/oe_authentication\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/parser/session flaw could disrupt sign-in or affect assertions, session material or configuration. Code execution requires the matching flaw class and process privileges. Trust in connected services, credential access and cross-tenant effects need separate evidence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OpenEuropa/Drupal and PHP maintainers; consuming site operator","links":["https://packagist.org/packages/openeuropa/oe_authentication","https://github.com/openeuropa/oe_authentication"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0568","name":"OpenEuropa Content Drupal module","vendor":"European Commission / OpenEuropa contributors","category":"CMS and publishing","version":"Not specified","summary":"Publisher metadata declares PHP and Drupal dependencies.","scope":"Inventory record: PHP-0568\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0007\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side Drupal module on PHP\nPHP version scope: Registry 4.15.0: PHP >=8.1, Drupal ^10 || ^11. Selected Drupal/root requirements may require a higher PHP version.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Module-local minimum is not the effective Drupal site floor. No current Commission site population or exact rollout is established. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: OpenEuropa/Drupal and PHP maintainers; consuming site operator\nDownstream surface: Corporate content entities and publishing\nRelease pin: Publisher registry 4.15.0, 2026-08-21; advertised source 8d3d46d2414c18718c163c2752a2143ef6edeb4b; bytes/signature unverified\nSource accessed: 2026-10-18\nAliases: openeuropa/oe_content\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/application integration flaw could affect publication integrity, credentials or availability. Arbitrary code execution depends on flaw class and process authority, not product presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OpenEuropa/Drupal and PHP maintainers; consuming site operator","links":["https://packagist.org/packages/openeuropa/oe_content"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0569","name":"OpenEuropa Task Runner","vendor":"European Commission / OpenEuropa contributors","category":"Development and build","version":"Not specified","summary":"Publisher describes a PHP task runner and declares its PHP floor.","scope":"Inventory record: PHP-0569\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP CLI task runner based on Robo\nPHP version scope: Displayed registry 2.0.0-beta2 (prerelease), dated 2026-10-06: PHP >=8.1. This is not a claim of newest stable release.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Tool usage and generated/deployed application runtime are different boundaries. Instructions were read, not executed. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: OpenEuropa/Robo/PHP maintainers and build-runner operator\nDownstream surface: Build tasks, generated configuration and release archives\nRelease pin: Publisher registry 2.0.0-beta2 prerelease, 2026-10-06; advertised source a243d05d9a4360774f88bd174fa83b23aeb83f02; bytes/signature unverified\nSource accessed: 2026-10-18\nAliases: openeuropa/task-runner\nConditional downstream consequence: Analyst judgment: a matching flaw executed by the build tool could affect build availability, generated outputs or credentials available to that runner. This does not establish a PHP runtime in the resulting production service.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OpenEuropa/Robo/PHP maintainers and build-runner operator","links":["https://packagist.org/packages/openeuropa/task-runner"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0570","name":"Yoda v1.5 legacy PHP web portal","vendor":"Utrecht University / Yoda","category":"Education and knowledge","version":"Not specified","summary":"Version 1.5 notes explicitly document the PHP portal upgrade.","scope":"Inventory record: PHP-0570\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nEvidence status: Historical-only\nDeployment status: Historical software release documented; no named current legacy installation measured\nPHP surface: Legacy PHP/CodeIgniter web portal; iRODS core and current portal implementation are separate\nPHP version scope: Versioned release notes: v1.5, July 2019; PHP 7.2 and CodeIgniter 3.1.10. No current support or installed legacy population asserted.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: The current service description does not specify portal PHP. Legacy architecture is not inherited by all present Yoda deployments. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: Yoda maintainers and legacy deployment operator; historical PHP/distribution support depends on exact build\nDownstream surface: Legacy research-data portal for metadata, files and archive workflow\nRelease pin: Versioned v1.5 release notes, release month 2019-07; no immutable commit/artifact pin\nSource accessed: 2026-10-18\nAliases: Yoda portal 1.5 (PHP)\nConditional downstream consequence: Analyst judgment: a matching reachable PHP or enabled-extension flaw could affect file/metadata confidentiality, integrity or service availability. Code execution requires a suitable flaw and privileges. Storage credentials, tenant boundaries and other services are not automatically compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Yoda maintainers and legacy deployment operator; historical PHP/distribution support depends on exact build","links":["https://utrechtuniversity.github.io/yoda/release-notes/release-1.5.html"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers; updating application code alone does not remediate this PHP flaw.","detail":"0-Z inventory audit reviewed 2026-10-21. PHP upstream states all installations serving web requests are at risk; Wiz Research states exploitation is in PHP itself and can affect even a simple Hello World application. Each VEX product in this relationship already has product-specific evidence recorded on its package establishing a PHP web-serving scope. The assessed element is the affected PHP runtime scope, not an application-code defect."}}},{"id":"PHP-0571","name":"EU Academy Moodle service (2023 evidence)","vendor":"European Commission","category":"Education and knowledge","version":"Not specified","summary":"An archived 2023 EU article identifies EU Academy as Moodle-based.","scope":"Inventory record: PHP-0571\nCategory: Education and knowledge\nOriginal relationship: transitive\nRelationship direction: product_depends_on_php\nParent component: PHP-0013\nEvidence status: Historical-only\nDeployment status: Historical operator-reported service; current implementation unverified\nPHP surface: Server-side PHP through the named upstream application; deployed SAPI unknown\nPHP version scope: Operator report published 2023-03-15, updated 2023-04-24. Installed Moodle/PHP release then and current 2026 stack unknown.\nExtensions: Actual required/optional extension set unknown for this deployed/released scope; do not inherit a moving parent version matrix\nLimitations: Historical-only qualifies the evidence date, not a claim that the service or Moodle was discontinued. The current Moodle release matrix cannot be applied to the 2023 service. No exact installed build, loaded-extension set, input reachability, installation total, tenant escape or compromise was measured. No specific PHP CVE was supplied. Public documentation and static declarations only.\nPatch owner: European Commission for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes\nDownstream surface: EU external-stakeholder e-learning\nRelease pin: Published 2023-03-15, updated 2023-04-24; archived historical operator report, not a 2026 build\nSource accessed: 2026-10-18\nConditional downstream consequence: Analyst judgment: a matching reachable PHP/application integration flaw could affect publication integrity, credentials or availability. Arbitrary code execution depends on flaw class and process authority, not product presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"European Commission for deployed configuration/runtime rollout; application and PHP upstream/package maintainers for fixes","links":["https://interoperable-europe.ec.europa.eu/collection/digital-skills-public-sector/news/eu-academy-platform-nutshell","https://moodledev.io/general/releases/5.3"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0572","name":"Imagick native PHP image extension","vendor":"Imagick project","category":"PHP external extensions","version":"Not specified","summary":"The release describes a native PHP wrapper for ImageMagick and declares a PHP minimum; its notes mention PHP 8.5 compilation compatibility.","scope":"Inventory record: PHP-0572\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 3.8.1: PHP >=5.6.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: ImageMagick is a required native library, not a PHP extension; additional ext-* requirements not exhaustively resolved\nLimitations: ImageMagick/delegate vulnerabilities require their own version and feature matching. ImageMagick itself is not a product dependent on PHP. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Image conversion/thumbnail workers and configured image/delegate input paths\nRelease pin: PECL release 3.8.1; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-imagick, pecl:imagick\nConditional downstream consequence: Analyst judgment: a matching reached image/delegate parser flaw could affect confidentiality, availability or integrity and, for a suitable memory-safety flaw, caller-process code execution. Enabled formats, delegates, policies, build and privileges must match.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/imagick/3.8.1","https://pecl.php.net/package/imagick"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0573","name":"APCu native PHP user-cache extension","vendor":"APCu / PHP extension maintainers","category":"PHP external extensions","version":"Not specified","summary":"The official catalogue identifies APCu as APC User Cache and declares its selected release PHP requirement.","scope":"Inventory record: PHP-0573\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 5.1.28: literal registry minimum PHP 7.0.0-dev or newer. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: Retain the literal -dev minimum rather than silently normalizing it to a tested support matrix. The selected release page failed retrieval; user-cache evidence does not establish an opcode-cache component or any shared-host tenant configuration. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Application user-cache values and PHP-process/shared-memory cache operations\nRelease pin: PECL catalogue selected 5.1.28; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-apcu, pecl:apcu\nConditional downstream consequence: Analyst judgment: a matching reached cache/shared-memory flaw could conditionally affect cached data confidentiality, integrity or service availability. Cross-tenant access, credentials and code execution require separate matching flaws, configuration and privileges.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/apcu"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0574","name":"Memcached native PHP client extension","vendor":"php-memcached project","category":"PHP external extensions","version":"Not specified","summary":"PECL identifies the libmemcached-based PHP client. The official 3.x README explicitly makes igbinary/msgpack serializer support optional, despite the flat PECL dependency list.","scope":"Inventory record: PHP-0574\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 3.4.0: PHP >=7.0.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: Optional igbinary >=2.0 and msgpack >=2.0 serializers in documented 3.x builds; selected builds and enabled serializers unknown\nLimitations: The client binding does not establish PHP in the memcached server. Moving 3.x README conditions are not independently verified release-archive configuration. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Calling PHP applications, cache payloads, selected serializers and configured cache-service credentials\nRelease pin: PECL release 3.4.0; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-memcached, pecl:memcached\nConditional downstream consequence: Analyst judgment: a matching reached client-protocol, authentication or native-memory flaw could conditionally affect caller data, credentials, integrity or availability. Process code execution needs a suitable flaw and matching build/input path. The remote server and other tenants are not thereby compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/memcached/3.4.0","https://pecl.php.net/package/memcached","https://github.com/php-memcached-dev/php-memcached"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0575","name":"igbinary native PHP serializer extension","vendor":"igbinary project","category":"PHP external extensions","version":"Not specified","summary":"The selected release is a PHP binary serializer and states its PHP requirement.","scope":"Inventory record: PHP-0575\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 3.2.16: PHP >=7.0.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: Catalogue entry 3.2.17RC1 is labelled stable despite its RC name. This row deliberately scopes the plain 3.2.16 release, not a claim that it is universally latest or recommended. Serializer integration is configuration-specific. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Explicit serializer/deserializer calls and enabled cache/session serialization paths\nRelease pin: PECL release 3.2.16; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-igbinary, pecl:igbinary\nConditional downstream consequence: Analyst judgment: a matching reached deserializer/native-parser flaw could conditionally disclose caller data, cause denial of service or corrupt process memory. Object-instantiation effects require the applicable API/configuration and application behavior. No other language implementation’s vulnerability is inherited by name alone.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/igbinary/3.2.16","https://pecl.php.net/package/igbinary"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0576","name":"MessagePack native PHP serialization extension","vendor":"msgpack-php project","category":"PHP external extensions","version":"Not specified","summary":"The official catalogue describes a PHP MessagePack API and declares the selected 3.0.1 release minimum.","scope":"Inventory record: PHP-0576\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 3.0.1: PHP >=7.0.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: The version-specific page failed retrieval; catalogue declaration is retained. This is not MessagePack-CSharp or proof of the same LZ4 code, vulnerability, package lineage or activation. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Explicit PHP MessagePack parsing/serialization and configured integrations\nRelease pin: PECL catalogue selected 3.0.1; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-msgpack, pecl:msgpack\nConditional downstream consequence: Analyst judgment: a matching reached deserializer/native-parser flaw could conditionally disclose caller data, cause denial of service or corrupt process memory. Object-instantiation effects require the applicable API/configuration and application behavior. No other language implementation’s vulnerability is inherited by name alone.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/msgpack"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0577","name":"YAML native PHP parser and emitter extension","vendor":"PHP YAML extension project","category":"PHP external extensions","version":"Not specified","summary":"The selected release provides YAML 1.1 parsing/emission using LibYAML. The catalogue names date but does not render required/optional classification.","scope":"Inventory record: PHP-0577\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 2.3.0: PHP >=7.1.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: LibYAML native dependency; date appears in PECL dependency output, but its mandatory/optional classification remains unresolved\nLimitations: Do not promote date to a proven mandatory extension from flattened registry output. Timestamp/serialized-object settings and exact parser configuration are separate; package.xml pin retrieval failed. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Configured YAML parse/emit calls, callback and decoding options\nRelease pin: PECL release 2.3.0; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-yaml, pecl:yaml\nConditional downstream consequence: Analyst judgment: a matching reached deserializer/native-parser flaw could conditionally disclose caller data, cause denial of service or corrupt process memory. Object-instantiation effects require the applicable API/configuration and application behavior. No other language implementation’s vulnerability is inherited by name alone.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/yaml/2.3.0","https://pecl.php.net/package/yaml","https://packagist.org/packages/pecl/yaml"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0578","name":"AMQP native PHP messaging client extension","vendor":"php-amqp project","category":"PHP external extensions","version":"Not specified","summary":"The release provides AMQP 0-9-1 client APIs. The official project documents native librabbitmq requirements separately from the test broker.","scope":"Inventory record: PHP-0578\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 2.2.0: PHP >=7.4.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: Native librabbitmq required; PHP extension prerequisites not fully enumerated\nLimitations: The documented RabbitMQ server requirement is for tests, not proof that RabbitMQ runs PHP or that a local broker ships in the extension. Moving README minimums are not measured linked-library versions. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Publisher/consumer processes, message payloads and configured AMQP credentials\nRelease pin: PECL release 2.2.0; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-amqp, pecl:amqp\nConditional downstream consequence: Analyst judgment: a matching reached client-protocol, authentication or native-memory flaw could conditionally affect caller data, credentials, integrity or availability. Process code execution needs a suitable flaw and matching build/input path. The remote server and other tenants are not thereby compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/amqp/2.2.0","https://pecl.php.net/package/amqp","https://github.com/php-amqp/php-amqp"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0579","name":"rdkafka native PHP Kafka client extension","vendor":"php-rdkafka project","category":"PHP external extensions","version":"Not specified","summary":"The selected stable release is a librdkafka-based PHP client. The catalogue separately lists 7.0.0alpha1 with a higher PHP minimum.","scope":"Inventory record: PHP-0579\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 6.0.5: PHP >=7.0.0 and <=8.99.99 as declared. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: The 7.0 alpha PHP 8.1 minimum is not applied to stable 6.0.5. The declared upper bound does not prove every newer PHP build is tested. Kafka broker implementation is not inferred. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: PHP producers/consumers, native protocol callbacks and configured Kafka endpoints/credentials\nRelease pin: PECL release 6.0.5; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-rdkafka, pecl:rdkafka\nConditional downstream consequence: Analyst judgment: a matching reached client-protocol, authentication or native-memory flaw could conditionally affect caller data, credentials, integrity or availability. Process code execution needs a suitable flaw and matching build/input path. The remote server and other tenants are not thereby compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/rdkafka/6.0.5","https://pecl.php.net/package/rdkafka"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0580","name":"SSH2 native PHP client binding","vendor":"PHP SSH2 extension project","category":"PHP external extensions","version":"Not specified","summary":"The release provides PHP bindings to libssh2 for SSH2 and declares a PHP minimum.","scope":"Inventory record: PHP-0580\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 1.5.0: PHP >=8.0.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: SSH protocol support does not establish PHP in OpenSSH or another SSH server. Native crypto backend, authentication options and exact linked libssh2 version are unknown. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: SSH/SFTP client operations, remote server responses and configured credentials\nRelease pin: PECL release 1.5.0; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-ssh2, pecl:ssh2\nConditional downstream consequence: Analyst judgment: a matching reached client-protocol, authentication or native-memory flaw could conditionally affect caller data, credentials, integrity or availability. Process code execution needs a suitable flaw and matching build/input path. The remote server and other tenants are not thereby compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/ssh2/1.5.0","https://pecl.php.net/package/ssh2"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0581","name":"Event native PHP libevent binding","vendor":"PHP Event extension project","category":"PHP external extensions","version":"Not specified","summary":"The selected release exposes native libevent scheduling APIs. The PHP manual makes OpenSSL conditional on OpenSSL features.","scope":"Inventory record: PHP-0581\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 3.1.6: PHP >=5.4.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: libevent native library required; OpenSSL native library only for OpenSSL features. Other ext-* requirements unresolved\nLimitations: A release note about a future PHP alpha build is not proof of a stable PHP release or full compatibility. Native libevent/OpenSSL paths depend on actual selected features. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Configured I/O, timer, signal, HTTP/DNS and optional TLS event callbacks\nRelease pin: PECL release 3.1.6; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-event, pecl:event\nConditional downstream consequence: Analyst judgment: a matching reached event/callback/TLS integration flaw could conditionally crash or stall a worker, disclose process data or affect integrity. Input reachability, enabled feature and native build must match; no privilege or tenant-boundary crossing is assumed.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/event/3.1.6","https://pecl.php.net/package/event","https://www.php.net/manual/en/event.requirements.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0582","name":"Ev native PHP libev binding","vendor":"PHP Ev extension project","category":"PHP external extensions","version":"Not specified","summary":"The selected release exposes libev event-loop functionality to PHP and declares a PHP minimum.","scope":"Inventory record: PHP-0582\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 1.2.3: PHP >=8.0.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: Uses native libev code. The inspected release description does not establish bundled versus system-library delivery, build options or activation in a particular loop adapter. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Explicit libev event-loop, I/O, timer and signal watchers in PHP workers\nRelease pin: PECL release 1.2.3; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-ev, pecl:ev\nConditional downstream consequence: Analyst judgment: a matching reached event/callback/TLS integration flaw could conditionally crash or stall a worker, disclose process data or affect integrity. Input reachability, enabled feature and native build must match; no privilege or tenant-boundary crossing is assumed.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/ev/1.2.3","https://pecl.php.net/package/ev"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0583","name":"SMBClient native PHP Samba binding","vendor":"libsmbclient-php project","category":"PHP external extensions","version":"Not specified","summary":"The selected release provides PHP functions and smb streams using Samba’s libsmbclient.","scope":"Inventory record: PHP-0583\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 1.1.2: PHP >=5.3.7. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: No additional PHP extension is established as mandatory by the inspected evidence; this is not an exhaustive resolved list\nLimitations: Catalogue entry 1.2.0dev is labelled stable. This row scopes plain 1.1.2 instead; no assertion of a universally newest stable build. The client binding does not establish PHP in the SMB server or all Samba components. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Configured SMB shares, PHP smb streams, authentication and remote file data\nRelease pin: PECL release 1.1.2; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-smbclient, pecl:smbclient\nConditional downstream consequence: Analyst judgment: a matching reached client-protocol, authentication or native-memory flaw could conditionally affect caller data, credentials, integrity or availability. Process code execution needs a suitable flaw and matching build/input path. The remote server and other tenants are not thereby compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/smbclient/1.1.2","https://pecl.php.net/package/smbclient"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0584","name":"Mailparse native PHP MIME parser extension","vendor":"PHP Mailparse extension project","category":"PHP external extensions","version":"Not specified","summary":"The selected release parses RFC822/MIME messages and still lists mbstring. The official installation manual requires mbstring to load first.","scope":"Inventory record: PHP-0584\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 3.2.0: PHP >=7.3.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: mbstring required and loaded before mailparse; native/vendored encoding-code contents not fully resolved\nLimitations: The release notes vendor encoding-conversion code from mbstring; that does not remove the declared mbstring dependency. No particular mail server, incoming message path or memory flaw is inferred. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: PHP email/MIME parsing workers, message bodies, headers and attachments\nRelease pin: PECL release 3.2.0; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-mailparse, pecl:mailparse\nConditional downstream consequence: Analyst judgment: a matching reached MIME/message/encoding parser flaw could conditionally disclose worker data, deny service or, for a suitable memory flaw, execute code with worker privileges. Message delivery alone does not prove a vulnerable API path.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/mailparse/3.2.0","https://pecl.php.net/package/mailparse","https://www.php.net/manual/en/mailparse.installation.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0585","name":"OAuth native PHP consumer extension","vendor":"PHP OAuth extension project","category":"PHP external extensions","version":"Not specified","summary":"The selected release identifies an OAuth consumer extension and requires hash, now part of PHP core.","scope":"Inventory record: PHP-0585\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: Selected 2.0.10: PHP >=7.1.0. Declared minimum is not proof of support for every newer PHP release or upstream security maintenance.\nExtensions: hash required by declared metadata; HTTP/native transport and full build options unresolved\nLimitations: A consumer binding does not establish PHP in a remote authorization/resource server or every OAuth implementation. hash being in core is not proof of a separately installed module. Optional installation is not default PHP presence. Exact ABI, native build, loaded options, reachable inputs, process privileges and deployment totals were not measured. No specific PHP CVE was supplied; no vulnerability or compromise is inferred.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Configured client signing/authorization operations and credentials\nRelease pin: PECL release 2.0.10; source/archive bytes, signatures and installed ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-oauth, pecl:oauth\nConditional downstream consequence: Analyst judgment: a matching reached client-protocol, authentication or native-memory flaw could conditionally affect caller data, credentials, integrity or availability. Process code execution needs a suitable flaw and matching build/input path. The remote server and other tenants are not thereby compromised.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/oauth/2.0.10","https://pecl.php.net/package/oauth"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0586","name":"GnuPG native PHP GPGME binding","vendor":"PHP gnupg extension project","category":"PHP external extensions","version":"Not specified","summary":"Selected release identifies a GPGME binding and fixes PHP 8.5 and GPGME 2.0 build compatibility.","scope":"Inventory record: PHP-0586\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: gnupg 1.5.4: declared PHP>=5.3.2; release notes fix PHP 8.5 and GPGME>=2.0 build failures. Declaration is not support for every PHP ABI.\nExtensions: No additional ext-* requirement established; native GPGME required. GnuPG engine is a separate native dependency.\nLimitations: PHP manual requires GPGME. Its 13-year-old user note about 1.3.2 is not current release support evidence. Keyrings and native engines are separate from PHP package presence. Optional installation is not default PHP presence. Actual build, ABI, loaded state, reachable input, privileges and deployments are unknown. No specific PHP CVE supplied.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Configured cryptographic operations, caller-process data and accessible keyring material\nRelease pin: PECL gnupg 1.5.4; source/archive bytes and native versions unverified\nSource accessed: 2026-10-18\nAliases: ext-gnupg, pecl:gnupg\nConditional downstream consequence: Analyst judgment: a matching reached crypto/parser/native-memory flaw or unsafe keyring operation could conditionally affect confidentiality, signature/integrity decisions, keys or caller availability. Process code execution requires a suitable flaw and matching native build/input path. Cryptographic bypass or key theft is not established by module presence.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/gnupg/1.5.4","https://www.php.net/manual/en/gnupg.requirements.php","https://www.gnupg.org/software/gpgme/index.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0587","name":"Couchbase native PHP SDK extension","vendor":"Couchbase, Inc.","category":"PHP external extensions","version":"Not specified","summary":"Version 4.5.0 is a PHP client extension. Vendor notes update its native C++ core to 1.3.1 and drop PHP 8.1 support despite the registry minimum.","scope":"Inventory record: PHP-0587\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: PECL couchbase4.5.0 declares PHP>=8.1.0. Vendor 4.5.0 notes drop PHP 8.1 support and list PHP 8.2–8.5 binaries; declared installability and supported builds differ.\nExtensions: JSON capability required (core in PHP>=8.0); native C++ core and OpenSSL are separate from ext-* requirements.\nLimitations: Server and Capella backends are not inferred to run PHP. Current installation guide retains June2024 support wording and an Alpine libcouchbase mention; neither overrides selected4.5.0 C++ core evidence. PECL Windows binaries and vendor CI binaries are not guaranteed identical. Optional installation is not default PHP presence. Actual build, ABI, loaded state, reachable input, privileges and deployments are unknown. No specific PHP CVE supplied.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Calling application document/query operations, configured database credentials and telemetry\nRelease pin: Couchbase 4.5.0; vendor-declared source SHA256 f31385068fc197516012eed85baf732eb58186a95a1d6da09ca03859f0b71747 (archive and signature not verified)\nSource accessed: 2026-10-18\nAliases: ext-couchbase, pecl:couchbase\nConditional downstream consequence: Analyst judgment: a matching reached SDK protocol/parser, TLS-validation or native-memory flaw could conditionally affect caller data, database credentials, integrity or availability. Code execution requires a suitable flaw and matching build/input. Database actions depend on configured permissions; remote database compromise, tenant escape and lateral movement are not established.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/couchbase/4.5.0","https://docs.couchbase.com/php-sdk/current/project-docs/sdk-release-notes.html","https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html","https://packages.couchbase.com/clients/php/couchbase-4.5.0.sha256.txt"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0588","name":"Gearman native PHP client and worker extension","vendor":"PHP Gearman extension project","category":"PHP external extensions","version":"Not specified","summary":"Selected 2.2.1 exposes libgearman clients/workers and declares PHP 7.2.0 through 8.6.99.","scope":"Inventory record: PHP-0588\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native extension in a compatible PHP process; web/CLI SAPI and installed build not measured\nPHP version scope: gearman 2.2.1: PHP>=7.2.0 and <=8.6.99 declared; upper bound is a package constraint, not a tested/security-support guarantee.\nExtensions: No additional ext-* requirement established. Manual lists libgearman, libevent and UUID libraries plus a separately running Gearman server.\nLimitations: A PHP client/worker is distinct from gearmand itself. Manual native requirements are moving family documentation, not verified2.2.1 linkage; UUID provider/platform details remain unknown. Optional installation is not default PHP presence. Actual build, ABI, loaded state, reachable input, privileges and deployments are unknown. No specific PHP CVE supplied.\nPatch owner: Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart\nDownstream surface: Configured task payloads and PHP worker callback privileges\nRelease pin: PECL gearman 2.2.1; source/archive bytes, native versions and ABI unverified\nSource accessed: 2026-10-18\nAliases: ext-gearman, pecl:gearman\nConditional downstream consequence: Analyst judgment: a matching reached task-protocol/native parser flaw could conditionally disclose data, deny service or corrupt/execute in the caller. Worker effects depend on callback implementation and privileges. Presence does not prove an unsafe job, compromised gearmand or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Extension maintainers for binding code; native-library upstream where applicable; OS/image/binary publisher and application operator for compatible rebuild, rollout and restart","links":["https://pecl.php.net/package/gearman/2.2.1","https://www.php.net/manual/en/gearman.requirements.php"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0589","name":"Couchbase PHP Composer SDK package","vendor":"Couchbase, Inc.","category":"SDKs and integrations","version":"Not specified","summary":"The 4.5.0 userland package requires JSON; sockets is require-dev, while gRPC/Protobuf are suggestions.","scope":"Inventory record: PHP-0589\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0587\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 4.5.0 selected registry has no direct php constraint displayed; native 4.5.0 and transitive support apply separately.\nExtensions: Runtime require: json. Dev-only: sockets. Suggests: grpc^1.15 and protobuf^3.21; not mandatory runtime declarations.\nLimitations: This caller-side package does not establish PHP in Couchbase Server, Capella, an OpenTelemetry collector or any remote service. Composer runtime requirements, require-dev and suggestions remain separate. No installation, resolved transitive graph, loaded extension, input reachability or deployment count was measured. No CVE supplied.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Calling application, configured API data and credentials; remote service implementation not inferred\nRelease pin: Registry 4.5.0 advertises source 41d3b2bd484d8a823d7b236df9b7973021237f3d; source bytes/signature unverified\nSource accessed: 2026-10-18\nAliases: couchbase/couchbase\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/couchbase/couchbase","https://docs.couchbase.com/php-sdk/current/project-docs/sdk-full-installation.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0590","name":"Couchbase PHP OpenTelemetry integration","vendor":"Couchbase, Inc.","category":"SDKs and integrations","version":"Not specified","summary":"The integration requires PHP>=8.2, couchbase/couchbase^4.5, open-telemetry/api^1.0 and exporter-otlp^1.4.","scope":"Inventory record: PHP-0590\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0589\nEvidence status: Optional integration\nDeployment status: Not measured\nPHP surface: Userland PHP package in a web, worker or CLI caller; actual SAPI unspecified\nPHP version scope: 4.5.0: PHP>=8.2; package selected voluntarily for tracing/metrics integration.\nExtensions: No direct ext-* requirement in inspected runtime metadata; native SDK requirements remain functional/transitive. Dev SDK/http/test tools are not runtime requirements.\nLimitations: This caller-side package does not establish PHP in Couchbase Server, Capella, an OpenTelemetry collector or any remote service. Composer runtime requirements, require-dev and suggestions remain separate. No installation, resolved transitive graph, loaded extension, input reachability or deployment count was measured. No CVE supplied.\nPatch owner: SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout\nDownstream surface: Configured caller-side tracing/metrics and the permissions/data exposed by that instrumentation\nRelease pin: Registry 4.5.0 advertises source 403c79e0d7e81150948637311c19bfeea5996c56; source bytes/signature unverified\nSource accessed: 2026-10-18\nAliases: couchbase/couchbase-opentelemetry\nConditional downstream consequence: If a matching PHP/runtime or enabled native-extension flaw is reached by this caller's configured input or API-response path, information disclosure, denial of service, code execution or integrity loss could affect the calling process and credentials. API actions depend on granted permissions. This is not evidence of a vulnerability in the remote service, tenant escape or lateral movement.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Optional PHP path; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Optional PHP path; CVE match unknown\nCVE-2026-109619: Optional PHP path; CVE match unknown\nCVE assessment limit: Requires the specific PHP integration to be configured and invoked. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"SDK/package publisher for library fixes; calling application owner and PHP/OS/image maintainer for dependency selection, runtime and rollout","links":["https://packagist.org/packages/couchbase/couchbase-opentelemetry"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Optional PHP path; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0591","name":"Ubuntu Noble php8.3-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"8.3.6-0ubuntu0.24.04.13","summary":"Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13.","scope":"Inventory record: PHP-0591\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary; CLI is a separate required package, not the same SAPI\nPHP version scope: Ubuntu USN-8948-1 fixes Noble php8.3-fpm at 8.3.6-0ubuntu0.24.04.13; published package metadata, not a measured installed build.\nExtensions: Requires php8.3-opcache and CLI packages; php8.3-common exactly 8.3.6-0ubuntu0.24.04.13. PEAR is suggested. Dependency presence does not prove a loaded extension.\nLimitations: Combined architecture page lists different zlib floors for armhf and other targets. Vendor backports, Ubuntu pocket/component and support entitlement must be matched. Native package declarations are not loaded-library measurements. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges and deployments are not measured.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-1; php8.3-fpm 8.3.6-0ubuntu0.24.04.13; noble-updates/universe\nSource accessed: 2026-10-21\nAliases: ubuntu:noble-updates/php8.3-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13.\nCVE-2026-109618: Fixed in php8.3-fpm 8.3.6-0ubuntu0.24.04.13\nCVE-2026-109619: Fixed in php8.3-fpm 8.3.6-0ubuntu0.24.04.13\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://packages.ubuntu.com/noble-updates/php8.3-fpm","https://ubuntu.com/security/notices/USN-8948-1"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.3 packages for affected Ubuntu 24.04 LTS systems."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.3 packages for affected Ubuntu 24.04 LTS systems."}}},{"id":"PHP-0592","name":"SUSE SLE BCI PHP CLI container","vendor":"SUSE","category":"Containers and distribution","version":"Not specified","summary":"Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0592\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP interpreter entrypoint for scripts/commands; CLI use is explicit, not an exposed web listener\nPHP version scope: Dated 12 September 2026 notice: bci/php:8.3.33-26.4. Moving catalogue latest has an independently advertised digest.\nExtensions: Optional php8-gd/php8-intl RPM examples. docker-php-ext-install uses zypper; other named compatibility helpers are no-ops. PECL interoperability/support not guaranteed.\nLimitations: The dated notice is not the current complete package inventory or a PHP core patch verdict. Same helper names do not imply the source-built Docker Official PHP image. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges, deployments and vulnerabilities are not measured. No research code/package/image was installed, built, imported or executed.\nPatch owner: SUSE for RPM/image rebuilds; derived-image publisher and operator for rebuild, rollout and process restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: bci/php:8.3.33-26.4 (SUSE-CU-2026:10111-1); catalogue latest digest linkage/bytes unverified\nSource accessed: 2026-10-19\nAliases: registry.suse.com/bci/php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"SUSE for RPM/image rebuilds; derived-image publisher and operator for rebuild, rollout and process restart","links":["https://registry.suse.com/repositories/bci-php","https://lists.suse.com/pipermail/sle-container-updates/2026-September/012564.html","https://www.suse.com/security/cve/CVE-2026-109618.html","https://www.suse.com/security/cve/CVE-2026-109619.html"],"cves":{"CVE-2026-109618":{"status":"Not vuln","notes":"SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html"},"CVE-2026-109619":{"status":"Not vuln","notes":"SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html"}}},{"id":"PHP-0593","name":"SUSE SLE BCI PHP-Apache container","vendor":"SUSE","category":"Containers and distribution","version":"Not specified","summary":"Official vendor assessment: Not vuln for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0593\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Apache web server with mod_php, not the separate FPM image\nPHP version scope: Dated 12 September 2026 notice: bci/php-apache:8.3.33-26.6. Moving catalogue latest digest separately observed.\nExtensions: Optional gd/intl RPM examples; compatibility helpers do not establish an identical module list to Docker Official Images. PECL support not guaranteed.\nLimitations: Apache/mod_php mode is distinct from FPM and CLI. Tags, base lineage, image changes and actual runtime contents can overlap. A security image notice is not proof of a PHP core fix. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges, deployments and vulnerabilities are not measured. No research code/package/image was installed, built, imported or executed.\nPatch owner: SUSE for RPM/image rebuilds; derived-image publisher and operator for rebuild, rollout and process restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: bci/php-apache:8.3.33-26.6 (SUSE-CU-2026:10103-1); catalogue digest linkage/bytes unverified\nSource accessed: 2026-10-19\nAliases: registry.suse.com/bci/php-apache\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"SUSE for RPM/image rebuilds; derived-image publisher and operator for rebuild, rollout and process restart","links":["https://registry.suse.com/repositories/bci-php-apache","https://lists.suse.com/pipermail/sle-container-updates/2026-September/012562.html","https://www.suse.com/security/cve/CVE-2026-109618.html","https://www.suse.com/security/cve/CVE-2026-109619.html"],"cves":{"CVE-2026-109618":{"status":"Not vuln","notes":"SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html"},"CVE-2026-109619":{"status":"Not vuln","notes":"SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image digests.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://www.suse.com/security/cve/CVE-2026-109618.html; https://www.suse.com/security/cve/CVE-2026-109619.html"}}},{"id":"PHP-0594","name":"Gentoo dev-lang/php runtime package family","vendor":"Gentoo PHP maintainers","category":"Containers and distribution","version":"dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot","summary":"Official vendor assessment: Fix for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0594\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: USE-selected CLI, FPM, CGI, Apache, embed and phpdbg modes; actual enabled build unknown\nPHP version scope: Package catalogue lists 8.5.11, 8.4.26, 8.3.35, 8.3.33, 8.2.34 and 8.2.33; architecture keyword/testing status differs.\nExtensions: USE flags select native/core extensions and SAPIs. Catalogue plus-sign defaults are not proof of host-selected or loaded features.\nLimitations: For example, 8.5.11 is ~amd64 while 8.3.35 is amd64 in the observed table. This is not a blanket newest-stable recommendation. Exact ebuild dependency conditions and user USE overrides remain unresolved. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges, deployments and vulnerabilities are not measured. No research code/package/image was installed, built, imported or executed.\nPatch owner: Gentoo maintainers for ebuilds/patches; operator for architecture keywords, USE selection, rebuild and runtime restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Selected version catalogue; 8.5.11 ebuild retrieval failed, no immutable ebuild/build pin\nSource accessed: 2026-10-19\nAliases: gentoo:dev-lang/php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nPublic vendor CVE review: 2026-10-21\nVendor advisory sources: https://security.gentoo.org/glsa/202610-02\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Gentoo maintainers for ebuilds/patches; operator for architecture keywords, USE selection, rebuild and runtime restart","links":["https://packages.gentoo.org/packages/dev-lang/php","https://security.gentoo.org/glsa/202610-02"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://security.gentoo.org/glsa/202610-02\nAction statement: Sync the package repository and upgrade the installed PHP slots to the GLSA's corrected versions; restart serving processes."},"CVE-2026-109619":{"status":"Fix","notes":"Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures.","action":"","detail":"Public vendor assessment reviewed 2026-10-21. Sources: https://security.gentoo.org/glsa/202610-02\nAction statement: Sync the package repository and upgrade the installed PHP slots to the GLSA's corrected versions; restart serving processes."}}},{"id":"PHP-0595","name":"Nixpkgs PHP runtime environments","vendor":"NixOS / Nixpkgs maintainers","category":"Containers and distribution","version":"Not specified","summary":"Nixpkgs documents a minimal PHP base wrapped with selected extensions and generated php.ini; PHP-built tools inherit their owning runtime.","scope":"Inventory record: PHP-0595\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Wrapped interpreter with generated php.ini; selected PHP-FPM pool or Apache integration; unwrapped runtime is separate\nPHP version scope: Official stable manual plus pinned wiki revision33628; exact nixpkgs revision, PHP version, platform and output not pinned\nExtensions: php.withExtensions/buildEnv selects extensions and configuration; adding a standalone memcached extension to systemPackages alone does not enable it.\nLimitations: Manual examples are configuration syntax, not available/supported version declarations. Wiki examples containing php74, php81 or php1 are not used as current runtime inventory. Host NixOS and every derivation do not thereby require PHP. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges, deployments and vulnerabilities are not measured. No research code/package/image was installed, built, imported or executed.\nPatch owner: Nixpkgs maintainers for package expressions; flake/derivation owner for pinned revision, rebuild/switch and service restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: NixOS wiki PHP oldid33628 read; stable manual is moving; no exact derivation/hash\nSource accessed: 2026-10-19\nAliases: nixpkgs:php, nixos:phpfpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Nixpkgs maintainers for package expressions; flake/derivation owner for pinned revision, rebuild/switch and service restart","links":["https://nixos.org/manual/nixpkgs/stable/","https://wiki.nixos.org/w/index.php?title=PHP&oldid=33628"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0596","name":"OpenBSD optional PHP package and ports family","vendor":"OpenBSD ports maintainers / PHP documentation team","category":"Containers and distribution","version":"Not specified","summary":"PHP documentation confirms split optional OpenBSD packages; dated7.9 release notes list four PHP source-version families.","scope":"Inventory record: PHP-0596\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Manual core package includes engine/FPM/gettext/iconv; Apache and database modules separately selected\nPHP version scope: OpenBSD7.9 release page, dated19 May2026, lists PHP8.2.30/8.3.30/8.4.20/8.5.5. Later security package state unknown.\nExtensions: Core-versus-separate-module packaging is documented; mysqli/imap examples are not default presence. Per-version package contents/activation unresolved.\nLimitations: A release-note package catalogue does not mean PHP is in every base installation. Manual installation examples, chroot notes and historical module names are not verified current package/ABI defaults. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges, deployments and vulnerabilities are not measured. No research code/package/image was installed, built, imported or executed.\nPatch owner: OpenBSD ports/package maintainers for package branch updates; operator for installed package selection, activation and daemon restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: OpenBSD7.9 release page dated19 May2026; later package/backport builds unverified\nSource accessed: 2026-10-19\nAliases: openbsd:php\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"OpenBSD ports/package maintainers for package branch updates; operator for installed package selection, activation and daemon restart","links":["https://www.php.net/manual/en/install.unix.openbsd.php","https://www.openbsd.org/79.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0597","name":"OpenWrt selectable PHP8 package family","vendor":"OpenWrt packages feed maintainers","category":"Containers and distribution","version":"Merged package recipes: master/openwrt-25.12 PHP 8.4.27; openwrt-24.10 PHP 8.3.36","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0597\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Separate CLI, CGI, FPM and Apache module binaries. php8 is configuration-only; php8-fastcgi adds startup configuration and depends on php8-cgi.\nPHP version scope: Merged package recipes: master/openwrt-25.12 PHP 8.4.27; openwrt-24.10 PHP 8.3.36\nExtensions: Recipe declares 43 selectable module packages and six base/runtime/startup targets; these are not 49 installed modules or devices. Feature conditions apply.\nLimitations: OpenWrt device or management UI is not inferred to use PHP. php8 alone contains configuration, while fastcgi is a startup wrapper using CGI. Build target existence does not prove a selected firmware binary, loaded module or active network service. Availability is not default installation. Exact installed bytes, loaded features, inputs, privileges, deployments and vulnerabilities are not measured. No research code/package/image was installed, built, imported or executed.\nPatch owner: OpenWrt feed/firmware maintainer for recipe/patches; firmware/image builder and device operator for selected packages, rebuild and service restart\nDownstream surface: Only installed PHP applications and jobs using a selected interpreter package; router/control-plane reachability and privilege unknown\nRelease pin: Merged package recipes: master/openwrt-25.12 PHP 8.4.27; openwrt-24.10 PHP 8.3.36\nSource accessed: 2026-10-22\nAliases: openwrt:php8-family\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: OpenWrt member-authored security update PRs explicitly name both CVEs and are merged into the named package-feed branches. This confirms fixed package source recipes, not a completed binary mirror or firmware rollout for every target. Devices without the optional PHP packages are outside this record's runtime scope.\nCVE-2026-109619: OpenWrt member-authored security update PRs explicitly name both CVEs and are merged into the named package-feed branches. This confirms fixed package source recipes, not a completed binary mirror or firmware rollout for every target. Devices without the optional PHP packages are outside this record's runtime scope.\nVendor advisory sources: https://github.com/openwrt/packages/pull/30844; https://github.com/openwrt/packages/pull/30845; https://github.com/openwrt/packages/pull/30847\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"OpenWrt feed/firmware maintainer for recipe/patches; firmware/image builder and device operator for selected packages, rebuild and service restart","links":["https://github.com/openwrt/packages/blob/master/lang/php8/Makefile","https://github.com/openwrt/packages/pull/30844","https://github.com/openwrt/packages/pull/30845","https://github.com/openwrt/packages/pull/30847"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"OpenWrt member-authored security update PRs explicitly name both CVEs and are merged into the named package-feed branches. This confirms fixed package source recipes, not a completed binary mirror or firmware rollout for every target. Devices without the optional PHP packages are outside this record's runtime scope.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/openwrt/packages/pull/30844; https://github.com/openwrt/packages/pull/30845; https://github.com/openwrt/packages/pull/30847\nAction statement: Build/install PHP packages from the corresponding updated branch and restart the selected PHP services; verify binary package availability and installed versions for the device target."},"CVE-2026-109619":{"status":"Fix","notes":"OpenWrt member-authored security update PRs explicitly name both CVEs and are merged into the named package-feed branches. This confirms fixed package source recipes, not a completed binary mirror or firmware rollout for every target. Devices without the optional PHP packages are outside this record's runtime scope.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/openwrt/packages/pull/30844; https://github.com/openwrt/packages/pull/30845; https://github.com/openwrt/packages/pull/30847\nAction statement: Build/install PHP packages from the corresponding updated branch and restart the selected PHP services; verify binary package availability and installed versions for the device target."}}},{"id":"PHP-0598","name":"Moodle4Mac complete installer family","vendor":"Moodle project / Ralf Krause","category":"Containers and distribution","version":"Not specified","summary":"Moodle publishes MAMP-based installers containing Apache, MySQL and PHP. The linked guide restricts them to local testing/development and documents modified environment checks.","scope":"Inventory record: PHP-0598\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0013\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled Apache/PHP local server; MAMP also contains a php executable per guide. Exact SAPI not pinned.\nPHP version scope: Catalogue example Moodle4Mac 5.3: MAMP 7.1 with PHP 8.3.9, Apache 2.4.58 and MySQL 8.0.35. Legacy version-labelled bundles are retained in the 34-entry catalogue, including 6.0dev as development-only.\nExtensions: Exact bundled required/optional/loaded extension inventory unknown; do not inherit moving application requirements as payload evidence\nLimitations: No installer/archive was downloaded, unpacked, imported or run. Published stack labels are not verified bytes, loaded extensions or a supported pair. This family overlaps Moodle and its runtime bundle parent; not a distinct deployment total. No installed system, reachable listener, affected build or compromise measured. The linked 5.3 guide says database-version checks are modified for 5.0–5.3/6.0dev and warns against production use. Passing a modified check does not establish upstream compatibility.\nPatch owner: Ralf Krause / Moodle4Mac packager for installer composition; MAMP and PHP maintainers for their components; operator for bundle/runtime replacement and restart\nDownstream surface: Only the selected installed local Moodle server and bundled interpreter\nRelease pin: Moving installer catalogue snapshot retrieved 2026-10-19; no installer digest or immutable complete SBOM verified\nSource accessed: 2026-10-19\nAliases: Moodle4Mac\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect the local server process if its build, loaded feature and reachable input match. Disclosure, DoS, integrity or code execution would be limited by actual privileges and configuration. Internet exposure, credential theft and host compromise are not established; updates require the bundle packager/operator, not merely updating Moodle application files.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Ralf Krause / Moodle4Mac packager for installer composition; MAMP and PHP maintainers for their components; operator for bundle/runtime replacement and restart","links":["https://download.moodle.org/macosx/","https://docs.moodle.org/503/en/Installation_Package_for_OS_X"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0599","name":"Moodle Windows complete installer family","vendor":"Moodle project / complete-installer packagers","category":"Containers and distribution","version":"Not specified","summary":"Moodle publishes Windows installers containing Apache, MySQL and PHP, built using XAMPP. Its catalogue warns of component requirements mismatches and against production use.","scope":"Inventory record: PHP-0599\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0013\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP included alongside Apache; exact SAPI and CLI binary inventory unverified\nPHP version scope: Catalogue example Moodle 5.3+: XAMPP v8.2.4-0 Portable (x64), with local_adminer listed. This is a bundle label, not a verified PHP patch. Thirty version-labelled entries, including 6.0dev and legacy packages, retained in the catalogue.\nExtensions: Exact bundled required/optional/loaded extension inventory unknown; do not inherit moving application requirements as payload evidence\nLimitations: No installer/archive was downloaded, unpacked, imported or run. Published stack labels are not verified bytes, loaded extensions or a supported pair. This family overlaps Moodle and its runtime bundle parent; not a distinct deployment total. No installed system, reachable listener, affected build or compromise measured. The 5.3+ listing and XAMPP label do not prove that the included interpreter meets Moodle 5.3 PHP >=8.3. Exact payload and support state remain unresolved. Catalogue warnings are attributed to Moodle, not independently established as global XAMPP maintenance status.\nPatch owner: Moodle complete-installer packager for installer composition; XAMPP and PHP component maintainers where supported; operator for replacing the local bundle/runtime and restarting processes\nDownstream surface: Only the selected installed local Moodle server and bundled interpreter\nRelease pin: Moving installer catalogue snapshot retrieved 2026-10-19; no installer digest or immutable complete SBOM verified\nSource accessed: 2026-10-19\nAliases: Moodle complete install packages for Windows\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect the local server process if its build, loaded feature and reachable input match. Disclosure, DoS, integrity or code execution would be limited by actual privileges and configuration. Internet exposure, credential theft and host compromise are not established; updates require the bundle packager/operator, not merely updating Moodle application files.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Moodle complete-installer packager for installer composition; XAMPP and PHP component maintainers where supported; operator for replacing the local bundle/runtime and restarting processes","links":["https://download.moodle.org/windows/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0600","name":"Synology PHP 5.6 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0600\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch5.6; first-listed build5.6.40-0131. 18 build folders; 10 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build5.6.40-0131; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php5.6-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP5.6/5.6.40-0131","https://archive.synology.com/download/Package/PHP5.6"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0601","name":"Synology PHP 7.0 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0601\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch7.0; first-listed build7.0.33-0131. 10 build folders; 10 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build7.0.33-0131; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php7.0-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP7.0/7.0.33-0131","https://archive.synology.com/download/Package/PHP7.0"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0602","name":"Synology PHP 7.2 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0602\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch7.2; first-listed build7.2.34-0131. 5 build folders; 10 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build7.2.34-0131; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php7.2-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP7.2/7.2.34-0131","https://archive.synology.com/download/Package/PHP7.2"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0603","name":"Synology PHP 7.3 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0603\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch7.3; first-listed build7.3.33-0173. 8 build folders; 5 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build7.3.33-0173; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php7.3-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP7.3/7.3.33-0173","https://archive.synology.com/download/Package/PHP7.3"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0604","name":"Synology PHP 7.4 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0604\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch7.4; first-listed build7.4.33-0140. 12 build folders; 2 SPK files in the selected build. Selected files carry a BSM marker; do not treat them as general DSM support.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. The sampled7.4 files are BSM-tagged; their product/model applicability remains unknown. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build7.4.33-0140; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php7.4-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP7.4/7.4.33-0140","https://archive.synology.com/download/Package/PHP7.4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0605","name":"Synology PHP 8.0 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0605\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch8.0; first-listed build8.0.30-0121. 6 build folders; 5 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build8.0.30-0121; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php8.0-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP8.0/8.0.30-0121","https://archive.synology.com/download/Package/PHP8.0"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0606","name":"Synology PHP 8.1 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0606\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch8.1; first-listed build8.1.34-0110. 4 build folders; 5 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build8.1.34-0110; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php8.1-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP8.1/8.1.34-0110","https://archive.synology.com/download/Package/PHP8.1"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0607","name":"Synology PHP 8.2 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0607\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch8.2; first-listed build8.2.30-0170. 5 build folders; 5 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build8.2.30-0170; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php8.2-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP8.2/8.2.30-0170","https://archive.synology.com/download/Package/PHP8.2"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0608","name":"Synology PHP 8.3 archived package family","vendor":"Synology","category":"Containers and distribution","version":"Not specified","summary":"The official archive publishes this named PHP package family and architecture/platform-labelled SPK files.","scope":"Inventory record: PHP-0608\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Archive branch8.3; first-listed build8.3.30-0050. 2 build folders; 5 SPK files in the selected build.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Confirmed relationship refers to the named archived distribution, including legacy branches, not current support or installation. All model/DSM minima, native ABI, loaded modules and exact payloads remain unverified. No SPK was downloaded, unpacked or executed.\nPatch owner: Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Synology archive build8.3.30-0050; file names and modification metadata only, no binary hash verified\nSource accessed: 2026-10-19\nAliases: synology:php8.3-package\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Synology for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://archive.synology.com/download/Package/PHP8.3/8.3.30-0050","https://archive.synology.com/download/Package/PHP8.3"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0609","name":"TerraMaster TOS6 Web Server optional PHP hosting","vendor":"TerraMaster","category":"Appliances and embedded","version":"Not specified","summary":"The Web Server guide documents optional PHP instances, virtual-host version selection and configurable extensions.","scope":"Inventory record: PHP-0609\nCategory: Appliances and embedded\nOriginal relationship: hosts\nRelationship direction: hosts_php_workloads\nParent component: TerraMaster TOS6\nEvidence status: Hosting support\nDeployment status: Not measured\nPHP surface: Configurable PHP instances attached to virtual hosts; server SAPI unverified\nPHP version scope: Versioned TOS6 guide allows choosing PHP versions and creating per-site PHP instances; available branches, PHP patches and firmware builds unspecified.\nExtensions: Xdebug is explicitly optional; other extension names and cache implementation not enumerated\nLimitations: Hosting support does not prove TOS or the management GUI is written in PHP. The guide’s virtual hosts do not establish tenant isolation or shared-process boundaries. Actual PHP/SAPI, package contents, selected extensions, Internet exposure and installations remain unknown.\nPatch owner: TerraMaster for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: TOS6-scoped public Web Server guide; firmware/runtime release pin unknown\nSource accessed: 2026-10-19\nAliases: terramaster:tos6-web-server-php-option\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Hosted PHP option; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Hosted PHP option; CVE match unknown\nCVE-2026-109619: Hosted PHP option; CVE match unknown\nCVE assessment limit: Selected customer PHP only. Activation and provider/control-plane PHP are not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"TerraMaster for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://help.terra-master.com/docs/TOS6/application/web-server"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Hosted PHP option; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0610","name":"QNAP PHP7.4 optional application before5.2 migration","vendor":"QNAP","category":"Containers and distribution","version":"Not specified","summary":"QNAP documents a separate PHP7.4 application and its firmware-transition disablement.","scope":"Inventory record: PHP-0610\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0425 / PHP-0426\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: Selected NAS PHP runtime; exact SAPI and active service identities unknown\nPHP version scope: Vendor FAQ: optional PHP7.4 app on QTS/QuTS hero5.1.x is disabled after upgrade to5.2.0 or later; not available in that later App Center scope. Exact PHP patch unknown.\nExtensions: Exact required/optional/loaded extension set unknown for the selected vendor payload\nLimitations: Historical-only describes the documented app lifecycle, not proof that every older NAS upgraded or uninstalled it. This app is distinct from built-in firmware PHP and container runtimes. The OpenSSL explanation is vendor-package-specific; no universal upstream PHP7.4 constraint or current affected-system claim.\nPatch owner: QNAP for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart\nDownstream surface: Only selected installed/configured NAS PHP workloads, not every NAS service or client\nRelease pin: Vendor FAQ last modified2024-11-19;5.1.x→5.2.0 transition, not an exact application binary\nSource accessed: 2026-10-19\nAliases: qnap:optional-php74-app\nConditional downstream consequence: Analyst judgment: a matching PHP flaw could affect a configured workload using this installed package and a loaded/reachable feature. Disclosure, DoS, integrity or code execution depend on the exact build, input path and privileges. Credentials, tenant crossing and host control are not established by catalogue availability.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"QNAP for package/firmware integration and distribution; PHP/component upstream for fixes; operator for compatible deployment and process restart","links":["https://www.qnap.com/en-us/how-to/faq/article/why-i-cannot-use-php-74-after-updating-qts-quts-hero-to-520"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0611","name":"Plesk plesk-engine internal PHP management runtime for Windows","vendor":"Plesk","category":"Hosting and cloud","version":"Not specified","summary":"Plesk confirms that all versions of the Windows internal UI engine component are affected; hotfixes are planned for Plesk Obsidian 18.0.80#11 and 18.0.81#4.","scope":"Inventory record: PHP-0611\nCategory: Hosting and cloud\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0029\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: PHP inside the Windows plesk-engine component; exact SAPI/threading and process identity unverified\nPHP version scope: Plesk's 21 October 2026 advisory states that all versions of the Windows internal UI engine component are affected and plans hotfixes as 18.0.80#11 and 18.0.81#4. Plesk's changelog names the Windows internal PHP runtime plesk-engine and previously pinned it to PHP 8.4.22 in Obsidian 18.0.79.\nExtensions: Internal Windows module/loader inventory unknown\nLimitations: The advisory table labels the Windows UI component as sw-engine while the changelog labels the Windows internal PHP runtime plesk-engine; this record maps those official Plesk descriptions to the same internal UI engine scope. Do not inherit the Linux sw-engine version or the separately dated hosted-handler patches. An internal runtime does not prove every panel daemon is PHP or always privileged. No installed payload, exposed management path or tenant escape was tested.\nPatch owner: WebPros / Plesk for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Plesk security advisory updated 2026-10-21; hotfixes planned as 18.0.80#11 and 18.0.81#4\nSource accessed: 2026-10-21\nAliases: plesk:windows-plesk-engine-php\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Confirmed affected by Plesk advisory for CVE-2026-109618 and CVE-2026-109619; hotfixes are planned but not yet released.\nCVE-2026-109618: Vulnerable\nCVE-2026-109619: Vulnerable\nCVE assessment limit: Installed build, configuration and reachable path need separate evidence.","owner":"WebPros / Plesk for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://docs.plesk.com/release-notes/obsidian/change-log/","https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4","action":"Apply Plesk Obsidian hotfix 18.0.80#11 or 18.0.81#4 when available.","detail":"Added from the Plesk security advisory updated 2026-10-21; the Plesk changelog names the Windows internal PHP runtime plesk-engine while the advisory table labels the Windows UI component sw-engine."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4","action":"Apply Plesk Obsidian hotfix 18.0.80#11 or 18.0.81#4 when available.","detail":"Added from the Plesk security advisory updated 2026-10-21; the Plesk changelog names the Windows internal PHP runtime plesk-engine while the advisory table labels the Windows UI component sw-engine."}}},{"id":"PHP-0612","name":"Blackfire deterministic PHP Probe native extension","vendor":"Blackfire / Platform.sh SAS doing business as Upsun","category":"PHP external extensions","version":"Not specified","summary":"Official docs identify the deterministic PHP probe as a C extension, separate from the agent and browser client.","scope":"Inventory record: PHP-0612\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: blackfire.so / PHP probe inside the instrumented PHP runtime, with agent communication\nPHP version scope: Probe changelog labels 2026.10.1 on 13 October 2026. The separate update page still showed 2026.9.1 during retrieval; no universal installed/latest-version inference.\nExtensions: This row identifies the optional native extension itself; complete host-module inventory unknown\nLimitations: Native probe, PHP SDK, continuous profiler, agent and browser extension have different component boundaries. Full PHP/OS/ABI matrix and extension interactions are unverified. A changelog fix is not a claim that every older build is externally exploitable. SaaS backend implementation remains unknown.\nPatch owner: Blackfire / Platform.sh SAS doing business as Upsun for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Dated probe changelog 2026.10.1, 2026-10-13; no downloaded probe hash\nSource accessed: 2026-10-19\nAliases: ext-blackfire, blackfire:deterministic-php-probe\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Blackfire / Platform.sh SAS doing business as Upsun for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://docs.blackfire.io/changelogs/php-probe","https://docs.blackfire.io/academy/getting-started/installation","https://docs.blackfire.io/up-and-running/update"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0613","name":"Blackfire PHP SDK client library","vendor":"Blackfire / Platform.sh SAS doing business as Upsun","category":"SDKs and integrations","version":"Not specified","summary":"The publisher registry identifies a PHP SDK with separate suggested ext-blackfire and ext-zlib capabilities.","scope":"Inventory record: PHP-0613\nCategory: SDKs and integrations\nOriginal relationship: SDK\nRelationship direction: php_client_for_service\nParent component: PHP-0612\nEvidence status: SDK-only\nDeployment status: Not measured\nPHP surface: Userland PHP SDK for profile control and API requests\nPHP version scope: Publisher registry v3.0.1, source date 28 July 2026: PHP >=5.3.0 and composer/ca-bundle ^1.0. Suggested modules are not Composer hard requirements.\nExtensions: Composer suggests ext-blackfire for its native probe and ext-zlib for remote-target configuration. Local profiling guide requires a configured probe/agent for that feature.\nLimitations: SDK-only does not confirm PHP in Blackfire’s remote service, CLI, browser extension or agent. Manifest suggestions and feature-specific prerequisites differ. No dependency solver, installed extension, API call or remote deployment measured.\nPatch owner: Blackfire SDK maintainers for PHP client releases; PHP/application owner for host runtime, dependency updates and client-job rollout\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Registry v3.0.1; advertised source ab81db5203e306b07c3e5f4251c22558a0889dd3, source bytes/signatures unverified\nSource accessed: 2026-10-19\nAliases: blackfire/php-sdk\nConditional downstream consequence: Analyst judgment: a matching local PHP/SDK flaw could affect the PHP client job and credentials available to it. Remote backend compromise, agent compromise and production reachability do not follow from this SDK relationship.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Caller PHP runtime only; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Caller PHP runtime only; CVE match unknown\nCVE-2026-109619: Caller PHP runtime only; CVE match unknown\nCVE assessment limit: Caller-side client boundary. The remote API/service implementation is not inferred. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Blackfire SDK maintainers for PHP client releases; PHP/application owner for host runtime, dependency updates and client-job rollout","links":["https://packagist.org/packages/blackfire/php-sdk","https://docs.blackfire.io/php/integrations/sdk"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Caller PHP runtime only; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0614","name":"Blackfire PHP continuous-profiler integration using Datadog profiling extension","vendor":"Datadog / Blackfire integration","category":"PHP external extensions","version":"Not specified","summary":"The guide loads datadog-profiling.so from a PHP_API_VERSION-specific path, separate from the deterministic Blackfire probe.","scope":"Inventory record: PHP-0614\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: DataDog/dd-trace-php profiling component\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: datadog-profiling.so matching PHP API/architecture, with Blackfire agent transport\nPHP version scope: Blackfire guide requires PHP >=8.2.0, NTS only and Blackfire Agent >=2.13.0. Its link leads to dd-trace-php releases; 1.26.0 was separately observed, not proven as a deployed or integration-tested selection.\nExtensions: Requires this profiling extension and a configured Blackfire agent; tracer enablement is a separate configuration.\nLimitations: Blackfire integration floors are not universal Datadog support limits. Do not merge continuous and deterministic probes or assume all dd-trace-php products are enabled. No chosen binary, digest, integration test, running profiler or service backend established.\nPatch owner: Datadog / Blackfire integration for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Moving Blackfire integration guide; dd-trace-php 1.26.0 release identity dated 2026-10-08 observed independently, no artifact pin\nSource accessed: 2026-10-19\nAliases: blackfire:datadog-php-continuous-profiler\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Datadog / Blackfire integration for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://docs.blackfire.io/continuous-profiling-cookbooks/php","https://github.com/DataDog/dd-trace-php/releases"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0615","name":"Tideways commercial PHP profiling extension","vendor":"Tideways GmbH","category":"PHP external extensions","version":"Not specified","summary":"Vendor requirements distinguish the PHP extension from its daemon and describe separate platform and libc scopes.","scope":"Inventory record: PHP-0615\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native PHP extension for mod_php, FPM/FastCGI, CGI, FrankenPHP or LSAPI, communicating to a separate daemon\nPHP version scope: Guide last labels its PHP list November 2025: 5.3-5.6, 7.0-7.4 and 8.0-8.5; NTS/ZTS. Download body lists five PHP-extension tarball names at 5.47.0; no package release date or byte verification.\nExtensions: This is the tideways extension, not the archived tideways_xhprof extension. Complete host modules unknown.\nLimitations: Requirements specify Linux/macOS and amd64/arm64; do not infer PHP-extension FreeBSD support from a separate daemon download. Legacy PHP compatibility is not PHP upstream security support. The extension does not itself listen on sockets according to the guide; actual configuration, agent implementation and SaaS backend remain unknown.\nPatch owner: Tideways GmbH for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Downloads observed 2026-10-19: PHP extension 5.47.0 filename labels only; requirements list dated November 2025\nSource accessed: 2026-10-19\nAliases: tideways:commercial-php-extension, ext-tideways\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Tideways GmbH for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://support.tideways.com/documentation/compatibility-and-requirements.html","https://tideways.com/profiler/downloads"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0616","name":"Excimer native PHP interrupting timer and sampling profiler","vendor":"Wikimedia / MediaWiki Platform maintainers","category":"PHP external extensions","version":"Not specified","summary":"Publisher PIE metadata identifies a C php-ext package; a fixed project-document revision explains the registry transition.","scope":"Inventory record: PHP-0616\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native excimer.so inside PHP, using engine interruption/timer APIs; CLI/web modes depend on deployment\nPHP version scope: PIE registry 1.2.7 dated 29 July 2026, README PHP 7.1+, NTS/ZTS declared. PECL 1.2.6 is a separate older catalogue entry. Registry OS “no restrictions” does not override project Linux/BSD/macOS requirements.\nExtensions: This row identifies the optional native extension itself; complete host-module inventory unknown\nLimitations: PIE and PECL are distribution channels for one component, not two deployment populations. A broad package OS flag is not proof of Windows support. No ABI matrix, installation, target app activation or observed fleet verified; native extension is not a MediaWiki-only userland plugin.\nPatch owner: Wikimedia / MediaWiki Platform maintainers for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: PIE 1.2.7 advertised source 23f541b9d970db0524a1b2506b4df727e5e59998; project doc revision 8546270 dated 2026-08-06; no source/binary verification\nSource accessed: 2026-10-19\nAliases: ext-excimer, wikimedia/excimer\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Wikimedia / MediaWiki Platform maintainers for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://packagist.org/packages/wikimedia/excimer","https://pecl.php.net/package/excimer/1.2.6","https://www.mediawiki.org/w/index.php?oldid=8546270&title=Excimer"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0617","name":"SPX native PHP profiling extension and built-in report UI","vendor":"Sylvain Lassaut / NoiseByNorthwest","category":"PHP external extensions","version":"Not specified","summary":"The maintainer README describes a loaded PHP extension with HTTP profiling/UI and CLI modes; build configuration links native zlib.","scope":"Inventory record: PHP-0617\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: spx.so within CLI/web PHP; spx.http_enabled defaults to 0 in the inspected guide\nPHP version scope: Moving master README: PHP 5.4-8.5, x86-64/arm64, Linux/macOS/FreeBSD; ZTS support labelled beta. Requested v0.4.22 pinned pages were unavailable, so no released-source pin is claimed.\nExtensions: This row identifies the optional native extension itself; complete host-module inventory unknown\nLimitations: The built-in browser UI does not run PHP in the browser; the extension serves/intercepts the web request. Experimental/ZTS limitations, HTTP key/proxy/allowlist controls and data storage matter. No public UI exposure, supported release payload, configured listener or vulnerability tested.\nPatch owner: Sylvain Lassaut / NoiseByNorthwest for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Moving master README/config.m4 only; v0.4.22 release/tag-source reads failed\nSource accessed: 2026-10-19\nAliases: noisebynorthwest/php-spx, ext-spx\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Sylvain Lassaut / NoiseByNorthwest for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://github.com/NoiseByNorthwest/php-spx/blob/master/README.md","https://github.com/NoiseByNorthwest/php-spx/blob/master/config.m4"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0618","name":"XHProf native PHP collection extension","vendor":"PECL XHProf / longxinH and contributors","category":"PHP external extensions","version":"Not specified","summary":"The release page separates a C data-collection extension from an all-PHP reporting layer.","scope":"Inventory record: PHP-0618\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Native XHProf collector inside the chosen PHP process\nPHP version scope: PECL release 2.3.10 is labelled stable and requires PHP >=7.0.0. Its release notes discuss PHP 8.4 compatibility; all newer PHP/ABI builds are not thereby established.\nExtensions: This row identifies the optional native extension itself; complete host-module inventory unknown\nLimitations: The collector and PHP reporting UI are separate rows within one package lineage. PEAR installer minimum is not a runtime extension. Do not merge the archived Tideways fork or assume every future PHP version is supported.\nPatch owner: PECL XHProf / longxinH and contributors for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: PECL XHProf 2.3.10 declaration; no tarball/DLL hash verification\nSource accessed: 2026-10-19\nAliases: ext-xhprof, longxinh:xhprof-native-collector\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"PECL XHProf / longxinH and contributors for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://pecl.php.net/package/xhprof/2.3.10"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0619","name":"XHProf PHP reporting and navigation UI","vendor":"PECL XHProf / longxinH and contributors","category":"Development and build","version":"Not specified","summary":"The publisher explicitly states that XHProf reporting/UI is PHP, distinct from the native collector.","scope":"Inventory record: PHP-0619\nCategory: Development and build\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0618\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side/userland PHP reporting code; browser visual output is not browser PHP\nPHP version scope: Reporting layer described on the XHProf 2.3.10 package page. Package PHP floor >=7.0.0; standalone UI dependency/hosting requirements remain incomplete.\nExtensions: Native xhprof is relevant to collection; reading a stored report does not by itself prove the collector is loaded.\nLimitations: UI presence, web serving, access controls and parser inputs are not measured. Collector data and UI deployments can be separated. Package and component rows overlap; no second installation or universal UI vulnerability inferred.\nPatch owner: XHProf project/package distributor for PHP reporting code; operator for runtime/code updates, report access controls and process rollout\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Same XHProf 2.3.10 package description as PHP-0618; no independent UI release verified\nSource accessed: 2026-10-19\nAliases: longxinh:xhprof-reporting-ui\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Dev/CI/admin scope; CVE match unknown. No affected deployment established.\nCVE-2026-109618: Dev/CI/admin scope; CVE match unknown\nCVE-2026-109619: Dev/CI/admin scope; CVE match unknown\nCVE assessment limit: Production-web exposure is not inferred from this tooling record. Credentials and reachable untrusted inputs can still make the tool important. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"XHProf project/package distributor for PHP reporting code; operator for runtime/code updates, report access controls and process rollout","links":["https://pecl.php.net/package/xhprof/2.3.10"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Dev/CI/admin scope; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0620","name":"Tideways XHProf archived native extension fork","vendor":"Tideways / open-source fork contributors","category":"PHP external extensions","version":"Not specified","summary":"Maintainer archive notice directs users to PECL XHProf and says this fork is not compatible with the commercial Tideways service.","scope":"Inventory record: PHP-0620\nCategory: PHP external extensions\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0618\nEvidence status: Historical-only\nDeployment status: Not measured\nPHP surface: tideways_xhprof.so native hierarchical profiling in legacy PHP processes\nPHP version scope: Repository archived 6 October 2023; archived README requires PHP >=7.0 and describes NTS/ZTS. No current maintenance or modern ABI compatibility claim.\nExtensions: This row identifies the optional native extension itself; complete host-module inventory unknown\nLimitations: The archive date is not proof all installations migrated or that the commercial Tideways extension ended. README API is not compatible with other XHProf variants, despite shared data format. Exact final ABI/support/installed legacy builds remain unknown.\nPatch owner: Tideways / open-source fork contributors for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart\nDownstream surface: Only PHP processes using this named component and their accessible data\nRelease pin: Repository archive banner dated 2023-10-06; no final source release/build pin\nSource accessed: 2026-10-19\nAliases: tideways/php-xhprof-extension, ext-tideways_xhprof\nConditional downstream consequence: Analyst judgment: a matching flaw in the loaded PHP/native component could affect its worker availability, readable profile/application data or execution identity when the relevant path is reached. ABI, mode, input reachability and privilege conditions must match. A profiler or agent does not establish root access, tenant escape, credentials exposure or compromise.\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: Historical scope; current use unknown. No affected deployment established.\nCVE-2026-109618: Historical scope; current use unknown\nCVE-2026-109619: Historical scope; current use unknown\nCVE assessment limit: Historical evidence does not prove retirement from every installation or that a current deployment is affected. Pre-release public-source review. Affected/fixed builds, SAPI/features and exploit prerequisites are not established. Installed version, backport, configuration and reachable path need separate evidence.","owner":"Tideways / open-source fork contributors for component fixes; package/image supplier for matching PHP ABI; operator for deployment and process restart","links":["https://github.com/tideways/php-xhprof-extension"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"Historical scope; current use unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0621","name":"Plesk for Linux","vendor":"Plesk","category":"Other","version":"All shipped PHP versions","summary":"Plesk confirms that all PHP versions shipped with Plesk for Linux are affected; patched versions are pending a PHP vendor fix.","scope":"Source: Plesk security advisory updated 2026-10-20\nAffected versions: All shipped PHP versions\nPatched versions: Pending fix from the PHP vendor\nImpact: Remote code execution is possible on affected PHP versions.","owner":"Verify with vendor","links":["https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: all PHP versions shipped with Plesk","action":"Apply fixed Plesk PHP packages when available from Plesk.","detail":"Added from the Plesk security advisory published 2026-10-20."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: all PHP versions shipped with Plesk","action":"Apply fixed Plesk PHP packages when available from Plesk.","detail":"Added from the Plesk security advisory published 2026-10-20."}}},{"id":"PHP-0622","name":"Plesk for Windows","vendor":"Plesk","category":"Other","version":"All shipped PHP versions","summary":"Plesk confirms that all PHP versions shipped with Plesk for Windows are affected; patched versions are pending a PHP vendor fix.","scope":"Source: Plesk security advisory updated 2026-10-20\nAffected versions: All shipped PHP versions\nPatched versions: Pending fix from the PHP vendor\nImpact: Remote code execution is possible on affected PHP versions.","owner":"Verify with vendor","links":["https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected: all PHP versions shipped with Plesk","action":"Apply fixed Plesk PHP packages when available from Plesk.","detail":"Added from the Plesk security advisory published 2026-10-20."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected: all PHP versions shipped with Plesk","action":"Apply fixed Plesk PHP packages when available from Plesk.","detail":"Added from the Plesk security advisory published 2026-10-20."}}},{"id":"PHP-0623","name":"PAN-OS","vendor":"Palo Alto Networks","category":"Appliances and embedded","version":"PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 (all builds) listed affected; fixed releases not yet announced","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0623\nEdge inventory record: EDGE-001\nCategory: Appliances and embedded\nScope group: Network/security appliance\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037 runtime family reference\nEvidence status: Confirmed relationship\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: Network firewall; scoped management interface\nPHP surface: 12.2 catalogue includes PHP; older-branch advisory identifies management PHP.\nPHP version scope: 12.2 list: PHP 8.0.30 plus related packages. Management-role advisory: 10.1/10.2/11.1/11.2 scopes.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: Do not transfer older management implementation to 12.2, or infer PHP in packet inspection/forwarding.\nPatch owner: Palo Alto Networks for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: If a matching reachable PHP function is compromised, readable settings/credentials or permitted management actions could be misused. Wider appliance control requires separate privilege/path evidence.\nPHP component loss: The PHP-dependent interface/workflow could be unavailable. Independent traffic processing or other services may continue; exact behaviour is not measured.\nWhole appliance loss: Stopping the whole firewall could interrupt traffic through it if an alternative path/failover does not preserve connectivity.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-21\nPublic vendor CVE review: 2026-10-21, re-checked 2026-10-22\nVendor advisory detail: Palo Alto Networks advisory (published 2026-10-21, CVSS 8.7 HIGH, urgency MODERATE): the issue strictly affects the management web interface (HTTPS web UI and XML API service). No fixed releases yet. Mitigations: limit management access to trusted internal IP addresses. Signature protection requires a Threat Prevention subscription, Applications and Threats content version 9162 or later, and Threat IDs 543004 and 97622-97625. MGT-bound traffic must pass through a dataplane (DP) port with the vendor-documented inbound-management certificate replacement, inbound TLS decryption, and Threat Prevention applied to that traffic. Frontier Virtual Patching (ATP Plus) provides Threat ID 543004 on PAN-OS 12.2.4 and later; these inspection prerequisites still apply. Signature coverage is a mitigation, not a software fix. No known malicious exploitation. Cloud NGFW, Prisma Access, GlobalProtect App and Cortex products are listed as unaffected.\nVendor advisory sources: https://security.paloaltonetworks.com/CVE-2026-109618\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Palo Alto Networks for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://docs.paloaltonetworks.com/oss-listings/pan-os-oss-listings/pan-os-12-2-open-source-software-oss-listing","https://security.paloaltonetworks.com/CVE-2025-0108","https://security.paloaltonetworks.com/CVE-2026-109618"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.","action":"Limit HTTPS web UI and XML API access to trusted internal IP addresses and monitor the advisory for fixed releases. For signature mitigation, a Threat Prevention subscription and Applications and Threats content version 9162 or later are required; enable Threat IDs 543004 and 97622-97625. Route MGT-bound traffic through a dataplane (DP) port, replace the inbound-management certificate as documented by the vendor, configure inbound TLS decryption for inspection, and apply Threat Prevention to that management traffic. Frontier Virtual Patching (ATP Plus) provides Threat ID 543004 on PAN-OS 12.2.4 and later; the traffic inspection prerequisites still apply. These mitigations do not constitute a software fix.","detail":"Public vendor assessment reviewed 2026-10-21 and re-checked 2026-10-22. Affected scope: PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 and all Panorama versions; management web interface only. Sources: https://security.paloaltonetworks.com/CVE-2026-109618"},"CVE-2026-109619":{"status":"Vulnerable","notes":"Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.","action":"Limit HTTPS web UI and XML API access to trusted internal IP addresses and monitor the advisory for fixed releases. For signature mitigation, a Threat Prevention subscription and Applications and Threats content version 9162 or later are required; enable Threat IDs 543004 and 97622-97625. Route MGT-bound traffic through a dataplane (DP) port, replace the inbound-management certificate as documented by the vendor, configure inbound TLS decryption for inspection, and apply Threat Prevention to that management traffic. Frontier Virtual Patching (ATP Plus) provides Threat ID 543004 on PAN-OS 12.2.4 and later; the traffic inspection prerequisites still apply. These mitigations do not constitute a software fix.","detail":"Public vendor assessment reviewed 2026-10-21 and re-checked 2026-10-22. Affected scope: PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 and all Panorama versions; management web interface only. Sources: https://security.paloaltonetworks.com/CVE-2026-109618"}}},{"id":"PHP-0624","name":"NetScaler ADC","vendor":"Citrix / NetScaler","category":"Appliances and embedded","version":"All supported NetScaler software versions impacted; fixed PHP package pending","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619 in the PHP-based NetScaler Management Portal; fixed package pending.","scope":"Inventory record: PHP-0624\nEdge inventory record: EDGE-002\nCategory: Appliances and embedded\nScope group: Network/security appliance\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037 runtime family reference\nEvidence status: Vendor-confirmed affected product scope\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: Application delivery and appliance administration\nPHP surface: NetScaler Product Security states that the NetScaler Management Portal uses PHP; affected management access includes the NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI.\nPHP version scope: All supported NetScaler software versions are impacted; Citrix is working to upgrade the PHP software package to a fixed version.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: This assessment is limited to PHP-based management access. NetScaler Console (Service and on premises) and NetScaler SVM are not impacted; do not extend it to all Gateway login/VPN or data-plane paths.\nPatch owner: Citrix / NetScaler for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: If a matching reachable PHP function is compromised, readable settings/credentials or permitted management actions could be misused. Wider appliance control requires separate privilege/path evidence.\nPHP component loss: The PHP-dependent interface/workflow could be unavailable. Independent traffic processing or other services may continue; exact behaviour is not measured.\nWhole appliance loss: Whole-ADC shutdown could interrupt published applications or configured remote-access services unless another path/failover maintains them.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-22\nPublic vendor CVE review: 2026-10-22\nVendor advisory sources: https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/\nVulnerability status: Vendor bulletin 2026-10-21: NetScaler is impacted by both CVEs through the PHP-based Management Portal; a fixed PHP package is pending.\nCVE-2026-109618: Affected in all supported NetScaler software versions for PHP-based management access; fixed PHP package pending\nCVE-2026-109619: Affected in all supported NetScaler software versions for PHP-based management access; fixed PHP package pending\nCVE assessment limit: The VEX relationships state the current vendor-confirmed management-interface scope. Installed builds, runtime activation, access control and deployment were not tested.","owner":"Citrix / NetScaler for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://www.citrix.com/content/dam/citrix/en_us/documents/downloads/netscaler-adc/NetScaler_ADC_ADM_FreeBSD_14.1_Third_Party_Notices.pdf","https://prod-docs.netscaler.com/en-us/citrix-adc/current-release/application-firewall/signatures/signature-auto-update","https://community.citrix.com/techzone-blogs/110_security-updates/protecting-netscaler-management-access-from-php-cve-2026-109618-cve-2026-109619-r1640/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"NetScaler says its PHP-based Management Portal is impacted in all supported software versions; fix pending. Scope is the NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI; Console and SVM are not impacted.","action":"","detail":"Added from NetScaler Product Security guidance published 2026-10-21 and reviewed 2026-10-22. The vendor says the PHP-based Management Portal is impacted in all supported NetScaler software versions and scopes exposure to NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI. NetScaler Console and SVM are excluded.\nAction statement: Restrict NetScaler management GUI/API access on NSIP, management-enabled SNIPs and Cluster IPs to trusted administrative networks only; keep management interfaces off the Internet and verify authorized admin access remains available."},"CVE-2026-109619":{"status":"Vulnerable","notes":"NetScaler says its PHP-based Management Portal is impacted in all supported software versions; fix pending. Scope is the NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI; Console and SVM are not impacted.","action":"","detail":"Added from NetScaler Product Security guidance published 2026-10-21 and reviewed 2026-10-22. The vendor says the PHP-based Management Portal is impacted in all supported NetScaler software versions and scopes exposure to NSIP GUI, management-enabled SNIP GUI and Cluster IP GUI. NetScaler Console and SVM are excluded.\nAction statement: Restrict NetScaler management GUI/API access on NSIP, management-enabled SNIPs and Cluster IPs to trusted administrative networks only; keep management interfaces off the Internet and verify authorized admin access remains available."}}},{"id":"PHP-0625","name":"Panorama","vendor":"Palo Alto Networks","category":"Appliances and embedded","version":"All Panorama versions listed affected; fixed releases not yet announced","summary":"Official vendor assessment: Vulnerable for CVE-2026-109618 and CVE-2026-109619; see the scoped VEX assessment and advisory references.","scope":"Inventory record: PHP-0625\nEdge inventory record: EDGE-003\nCategory: Appliances and embedded\nScope group: Adjacent central management\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037 runtime family reference\nEvidence status: Confirmed relationship\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: Central firewall configuration, updates and logging\nPHP surface: 12.2 catalogue includes PHP; its precise active function is not established.\nPHP version scope: 12.2 list: PHP 8.0.30; CLI, embedded, FPM and related packages. No firmware digest.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: A central manager can affect several devices, but this does not establish equivalent authority for its PHP process.\nPatch owner: Palo Alto Networks for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: Only if the affected PHP function has access to management data/actions could those be misused. The PHP-to-controller permission path is unknown.\nPHP component loss: Unknown: package inclusion does not identify the PHP-dependent management or logging function.\nWhole appliance loss: Whole-manager shutdown could obstruct central changes, updates or logging. It does not establish that every managed firewall stops forwarding.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-21\nPublic vendor CVE review: 2026-10-21, re-checked 2026-10-22\nVendor advisory detail: Palo Alto Networks advisory (published 2026-10-21, CVSS 8.7 HIGH, urgency MODERATE): the issue strictly affects the management web interface (HTTPS web UI and XML API service). No fixed releases yet. Mitigations: limit management access to trusted internal IP addresses. Signature protection requires a Threat Prevention subscription, Applications and Threats content version 9162 or later, and Threat IDs 543004 and 97622-97625. MGT-bound traffic must pass through a dataplane (DP) port with the vendor-documented inbound-management certificate replacement, inbound TLS decryption, and Threat Prevention applied to that traffic. Frontier Virtual Patching (ATP Plus) provides Threat ID 543004 on PAN-OS 12.2.4 and later; these inspection prerequisites still apply. Signature coverage is a mitigation, not a software fix. No known malicious exploitation. Cloud NGFW, Prisma Access, GlobalProtect App and Cortex products are listed as unaffected.\nVendor advisory sources: https://security.paloaltonetworks.com/CVE-2026-109618\nCVE assessment limit: The VEX relationships state the current vendor-confirmed scope. Earlier inventory context describes dependency evidence only; installed builds, runtime activation and deployment were not tested.","owner":"Palo Alto Networks for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://docs.paloaltonetworks.com/oss-listings/panorama-oss-listings/panorama-12-2-open-source-software-oss-listing","https://docs.paloaltonetworks.com/panorama/getting-started/panorama-overview/about-panorama","https://security.paloaltonetworks.com/CVE-2026-109618"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.","action":"Limit HTTPS web UI and XML API access to trusted internal IP addresses and monitor the advisory for fixed releases. For signature mitigation, a Threat Prevention subscription and Applications and Threats content version 9162 or later are required; enable Threat IDs 543004 and 97622-97625. Route MGT-bound traffic through a dataplane (DP) port, replace the inbound-management certificate as documented by the vendor, configure inbound TLS decryption for inspection, and apply Threat Prevention to that management traffic. Frontier Virtual Patching (ATP Plus) provides Threat ID 543004 on PAN-OS 12.2.4 and later; the traffic inspection prerequisites still apply. These mitigations do not constitute a software fix.","detail":"Public vendor assessment reviewed 2026-10-21 and re-checked 2026-10-22. Affected scope: PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 and all Panorama versions; management web interface only. Sources: https://security.paloaltonetworks.com/CVE-2026-109618"},"CVE-2026-109619":{"status":"Vulnerable","notes":"Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is added.","action":"Limit HTTPS web UI and XML API access to trusted internal IP addresses and monitor the advisory for fixed releases. For signature mitigation, a Threat Prevention subscription and Applications and Threats content version 9162 or later are required; enable Threat IDs 543004 and 97622-97625. Route MGT-bound traffic through a dataplane (DP) port, replace the inbound-management certificate as documented by the vendor, configure inbound TLS decryption for inspection, and apply Threat Prevention to that management traffic. Frontier Virtual Patching (ATP Plus) provides Threat ID 543004 on PAN-OS 12.2.4 and later; the traffic inspection prerequisites still apply. These mitigations do not constitute a software fix.","detail":"Public vendor assessment reviewed 2026-10-21 and re-checked 2026-10-22. Affected scope: PAN-OS 12.2, 12.1, 11.2, 11.1, 10.2 and all Panorama versions; management web interface only. Sources: https://security.paloaltonetworks.com/CVE-2026-109618"}}},{"id":"PHP-0626","name":"BIG-IP TMOS platform PHP","vendor":"F5","category":"Appliances and embedded","version":"BIG-IP (all modules) 21.x and 17.x under investigation; no affected/fixed release confirmed","summary":"F5 K000163821 lists BIG-IP (all modules) 21.x and 17.x under investigation for CVE-2026-109618 and CVE-2026-109619; confirmation of vulnerability or non-vulnerability is not yet available.","scope":"Inventory record: PHP-0626\nEdge inventory record: EDGE-004\nCategory: Appliances and embedded\nScope group: Platform component\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037 runtime family reference\nEvidence status: Vendor advisory under investigation\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: Appliance platform; administration uploads indicated\nPHP surface: Official issue record confirms PHP in BIG-IP; administration-upload role is described in indexed vendor text.\nPHP version scope: F5 issue ID1270257 confirms a BIG-IP PHP component, while K000163821 lists BIG-IP (all modules) 21.x and 17.x with research placeholders and no affected/fixed release confirmation.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: The advisory's all-modules evaluation scope is not a statement that every module or packet path is PHP, and F5 has not yet confirmed vulnerability or non-vulnerability.\nPatch owner: F5 for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: If a matching reachable PHP function is compromised, readable settings/credentials or permitted management actions could be misused. Wider appliance control requires separate privilege/path evidence.\nPHP component loss: The PHP-dependent interface/workflow could be unavailable. Independent traffic processing or other services may continue; exact behaviour is not measured.\nWhole appliance loss: Whole BIG-IP shutdown could interrupt the application-delivery/access/security functions actually provisioned on that unit.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-22\nPublic vendor CVE review: 2026-10-22\nVendor advisory sources: https://my.f5.com/manage/s/article/K000163821\nVulnerability status: F5 K000163821 lists BIG-IP (all modules) 21.x and 17.x under investigation; confirmation of vulnerability or non-vulnerability is not presently available.\nCVE-2026-109618: Vendor advisory under investigation; no affected/fixed BIG-IP release confirmed\nCVE-2026-109619: Vendor advisory under investigation; no affected/fixed BIG-IP release confirmed\nCVE assessment limit: The VEX relationships state the current vendor research status. Installed builds, runtime activation, enabled features, reachable inputs and exploitation remain unestablished.","owner":"F5 for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://cdn.f5.com/product/bugtracker/ID1270257.html","https://my.f5.com/manage/s/article/K000133753","https://my.f5.com/manage/s/article/K000163821"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"F5 lists BIG-IP (all modules) 21.x and 17.x under investigation; confirmation of vulnerability or non-vulnerability is not presently available.","action":"","detail":"Added from F5 K000163821 published 2026-10-21 and reviewed 2026-10-22. F5 lists BIG-IP (all modules) 21.x and 17.x with research placeholders and says confirmation of vulnerability or non-vulnerability is not presently available while research continues."},"CVE-2026-109619":{"status":"Investigation","notes":"F5 lists BIG-IP (all modules) 21.x and 17.x under investigation; confirmation of vulnerability or non-vulnerability is not presently available.","action":"","detail":"Added from F5 K000163821 published 2026-10-21 and reviewed 2026-10-22. F5 lists BIG-IP (all modules) 21.x and 17.x with research placeholders and says confirmation of vulnerability or non-vulnerability is not presently available while research continues."}}},{"id":"PHP-0627","name":"BIG-IP APM PHP page templates","vendor":"F5","category":"Appliances and embedded","version":"BIG-IP (all modules) 21.x and 17.x under investigation; no affected/fixed release confirmed","summary":"F5 K000163821 lists BIG-IP (all modules) 21.x and 17.x under investigation for CVE-2026-109618 and CVE-2026-109619; confirmation of vulnerability or non-vulnerability is not yet available.","scope":"Inventory record: PHP-0627\nEdge inventory record: EDGE-005\nCategory: Appliances and embedded\nScope group: User access component\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0626 (EDGE-004)\nEvidence status: Vendor advisory under investigation\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: User access: logon, access-profile and webtop pages\nPHP surface: F5 explicitly documents PHP inside APM UI templates.\nPHP version scope: Version-labelled 16.1 guide with moving Applies To list; K000163821 separately lists current BIG-IP (all modules) 21.x and 17.x under investigation. Exact runtime and component applicability remain unknown.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: This is a component of BIG-IP, not another device. Browser/mobile/Edge Client pages do not prove PHP executes on those clients, and F5 has not yet confirmed vulnerability or non-vulnerability.\nPatch owner: F5 for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: If a matching PHP page function is compromised, information it handles or page behaviour could be misused. Credential/session theft or access-policy control needs evidence of the actual path and permissions.\nPHP component loss: Relevant logon/webtop/access pages may fail. Effects on existing sessions and non-page VPN traffic remain unestablished.\nWhole appliance loss: Whole provisioned APM/BIG-IP shutdown can interrupt remote access and applications behind it, subject to actual redundancy.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-22\nPublic vendor CVE review: 2026-10-22\nVendor advisory sources: https://my.f5.com/manage/s/article/K000163821\nVulnerability status: F5 K000163821 lists BIG-IP (all modules) 21.x and 17.x under investigation; confirmation of vulnerability or non-vulnerability is not presently available.\nCVE-2026-109618: Vendor advisory under investigation; no affected/fixed BIG-IP release confirmed\nCVE-2026-109619: Vendor advisory under investigation; no affected/fixed BIG-IP release confirmed\nCVE assessment limit: The VEX relationships state the current vendor research status. Installed builds, runtime activation, enabled features, reachable inputs and exploitation remain unestablished.","owner":"F5 for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/coding-tips-and-examples.html","https://techdocs.f5.com/en-us/bigip-16-1-0/big-ip-access-policy-manager-customization/advanced-customization-using-logon-page-templates.html","https://my.f5.com/manage/s/article/K000163821"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"F5 lists BIG-IP (all modules) 21.x and 17.x under investigation; confirmation of vulnerability or non-vulnerability is not presently available.","action":"","detail":"Added from F5 K000163821 published 2026-10-21 and reviewed 2026-10-22. F5 lists BIG-IP (all modules) 21.x and 17.x with research placeholders and says confirmation of vulnerability or non-vulnerability is not presently available while research continues."},"CVE-2026-109619":{"status":"Investigation","notes":"F5 lists BIG-IP (all modules) 21.x and 17.x under investigation; confirmation of vulnerability or non-vulnerability is not presently available.","action":"","detail":"Added from F5 K000163821 published 2026-10-21 and reviewed 2026-10-22. F5 lists BIG-IP (all modules) 21.x and 17.x with research placeholders and says confirmation of vulnerability or non-vulnerability is not presently available while research continues."}}},{"id":"PHP-0628","name":"FortiADC","vendor":"Fortinet","category":"Appliances and embedded","version":"Not specified","summary":"Fortinet PSIRT FG-IR-26-186 lists FortiADC among products under investigation for CVE-2026-109618 and CVE-2026-109619; exact affected/fixed product scope remains unresolved.","scope":"Inventory record: PHP-0628\nEdge inventory record: EDGE-006\nCategory: Appliances and embedded\nScope group: Network/security appliance\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037 runtime family reference\nEvidence status: Vendor advisory under investigation\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: Application delivery; PHP-FPM management processes\nPHP surface: 7.4.8 vendor CLI example shows PHP-FPM; web-interface role is corroborated by indexed troubleshooting text.\nPHP version scope: FortiADC 7.4.8 CLI Reference, printed page 563; 7.4.11 troubleshooting excerpt. FG-IR-26-186 names FortiADC under investigation without affected or fixed versions.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: An official process example is not a live device observation. Do not attribute the separate load-balancing process to PHP, and do not infer a FortiADC affected or fixed release before Fortinet publishes one.\nPatch owner: Fortinet for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: If a matching reachable PHP function is compromised, readable settings/credentials or permitted management actions could be misused. Wider appliance control requires separate privilege/path evidence.\nPHP component loss: The PHP-dependent interface/workflow could be unavailable. Independent traffic processing or other services may continue; exact behaviour is not measured.\nWhole appliance loss: Whole-ADC shutdown could make the applications/services it fronts unavailable unless another route/failover maintains them.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-22\nPublic vendor CVE review: 2026-10-22\nVendor advisory sources: https://fortiguard.fortinet.com/psirt/FG-IR-26-186\nVulnerability status: Fortinet PSIRT FG-IR-26-186 lists FortiADC under investigation; exact affected/fixed product scope remains unresolved.\nCVE-2026-109618: Vendor advisory under investigation; exact affected/fixed FortiADC scope unresolved\nCVE-2026-109619: Vendor advisory under investigation; exact affected/fixed FortiADC scope unresolved\nCVE assessment limit: The VEX relationships state the current vendor research status. Installed builds, runtime activation, enabled features, reachable inputs and exploitation remain unestablished.","owner":"Fortinet for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/db39ff41-6283-11f0-a9d0-d2b0d2e22f7d/fortiadc-v7.4.8-cli-reference-guide.pdf","https://docs2.fortinet.com/document/fortiadc/7.4.11/handbook/406890/solutions-by-issue-type","https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT lists FortiADC under investigation; exact affected/fixed product scope remains unresolved.","action":"","detail":"Added from Fortinet PSIRT FG-IR-26-186 published 2026-10-21 and reviewed 2026-10-22. Fortinet lists FortiADC under Products Under Investigation and does not publish affected or fixed FortiADC versions in the advisory."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT lists FortiADC under investigation; exact affected/fixed product scope remains unresolved.","action":"","detail":"Added from Fortinet PSIRT FG-IR-26-186 published 2026-10-21 and reviewed 2026-10-22. Fortinet lists FortiADC under Products Under Investigation and does not publish affected or fixed FortiADC versions in the advisory."}}},{"id":"PHP-0629","name":"Junos OS J-Web (EX/SRX scope)","vendor":"Juniper Networks","category":"Appliances and embedded","version":"Not specified","summary":"Juniper-authored CVE record expressly identifies PHP in J-Web; later vendor bulletin corroborates inclusion. Applicability of CVE-2026-109618 and CVE-2026-109619 is not established for this scope.","scope":"Inventory record: PHP-0629\nEdge inventory record: EDGE-019\nCategory: Appliances and embedded\nScope group: Network/security appliance\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037 runtime family reference\nEvidence status: Confirmed relationship\nRelationship confidence: Source supports the stated scope; actual deployment unknown\nDeployment status: Unknown: no installation count, live build, reachability, permissions, failover or exploitation measured\nService role: Network/security device web administration\nPHP surface: Juniper-authored CVE record expressly identifies PHP in J-Web; later vendor bulletin corroborates inclusion.\nPHP version scope: Historical 2023 EX/SRX CNA scope; 2024 indexed JSA88120 through23.4. Exact current PHP build unknown.\nExtensions: Unknown unless explicitly recorded\nImportant boundary: Only the named J-Web/release scope is supported. Enabling conditions of an older flaw are not automatically those of the 2026 pair.\nPatch owner: Juniper Networks for supported firmware/component corrections; operator/provider for deployment, restart and service continuity\nPossible abuse: If a matching reachable PHP function is compromised, readable settings/credentials or permitted management actions could be misused. Wider appliance control requires separate privilege/path evidence.\nPHP component loss: The PHP-dependent interface/workflow could be unavailable. Independent traffic processing or other services may continue; exact behaviour is not measured.\nWhole appliance loss: Whole SRX/EX shutdown could interrupt firewall/switch connectivity. Disabling only J-Web is a narrower scenario; actual remaining operations must be verified.\nConditions: Requires a matching affected runtime/vendor build, enabled function, reachable input and relevant process permissions. PHP presence alone is insufficient.\nSource accessed: 2026-10-21\nVendor advisory status: No direct vendor confirmation for CVE-2026-109618 or CVE-2026-109619 identified in official-site review on 2026-10-21.\nVulnerability status: PHP relationship confirmed; product/build applicability of CVE-2026-109618 and CVE-2026-109619 not established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: The edge inventory confirms a PHP relationship in the cited scope only. Affected/fixed appliance builds, vendor backports, enabled features, reachable inputs and exploitation remain unestablished.","owner":"Juniper Networks for supported firmware/component corrections; operator/provider for deployment, restart and service continuity","links":["https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/36xxx/CVE-2023-36845.json","https://supportportal.juniper.net/s/article/2024-10-Security-Bulletin-Junos-OS-J-Web-Multiple-vulnerabilities-resolved-in-PHP-software"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0630","name":"iBabs bestuursportaal","vendor":"iBabs","category":"Other","version":"Not specified","summary":"PHP is not being used in iBabs. This is confirmed by an email of the supplier.","scope":"Source: Supplier email\nEvidence: Supplier confirmed that PHP is not used in iBabs.\nVulnerability status: Not affected because the PHP component is not present.","owner":"Verify with vendor","links":[],"cves":{"CVE-2026-109618":{"status":"Not vuln","notes":"","action":"","detail":"Added from supplier email confirmation."},"CVE-2026-109619":{"status":"Not vuln","notes":"","action":"","detail":"Added from supplier email confirmation."}}},{"id":"PHP-0631","name":"Apex One","vendor":"Trend Micro","category":"Monitoring and administration","version":"Not specified","summary":"Trend Micro's critical-patch readme states that a PHP module is used in Apex One and records an update to PHP 8.2.30.","scope":"Inventory record: PHP-0631\nCategory: Monitoring and administration\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled PHP module in the Apex One server; exact SAPI and reachable paths unspecified\nPHP version scope: Apex One Service Pack 1 Critical Patch Server Build 20105 readme includes prior Critical Patch 18012 text stating that the PHP module used in Apex One was updated to 8.2.30.\nLimitations: The vendor readme confirms a PHP module in Apex One, but does not identify CVE-2026-109618 or CVE-2026-109619, affected/fixed product builds, enabled features, reachability or deployment status.\nPatch owner: Trend Micro for bundled product components; operator for patch rollout\nDownstream surface: Apex One server and management interfaces\nRelease pin: Apex One Service Pack 1 Critical Patch Server Build 20105 readme; last updated 2026-10-08\nSource accessed: 2026-10-21\nAliases: Trend Micro Apex One\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Vendor readme confirms a bundled PHP component, but not applicability of the reviewed CVEs.","owner":"Trend Micro for bundled product components; operator for patch rollout","links":["https://files.trendmicro.com/documentation/readme/Apex%20One/2020/apex_one_2019_win_cp_b20105_EN_hotfix_Readme.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0632","name":"Apex Central","vendor":"Trend Micro","category":"Monitoring and administration","version":"Not specified","summary":"Trend Micro's hotfix readme lists PHP 8.2.33 among Apex Central third-party modules updated to prevent potential vulnerabilities.","scope":"Inventory record: PHP-0632\nCategory: Monitoring and administration\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Bundled PHP module in the Apex Central server; exact SAPI and reachable paths unspecified\nPHP version scope: Apex Central Hotfix Build 7328 readme lists PHP 8.2.33 among third-party modules updated to prevent potential vulnerabilities.\nLimitations: The vendor readme confirms a PHP module in Apex Central, but does not identify CVE-2026-109618 or CVE-2026-109619, affected/fixed product builds, enabled features, reachability or deployment status.\nPatch owner: Trend Micro for bundled product components; operator for patch rollout\nDownstream surface: Apex Central server and management interfaces\nRelease pin: Apex Central Hotfix Build 7328 readme; last updated 2026-10-06\nSource accessed: 2026-10-21\nAliases: Trend Micro Apex Central\nVulnerability status: Preliminary CVE-REVIEW-20261021-01: PHP relationship confirmed; CVE match unknown. No affected deployment established.\nCVE-2026-109618: PHP relationship confirmed; CVE match unknown\nCVE-2026-109619: PHP relationship confirmed; CVE match unknown\nCVE assessment limit: Vendor readme confirms a bundled PHP component, but not applicability of the reviewed CVEs.","owner":"Trend Micro for bundled product components; operator for patch rollout","links":["https://files.trendmicro.com/documentation/readme/CP/apexcentral_win_en_criticalpatch_b7328_Readme.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109618'. This assessment preserves the source inventory wording and does not assert an affected deployment."},"CVE-2026-109619":{"status":"Investigation","notes":"PHP relationship confirmed; CVE match unknown","action":"","detail":"Generated from inventory field 'cve_2026_109619'. This assessment preserves the source inventory wording and does not assert an affected deployment."}}},{"id":"PHP-0633","name":"Red Hat Enterprise Linux 9 php:8.2 module","vendor":"Red Hat","category":"Containers and distribution","version":"8.2.35-1.module+el9.8.0+25111+a1450321","summary":"Red Hat RHSA-2026:87072 provides fixed RHEL 9 php:8.2 module packages for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0633\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: RHEL 9 php:8.2 module packages\nPHP version scope: RHSA-2026:87072 lists php-8.2.35-1.module+el9.8.0+25111+a1450321.src.rpm as an updated package for affected RHEL 9 variants.\nLimitations: This advisory confirms the php:8.2 module scope only. Other RHEL 9 PHP RPM/AppStream branches remain outside this advisory scope and require separate vendor evidence.\nPatch owner: Red Hat for supported backported RPMs/AppStreams; subscriber/operator for update and restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: RHSA-2026:87072 issued and updated 2026-10-21\nSource accessed: 2026-10-21\nAliases: rhel9:php:8.2\nVulnerability status: Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321.\nCVE-2026-109618: Fixed in php-8.2.35-1.module+el9.8.0+25111+a1450321\nCVE-2026-109619: Fixed in php-8.2.35-1.module+el9.8.0+25111+a1450321\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Red Hat for supported backported RPMs/AppStreams; subscriber/operator for update and restart","links":["https://access.redhat.com/errata/RHSA-2026:87072"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321","action":"","detail":"Added from Red Hat RHSA-2026:87072 issued 2026-10-21.\nAction statement: Apply RHSA-2026:87072 updated php:8.2 module packages for affected Red Hat Enterprise Linux 9 systems."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321","action":"","detail":"Added from Red Hat RHSA-2026:87072 issued 2026-10-21.\nAction statement: Apply RHSA-2026:87072 updated php:8.2 module packages for affected Red Hat Enterprise Linux 9 systems."}}},{"id":"PHP-0634","name":"Ubuntu Stonking php8.5-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"8.5.9-0ubuntu2.1","summary":"Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Stonking php8.5-fpm 8.5.9-0ubuntu2.1.","scope":"Inventory record: PHP-0634\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-1 fixes Stonking php8.5-fpm at 8.5.9-0ubuntu2.1; published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 26.10 only, not every Ubuntu installation or all Ubuntu PHP packages. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-1; php8.5-fpm 8.5.9-0ubuntu2.1; Ubuntu 26.10 Stonking\nSource accessed: 2026-10-21\nAliases: ubuntu:stonking/php8.5-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1.\nCVE-2026-109618: Fixed in php8.5-fpm 8.5.9-0ubuntu2.1\nCVE-2026-109619: Fixed in php8.5-fpm 8.5.9-0ubuntu2.1\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-1"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.5 packages for affected Ubuntu 26.10 systems."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.5 packages for affected Ubuntu 26.10 systems."}}},{"id":"PHP-0635","name":"Ubuntu Resolute php8.5-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"8.5.4-0ubuntu1.5","summary":"Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Resolute php8.5-fpm 8.5.4-0ubuntu1.5.","scope":"Inventory record: PHP-0635\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-1 fixes Resolute php8.5-fpm at 8.5.4-0ubuntu1.5; published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 26.04 LTS only, not every Ubuntu installation or all Ubuntu PHP packages. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-1; php8.5-fpm 8.5.4-0ubuntu1.5; Ubuntu 26.04 LTS Resolute\nSource accessed: 2026-10-21\nAliases: ubuntu:resolute/php8.5-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5.\nCVE-2026-109618: Fixed in php8.5-fpm 8.5.4-0ubuntu1.5\nCVE-2026-109619: Fixed in php8.5-fpm 8.5.4-0ubuntu1.5\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-1"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.5 packages for affected Ubuntu 26.04 LTS systems."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.5 packages for affected Ubuntu 26.04 LTS systems."}}},{"id":"PHP-0636","name":"Ubuntu Jammy php8.1-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"8.1.2-1ubuntu2.28","summary":"Ubuntu USN-8948-1 fixes CVE-2026-109618 and CVE-2026-109619 in Jammy php8.1-fpm 8.1.2-1ubuntu2.28.","scope":"Inventory record: PHP-0636\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-1 fixes Jammy php8.1-fpm at 8.1.2-1ubuntu2.28; published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 22.04 LTS only, not every Ubuntu installation or all Ubuntu PHP packages. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-1; php8.1-fpm 8.1.2-1ubuntu2.28; Ubuntu 22.04 LTS Jammy\nSource accessed: 2026-10-21\nAliases: ubuntu:jammy/php8.1-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28.\nCVE-2026-109618: Fixed in php8.1-fpm 8.1.2-1ubuntu2.28\nCVE-2026-109619: Fixed in php8.1-fpm 8.1.2-1ubuntu2.28\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-1"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.1 packages for affected Ubuntu 22.04 LTS systems."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28","action":"","detail":"Added from Ubuntu USN-8948-1 issued 2026-10-21.\nAction statement: Apply USN-8948-1 updated php8.1 packages for affected Ubuntu 22.04 LTS systems."}}},{"id":"PHP-0637","name":"Ubuntu Focal php7.4-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"7.4.3-4ubuntu2.29+esm5","summary":"Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 with Ubuntu Pro.","scope":"Inventory record: PHP-0637\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-2 fixes Focal php7.4-fpm at 7.4.3-4ubuntu2.29+esm5; Ubuntu Pro fix available, published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 20.04 LTS only, not every Ubuntu installation or all Ubuntu PHP packages. Fix availability requires the relevant Ubuntu Pro entitlement. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-2; php7.4-fpm 7.4.3-4ubuntu2.29+esm5; Ubuntu 20.04 LTS Focal\nSource accessed: 2026-10-21\nAliases: ubuntu:focal/php7.4-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5.\nCVE-2026-109618: Fixed in php7.4-fpm 7.4.3-4ubuntu2.29+esm5\nCVE-2026-109619: Fixed in php7.4-fpm 7.4.3-4ubuntu2.29+esm5\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-2"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php7.4 packages for affected Ubuntu 20.04 LTS systems with Ubuntu Pro."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php7.4 packages for affected Ubuntu 20.04 LTS systems with Ubuntu Pro."}}},{"id":"PHP-0638","name":"Ubuntu Bionic php7.2-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"7.2.24-0ubuntu0.18.04.17+esm14","summary":"Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 with Ubuntu Pro.","scope":"Inventory record: PHP-0638\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-2 fixes Bionic php7.2-fpm at 7.2.24-0ubuntu0.18.04.17+esm14; Ubuntu Pro fix available, published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 18.04 LTS only, not every Ubuntu installation or all Ubuntu PHP packages. Fix availability requires the relevant Ubuntu Pro entitlement. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-2; php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14; Ubuntu 18.04 LTS Bionic\nSource accessed: 2026-10-21\nAliases: ubuntu:bionic/php7.2-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14.\nCVE-2026-109618: Fixed in php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14\nCVE-2026-109619: Fixed in php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-2"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php7.2 packages for affected Ubuntu 18.04 LTS systems with Ubuntu Pro."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php7.2 packages for affected Ubuntu 18.04 LTS systems with Ubuntu Pro."}}},{"id":"PHP-0639","name":"Ubuntu Xenial php7.0-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"7.0.33-0ubuntu0.16.04.16+esm22","summary":"Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 with Ubuntu Pro Legacy Support.","scope":"Inventory record: PHP-0639\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-2 fixes Xenial php7.0-fpm at 7.0.33-0ubuntu0.16.04.16+esm22; Ubuntu Pro fix available via Legacy Support add-on, published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 16.04 LTS only, not every Ubuntu installation or all Ubuntu PHP packages. Fix availability requires the relevant Ubuntu Pro Legacy Support entitlement. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-2; php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22; Ubuntu 16.04 LTS Xenial\nSource accessed: 2026-10-21\nAliases: ubuntu:xenial/php7.0-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22.\nCVE-2026-109618: Fixed in php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22\nCVE-2026-109619: Fixed in php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-2"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php7.0 packages for affected Ubuntu 16.04 LTS systems with Ubuntu Pro Legacy Support."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php7.0 packages for affected Ubuntu 16.04 LTS systems with Ubuntu Pro Legacy Support."}}},{"id":"PHP-0640","name":"Ubuntu Trusty php5-fpm binary package","vendor":"Canonical / Ubuntu package maintainers","category":"Containers and distribution","version":"5.5.9+dfsg-1ubuntu4.29+esm18","summary":"Ubuntu USN-8948-2 fixes CVE-2026-109618 and CVE-2026-109619 in Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 with Ubuntu Pro Legacy Support.","scope":"Inventory record: PHP-0640\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0358\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: PHP-FPM FastCGI binary package\nPHP version scope: Ubuntu USN-8948-2 fixes Trusty php5-fpm at 5.5.9+dfsg-1ubuntu4.29+esm18; Ubuntu Pro fix available via Legacy Support add-on, published advisory scope, not a measured installed build.\nExtensions: Package-specific; loaded extensions and release-matched dependencies are not resolved in this advisory.\nLimitations: This row covers the named FPM package for Ubuntu 14.04 LTS only, not every Ubuntu installation or all Ubuntu PHP packages. Fix availability requires the relevant Ubuntu Pro Legacy Support entitlement. Package availability does not prove operator rollout or process restart.\nPatch owner: Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: USN-8948-2; php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18; Ubuntu 14.04 LTS Trusty\nSource accessed: 2026-10-21\nAliases: ubuntu:trusty/php5-fpm\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18.\nCVE-2026-109618: Fixed in php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18\nCVE-2026-109619: Fixed in php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18\nCVE assessment limit: Vendor advisory establishes fixed package scope, not deployment status or whether an operator has applied the update.","owner":"Ubuntu package/security maintainers for distro patches; operator for selected pocket/entitlement, rollout and FPM restart","links":["https://ubuntu.com/security/notices/USN-8948-2"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php5 packages for affected Ubuntu 14.04 LTS systems with Ubuntu Pro Legacy Support."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18","action":"","detail":"Added from Ubuntu USN-8948-2 issued 2026-10-21.\nAction statement: Apply USN-8948-2 updated php5 packages for affected Ubuntu 14.04 LTS systems with Ubuntu Pro Legacy Support."}}},{"id":"PHP-0641","name":"Arch Linux Extra php-legacy package","vendor":"Arch Linux package maintainers","category":"Containers and distribution","version":"8.3.36-1","summary":"Arch Linux states that php-legacy versions before 8.3.36 are affected by both CVEs; the current Extra package page lists php-legacy 8.3.36-1.","scope":"Inventory record: PHP-0641\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: Packaged PHP legacy runtime; web SAPIs/modules need separate package/configuration evidence\nPHP version scope: Arch Linux news states php-legacy versions before 8.3.36 are affected by CVE-2026-109618 and CVE-2026-109619. The current x86_64 Extra package page lists php-legacy 8.3.36-1, built 2026-10-21 13:48 UTC.\nExtensions: Bundled/required/optional extension inventory unknown; selected package or build recipe must be resolved\nLimitations: Apache, ICU, GD and other make dependencies do not prove every associated runtime module is installed or loaded. Optional package availability is not PHP in every Arch host. No binary/image was pulled, installed, built or executed. Package availability does not prove operator rollout or process restart.\nPatch owner: Arch package maintainers and operator updating the rolling package and restarting users\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: Arch php-legacy 8.3.36-1 x86_64; official package page last updated 2026-10-21 13:57 UTC\nSource accessed: 2026-10-21\nAliases: arch:extra/x86_64/php-legacy\nConditional downstream consequence: A matching flaw could affect applications or jobs actually using this installed package and its loaded modules. Package availability alone creates no exposure. Distribution backports, SAPI, configuration and reachable input must be matched before assessing disclosure, DoS, integrity or code-execution consequences.\nVulnerability status: Fixed in Arch Linux Extra php-legacy 8.3.36-1.\nCVE-2026-109618: Fixed in php-legacy 8.3.36-1\nCVE-2026-109619: Fixed in php-legacy 8.3.36-1\nCVE assessment limit: Vendor news establishes the fixed package threshold, not deployment status or whether an operator has applied the update and restarted affected services.","owner":"Arch package maintainers and operator updating the rolling package and restarting users","links":["https://archlinux.org/packages/extra/x86_64/php-legacy/","https://archlinux.org/news/update-to-php-8512-andor-php-legacy-8336-to-prevent-remote-code-execution/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Arch Linux Extra php-legacy 8.3.36-1","action":"","detail":"Added from the Arch Linux php2shell news post and current package page on 2026-10-21.\nAction statement: Update Arch Linux systems to php-legacy >= 8.3.36 and restart affected services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Arch Linux Extra php-legacy 8.3.36-1","action":"","detail":"Added from the Arch Linux php2shell news post and current package page on 2026-10-21.\nAction statement: Update Arch Linux systems to php-legacy >= 8.3.36 and restart affected services."}}},{"id":"PHP-0642","name":"Bref PHP Lambda runtime layers","vendor":"Bref project","category":"Containers and distribution","version":"Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115","summary":"Bref confirms patched Bref 3 and Bref 2 PHP Lambda layers are published in all regions; update selected layer versions and redeploy.","scope":"Inventory record: PHP-0642\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed layers\nDeployment status: Not measured\nPHP surface: Function PHP, web PHP-FPM and console PHP Lambda layers\nPHP version scope: Bref 3 layers embed PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12; Bref 2 layers 2.3.45 cover PHP 8.2 through 8.4. bref/bref 3.0.14 and 2.4.22 select the patched layers\nExtensions: ARM runtimes are supported; bref-extra-extensions is documented unavailable for ARM. Other extension inventories unresolved\nLimitations: Layer ARN/version, architecture and region must be matched and functions redeployed. Bref 1 layers are not rebuilt. The vendor distinguishes FPM web attack paths from CLI-based functions/console workers; publication does not establish deployment or exploitation. No layer was pulled, executed or tested.\nPatch owner: Bref for compiled runtime layers and package-to-layer mapping; customer updates layer references and redeploys\nDownstream surface: Only the named PHP component and its callers\nRelease pin: Official security release notice published 2026-10-21: Bref 3 layer versions 21/24/24/26 for PHP 8.5/8.4/8.3/8.2; Bref 2 layer versions 43/71/115 for PHP 8.4/8.3/8.2\nSource accessed: 2026-10-21\nAliases: bref:php-lambda-layers\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through customer application inputs, possible effects include worker denial of service, disclosure of app-accessible secrets, data modification or code execution with the worker identity. Crossing customer, container or provider boundaries requires separate evidence; runtime presence alone establishes none of these outcomes.\nVulnerability status: Patched Bref 3 and Bref 2 PHP Lambda layers are published in all regions, superseding the earlier issue's unconfirmed layer scope.\nCVE-2026-109618: Fixed in the published Bref 3 and Bref 2 runtime layers listed by the vendor\nCVE-2026-109619: Fixed in the published Bref 3 and Bref 2 runtime layers listed by the vendor\nCVE assessment limit: Match the selected layer ARN/version, region and architecture; update direct ARNs or bref/bref and redeploy. Bref 1 is excluded. AWS platform or customer deployments are not assessed.","owner":"Bref for compiled runtime layers and package-to-layer mapping; customer updates layer references and redeploys","links":["https://bref.sh/docs/runtimes","https://github.com/brefphp/bref/issues/2222","https://bref.sh/news/06-php-security-release-october-2026"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded","action":"","detail":"Reconciled with the official Bref security release notice published 2026-10-21: https://bref.sh/news/06-php-security-release-october-2026\nAction statement: Update to bref/bref 3.0.14 or 2.4.22, or the vendor-listed fixed direct layer ARNs, then redeploy and verify the selected versions."},"CVE-2026-109619":{"status":"Fix","notes":"Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded","action":"","detail":"Reconciled with the official Bref security release notice published 2026-10-21: https://bref.sh/news/06-php-security-release-october-2026\nAction statement: Update to bref/bref 3.0.14 or 2.4.22, or the vendor-listed fixed direct layer ARNs, then redeploy and verify the selected versions."}}},{"id":"PHP-0643","name":"CloudLinux Alt-PHP 7.4 fixed package set","vendor":"CloudLinux / TuxCare","category":"Containers and distribution","version":"Not specified","summary":"CloudLinux reports fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, 18.04, 22.04, 24.04 and 26.04.","scope":"Inventory record: PHP-0643\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0387\nEvidence status: Vendor-confirmed fixed package set\nDeployment status: Not measured\nPHP surface: alt-php74 packages for the vendor-listed released Linux platform set\nPHP version scope: CloudLinux status updates report fixed alt-php74 releases for EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04; exact package build identifiers are not listed.\nLimitations: This row covers only the vendor-listed alt-php74 platform set and does not establish fixed releases for other Alt-PHP branches or platforms. Package availability does not prove operator rollout or service restart.\nPatch owner: CloudLinux/TuxCare for Alt-PHP packages; hosting operator for entitlements, updates and selected-user configuration\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: CloudLinux status incident updated 2026-10-21; exact package build identifiers not published in the incident\nSource accessed: 2026-10-21\nAliases: cloudlinux:alt-php74-fixed-platform-set\nVulnerability status: Fixed builds released for the vendor-listed CloudLinux alt-php74 platform set.\nCVE-2026-109618: Fixed builds released for listed alt-php74 platforms\nCVE-2026-109619: Fixed builds released for listed alt-php74 platforms\nCVE assessment limit: Vendor incident establishes fixed release availability for the named platform set, not exact installed package identifiers or operator rollout.","owner":"CloudLinux/TuxCare for Alt-PHP packages; hosting operator for entitlements, updates and selected-user configuration","links":["https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the released alt-php74 package for the selected platform and restart affected PHP services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the released alt-php74 package for the selected platform and restart affected PHP services."}}},{"id":"PHP-0644","name":"CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23","vendor":"CloudLinux / TuxCare","category":"Containers and distribution","version":"Not specified","summary":"CloudLinux reports a fixed alt-php80 release for Alpine Linux 3.23.","scope":"Inventory record: PHP-0644\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0387\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: alt-php80 package for Alpine Linux 3.23\nPHP version scope: CloudLinux status update reports a fixed alt-php80 release for Alpine Linux 3.23; exact package build identifier is not listed.\nLimitations: This row covers only the named Alt-PHP branch and platform. Package availability does not prove operator rollout or service restart.\nPatch owner: CloudLinux/TuxCare for Alt-PHP packages; hosting operator for entitlements, updates and selected-user configuration\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: CloudLinux status incident updated 2026-10-21; exact package build identifier not published in the incident\nSource accessed: 2026-10-21\nAliases: cloudlinux:alt-php80/alpine-3.23\nVulnerability status: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23.\nCVE-2026-109618: Fixed build released for alt-php80 on Alpine Linux 3.23\nCVE-2026-109619: Fixed build released for alt-php80 on Alpine Linux 3.23\nCVE assessment limit: Vendor incident establishes fixed release availability for the named branch/platform, not exact installed package identifier or operator rollout.","owner":"CloudLinux/TuxCare for Alt-PHP packages; hosting operator for entitlements, updates and selected-user configuration","links":["https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the released alt-php80 package for Alpine Linux 3.23 and restart affected PHP services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the released alt-php80 package for Alpine Linux 3.23 and restart affected PHP services."}}},{"id":"PHP-0645","name":"TuxCare ELS PHP package for CentOS 8.4","vendor":"TuxCare / CloudLinux","category":"Containers and distribution","version":"7.4.6","summary":"CloudLinux reports a fixed TuxCare ELS php-7.4.6 release for CentOS 8.4 ELS.","scope":"Inventory record: PHP-0645\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0422\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: TuxCare ELS PHP package for CentOS 8.4\nPHP version scope: CloudLinux status update reports fixed php-7.4.6 for CentOS 8.4 ELS.\nLimitations: The incident identifies the fixed PHP release but does not list complete RPM NEVRAs, architecture or every companion package. Package availability does not prove operator rollout or service restart.\nPatch owner: TuxCare for licensed PHP backport builds; system administrator for update and service rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: CloudLinux status incident updated 2026-10-21; php-7.4.6 for CentOS 8.4 ELS\nSource accessed: 2026-10-21\nAliases: tuxcare:els-php/centos-8.4/php-7.4.6\nVulnerability status: Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS.\nCVE-2026-109618: Fixed in php-7.4.6 for CentOS 8.4 ELS\nCVE-2026-109619: Fixed in php-7.4.6 for CentOS 8.4 ELS\nCVE assessment limit: Vendor incident establishes fixed release availability for the named ELS scope, not complete package identifiers or operator rollout.","owner":"TuxCare for licensed PHP backport builds; system administrator for update and service rollout","links":["https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5","https://docs.tuxcare.com/els-for-runtimes/php/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."}}},{"id":"PHP-0646","name":"TuxCare ELS PHP package for CentOS 8.5","vendor":"TuxCare / CloudLinux","category":"Containers and distribution","version":"7.4.19","summary":"CloudLinux reports a fixed TuxCare ELS php-7.4.19 release for CentOS 8.5 ELS.","scope":"Inventory record: PHP-0646\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0422\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: TuxCare ELS PHP package for CentOS 8.5\nPHP version scope: CloudLinux status update reports fixed php-7.4.19 for CentOS 8.5 ELS.\nLimitations: The incident identifies the fixed PHP release but does not list complete RPM NEVRAs, architecture or every companion package. Package availability does not prove operator rollout or service restart.\nPatch owner: TuxCare for licensed PHP backport builds; system administrator for update and service rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: CloudLinux status incident updated 2026-10-21; php-7.4.19 for CentOS 8.5 ELS\nSource accessed: 2026-10-21\nAliases: tuxcare:els-php/centos-8.5/php-7.4.19\nVulnerability status: Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS.\nCVE-2026-109618: Fixed in php-7.4.19 for CentOS 8.5 ELS\nCVE-2026-109619: Fixed in php-7.4.19 for CentOS 8.5 ELS\nCVE assessment limit: Vendor incident establishes fixed release availability for the named ELS scope, not complete package identifiers or operator rollout.","owner":"TuxCare for licensed PHP backport builds; system administrator for update and service rollout","links":["https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5","https://docs.tuxcare.com/els-for-runtimes/php/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."}}},{"id":"PHP-0647","name":"TuxCare ELS PHP package for Ubuntu 16.04","vendor":"TuxCare / CloudLinux","category":"Containers and distribution","version":"7.0.33","summary":"CloudLinux reports a fixed TuxCare ELS php-7.0.33 release for Ubuntu 16.04 ELS.","scope":"Inventory record: PHP-0647\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0422\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: TuxCare ELS PHP package for Ubuntu 16.04\nPHP version scope: CloudLinux status update reports fixed php-7.0.33 for Ubuntu 16.04 ELS.\nLimitations: The incident identifies the fixed PHP release but does not list complete DEB revisions, architecture or every companion package. Package availability does not prove operator rollout or service restart.\nPatch owner: TuxCare for licensed PHP backport builds; system administrator for update and service rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: CloudLinux status incident updated 2026-10-21; php-7.0.33 for Ubuntu 16.04 ELS\nSource accessed: 2026-10-21\nAliases: tuxcare:els-php/ubuntu-16.04/php-7.0.33\nVulnerability status: Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS.\nCVE-2026-109618: Fixed in php-7.0.33 for Ubuntu 16.04 ELS\nCVE-2026-109619: Fixed in php-7.0.33 for Ubuntu 16.04 ELS\nCVE assessment limit: Vendor incident establishes fixed release availability for the named ELS scope, not complete package identifiers or operator rollout.","owner":"TuxCare for licensed PHP backport builds; system administrator for update and service rollout","links":["https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5","https://docs.tuxcare.com/els-for-runtimes/php/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."}}},{"id":"PHP-0648","name":"TuxCare ELS PHP package for Ubuntu 18.04","vendor":"TuxCare / CloudLinux","category":"Containers and distribution","version":"7.2.24-0","summary":"CloudLinux reports a fixed TuxCare ELS php-7.2.24-0 release for Ubuntu 18.04 ELS.","scope":"Inventory record: PHP-0648\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0422\nEvidence status: Vendor-confirmed fixed package\nDeployment status: Not measured\nPHP surface: TuxCare ELS PHP package for Ubuntu 18.04\nPHP version scope: CloudLinux status update reports fixed php-7.2.24-0 for Ubuntu 18.04 ELS.\nLimitations: The incident identifies the fixed PHP release but does not list complete DEB revisions, architecture or every companion package. Package availability does not prove operator rollout or service restart.\nPatch owner: TuxCare for licensed PHP backport builds; system administrator for update and service rollout\nDownstream surface: Only applications/jobs using the selected installed runtime or image\nRelease pin: CloudLinux status incident updated 2026-10-21; php-7.2.24-0 for Ubuntu 18.04 ELS\nSource accessed: 2026-10-21\nAliases: tuxcare:els-php/ubuntu-18.04/php-7.2.24-0\nVulnerability status: Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS.\nCVE-2026-109618: Fixed in php-7.2.24-0 for Ubuntu 18.04 ELS\nCVE-2026-109619: Fixed in php-7.2.24-0 for Ubuntu 18.04 ELS\nCVE assessment limit: Vendor incident establishes fixed release availability for the named ELS scope, not complete package identifiers or operator rollout.","owner":"TuxCare for licensed PHP backport builds; system administrator for update and service rollout","links":["https://cloudlinux.statuspage.io/incidents/zl0vt1yq3dj5","https://docs.tuxcare.com/els-for-runtimes/php/"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS","action":"","detail":"Added from the CloudLinux incident status page updated 2026-10-21.\nAction statement: Apply the named fixed TuxCare ELS package and restart affected PHP services."}}},{"id":"PHP-0649","name":"PHP core and Zend Engine affected web-serving release scope","vendor":"The PHP Group","category":"PHP core","version":">=5.4.0 before fixed release or vendor backport; supported branches <8.2.35, <8.3.36, <8.4.27, <8.5.12","summary":"Version-scoped PHP runtime variant for affected web-serving releases. PHP says all PHP installations serving web requests are at risk; Calif found affected paths back to PHP 5.4.0.","scope":"Inventory record: PHP-0649\nCategory: PHP core\nOriginal relationship: variant\nRelationship direction: version_scope_of_php\nParent component: PHP-0037\nEvidence status: Upstream and primary-research confirmed affected runtime scope\nDeployment status: Not measured\nPHP surface: Web-serving PHP runtime and Zend Engine\nPHP version scope: PHP >=5.4.0 before a fixed release or vendor backport; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12.\nExtensions: Enabled extensions vary by binary; main runtime and Zend Engine are core components\nLimitations: This aggregate scope node is not a single distributable artifact. Exploitation path and reliability depend on SAPI, build, enabled extensions, worker lifecycle and reachable request path. Vendor backports can make an older upstream version fixed.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Web applications and other request-serving PHP workloads\nRelease pin: PHP advisory and php-src security advisories published 2026-10-21; Calif primary research reviewed 2026-10-21\nSource accessed: 2026-10-21\nAliases: affected php-src runtime scope, affected Zend Engine runtime scope\nConditional downstream consequence: Products executing on this runtime scope can be affected even when their own application code is unchanged; worker privileges and isolation determine downstream impact.\nVulnerability status: Affected runtime scope for CVE-2026-109618 and CVE-2026-109619.\nCVE-2026-109618: Affected web-serving PHP runtime scope\nCVE-2026-109619: Affected web-serving PHP runtime scope\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI and reachable path still need deployment-specific evidence.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://www.php.net/archive/2026.php#2026-10-21-5","https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp","https://calif.io/php2shell/"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Affected web-serving PHP runtime scope; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older branches require vendor backports or upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers.","detail":"Added from the PHP security advisory and php-src GHSA published 2026-10-21; Calif primary research records affected paths back to PHP 5.4.0."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Affected web-serving PHP runtime scope; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older branches require vendor backports or upgrade.","action":"Upgrade the serving PHP runtime to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply a vendor backport, then restart PHP workers.","detail":"Added from the PHP security advisory and php-src GHSA published 2026-10-21; Calif primary research records affected paths back to PHP 5.4.0."}}},{"id":"PHP-0650","name":"PHP core and Zend Engine fixed upstream releases","vendor":"The PHP Group","category":"PHP core","version":"8.5.12, 8.4.27, 8.3.36, 8.2.35","summary":"Version-scoped PHP runtime variant for the upstream fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.","scope":"Inventory record: PHP-0650\nCategory: PHP core\nOriginal relationship: variant\nRelationship direction: version_scope_of_php\nParent component: PHP-0037\nEvidence status: Upstream-confirmed fixed release scope\nDeployment status: Not measured\nPHP surface: Web-serving PHP runtime and Zend Engine\nPHP version scope: Fixed upstream releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\nExtensions: Enabled extensions vary by binary; main runtime and Zend Engine are core components\nLimitations: This aggregate scope node records the first fixed upstream releases for supported branches, not every downstream package or backport. Package availability does not prove operator rollout or worker restart.\nPatch owner: PHP upstream, binary/image/distribution publisher, and deploying operator\nDownstream surface: Web applications and other request-serving PHP workloads\nRelease pin: PHP advisory and php-src security advisories published 2026-10-21\nSource accessed: 2026-10-21\nAliases: fixed php-src runtime scope, fixed Zend Engine runtime scope\nConditional downstream consequence: Updating the runtime removes the underlying php2shell flaws for workloads actually served by the updated workers.\nVulnerability status: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.\nCVE-2026-109618: Fixed upstream runtime releases\nCVE-2026-109619: Fixed upstream runtime releases\nCVE assessment limit: Downstream packages, vendor backports, installed versions and worker restart remain deployment-specific.","owner":"PHP upstream, binary/image/distribution publisher, and deploying operator","links":["https://www.php.net/archive/2026.php#2026-10-21-5","https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w","https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers","action":"","detail":"Added from the PHP security advisory published 2026-10-21.\nAction statement: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers."}}},{"id":"PHP-0651","name":"Scalingo PaaS","vendor":"Scalingo","category":"Hosting and cloud","version":"Scalingo PHP runtimes 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 available since 2026-10-21 16:40 UTC+2","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0651\nCategory: Hosting and cloud\nOriginal relationship: hosts\nRelationship direction: hosts_customer_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Hosted PHP application runtime; exact tenant SAPI and selected stack are not measured\nPHP version scope: Scalingo PHP runtimes 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 available since 2026-10-21 16:40 UTC+2\nExtensions: Tenant/buildpack-specific; complete loaded module set unknown\nLimitations: A platform bulletin does not prove every application uses PHP, an affected version or a reachable path. Customer rebuild/redeploy state and worker restart are not measured.\nPatch owner: Scalingo for managed runtime availability; customer for selected runtime and redeploy\nDownstream surface: Hosted customer PHP applications and workers\nRelease pin: Scalingo PHP runtimes 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 available since 2026-10-21 16:40 UTC+2\nSource accessed: 2026-10-22\nAliases: Scalingo hosted PHP applications\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Scalingo SSB-2026-005 explicitly names both CVEs and confirms all four fixed runtimes are available. Customers must rebuild/redeploy with compatible constraints and verify the deployed PHP version. Router multipart blocking is separate mitigation and does not update the runtime or prove a fix in an old deployment.\nCVE-2026-109619: Scalingo SSB-2026-005 explicitly names both CVEs and confirms all four fixed runtimes are available. Customers must rebuild/redeploy with compatible constraints and verify the deployed PHP version. Router multipart blocking is separate mitigation and does not update the runtime or prove a fix in an old deployment.\nVendor advisory sources: https://doc.scalingo.com/security/bulletins/ssb-2026-005\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Scalingo for managed runtime availability; customer for selected runtime and redeploy","links":["https://doc.scalingo.com/security/bulletins/ssb-2026-005"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Scalingo SSB-2026-005 explicitly names both CVEs and confirms all four fixed runtimes are available. Customers must rebuild/redeploy with compatible constraints and verify the deployed PHP version. Router multipart blocking is separate mitigation and does not update the runtime or prove a fix in an old deployment.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://doc.scalingo.com/security/bulletins/ssb-2026-005\nAction statement: Rebuild and redeploy with a fixed PHP version, verify the running runtime, and only then consider lifting the separate multipart router restriction."},"CVE-2026-109619":{"status":"Fix","notes":"Scalingo SSB-2026-005 explicitly names both CVEs and confirms all four fixed runtimes are available. Customers must rebuild/redeploy with compatible constraints and verify the deployed PHP version. Router multipart blocking is separate mitigation and does not update the runtime or prove a fix in an old deployment.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://doc.scalingo.com/security/bulletins/ssb-2026-005\nAction statement: Rebuild and redeploy with a fixed PHP version, verify the running runtime, and only then consider lifting the separate multipart router restriction."}}},{"id":"PHP-0652","name":"Scalingo PHP buildpack","vendor":"Scalingo","category":"Containers and distribution","version":"Buildpack-selected PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0652\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Buildpack-provided PHP runtime for web and worker applications\nPHP version scope: Buildpack-selected PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12\nExtensions: Buildpack/application-specific; complete loaded module set unknown\nLimitations: A buildpack update is not proof that an existing slug was rebuilt or redeployed. Application constraints, cached layers and worker restart remain deployment-specific.\nPatch owner: Scalingo for buildpack runtime updates; customer for rebuild, redeploy and restart\nDownstream surface: Applications built with the Scalingo PHP buildpack\nRelease pin: Buildpack-selected PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12\nSource accessed: 2026-10-22\nAliases: Scalingo buildpack-php\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Scalingo confirms the buildpack can select all four fixed PHP releases. Rebuild and redeploy are required; restart-only, custom/forked/pinned buildpacks and incompatible PHP constraints do not automatically receive the fix. The upload-progress configuration workaround alone is not complete remediation.\nCVE-2026-109619: Scalingo confirms the buildpack can select all four fixed PHP releases. Rebuild and redeploy are required; restart-only, custom/forked/pinned buildpacks and incompatible PHP constraints do not automatically receive the fix. The upload-progress configuration workaround alone is not complete remediation.\nVendor advisory sources: https://doc.scalingo.com/security/bulletins/ssb-2026-005\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Scalingo for buildpack runtime updates; customer for rebuild, redeploy and restart","links":["https://doc.scalingo.com/security/bulletins/ssb-2026-005"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Scalingo confirms the buildpack can select all four fixed PHP releases. Rebuild and redeploy are required; restart-only, custom/forked/pinned buildpacks and incompatible PHP constraints do not automatically receive the fix. The upload-progress configuration workaround alone is not complete remediation.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://doc.scalingo.com/security/bulletins/ssb-2026-005\nAction statement: Check stack, PHP constraints and buildpack pin, then rebuild/redeploy and verify the selected fixed PHP version."},"CVE-2026-109619":{"status":"Fix","notes":"Scalingo confirms the buildpack can select all four fixed PHP releases. Rebuild and redeploy are required; restart-only, custom/forked/pinned buildpacks and incompatible PHP constraints do not automatically receive the fix. The upload-progress configuration workaround alone is not complete remediation.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://doc.scalingo.com/security/bulletins/ssb-2026-005\nAction statement: Check stack, PHP constraints and buildpack pin, then rebuild/redeploy and verify the selected fixed PHP version."}}},{"id":"PHP-0653","name":"Take Control Session routing","vendor":"N-able","category":"Monitoring and administration","version":"Not specified","summary":"N-able scoped emergency php2shell maintenance to Take Control session routing rather than the whole Take Control product family.","scope":"Inventory record: PHP-0653\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Hosted web-facing service component named in N-able's php2shell maintenance update\nPHP version scope: Vendor update names PHP vulnerabilities but does not publish the component's exact PHP build.\nExtensions: Unknown\nLimitations: N-able names the session-routing scope separately from the broader Take Control product. Exact PHP build, SAPI, service boundary and customer exposure are not published.\nPatch owner: N-able for hosted service remediation\nDownstream surface: Remote-access session routing and associated service state\nRelease pin: N-able php2shell update published 2026-10-21; service artifact identity not published\nSource accessed: 2026-10-21\nAliases: Take Control session routing\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nVulnerability status: Vendor update 2026-10-21: N-able names Take Control session routing in emergency php2shell maintenance; exact affected/fixed service scope remains pending.\nCVE-2026-109618: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE-2026-109619: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"N-able for hosted service remediation","links":["https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."},"CVE-2026-109619":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."}}},{"id":"PHP-0654","name":"N-sight","vendor":"N-able","category":"Monitoring and administration","version":"Not specified","summary":"N-able lists N-sight among products receiving emergency maintenance and updates for php2shell.","scope":"Inventory record: PHP-0654\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Hosted product surface named in N-able's php2shell maintenance update\nPHP version scope: Vendor update names PHP vulnerabilities but does not publish N-sight's exact PHP build.\nExtensions: Unknown\nLimitations: The vendor update establishes product-level maintenance scope, not the exact PHP component, version, SAPI or reachable service path.\nPatch owner: N-able for hosted service remediation\nDownstream surface: Remote monitoring and management service data and workflows\nRelease pin: N-able php2shell update published 2026-10-21; service artifact identity not published\nSource accessed: 2026-10-21\nAliases: N-sight RMM\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nVulnerability status: Vendor update 2026-10-21: N-able names N-sight in emergency php2shell maintenance; exact affected/fixed service scope remains pending.\nCVE-2026-109618: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE-2026-109619: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"N-able for hosted service remediation","links":["https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."},"CVE-2026-109619":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."}}},{"id":"PHP-0655","name":"Mail Assure / Spam Experts","vendor":"N-able","category":"Mail and analytics","version":"Not specified","summary":"N-able lists Mail Assure / Spam Experts among products receiving emergency maintenance and updates for php2shell.","scope":"Inventory record: PHP-0655\nCategory: Mail and analytics\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Hosted product surface named in N-able's php2shell maintenance update\nPHP version scope: Vendor update names PHP vulnerabilities but does not publish the service's exact PHP build.\nExtensions: Unknown\nLimitations: The vendor update establishes product-level maintenance scope, not the exact PHP component, version, SAPI or reachable service path.\nPatch owner: N-able for hosted service remediation\nDownstream surface: Mail-security administration, quarantine and service workflows\nRelease pin: N-able php2shell update published 2026-10-21; service artifact identity not published\nSource accessed: 2026-10-21\nAliases: Mail Assure, Spam Experts\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nVulnerability status: Vendor update 2026-10-21: N-able names Mail Assure / Spam Experts in emergency php2shell maintenance; exact affected/fixed service scope remains pending.\nCVE-2026-109618: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE-2026-109619: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"N-able for hosted service remediation","links":["https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."},"CVE-2026-109619":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."}}},{"id":"PHP-0656","name":"Passportal","vendor":"N-able","category":"Business applications","version":"Not specified","summary":"N-able lists Passportal among products receiving emergency maintenance and updates for php2shell.","scope":"Inventory record: PHP-0656\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Hosted product surface named in N-able's php2shell maintenance update\nPHP version scope: Vendor update names PHP vulnerabilities but does not publish Passportal's exact PHP build.\nExtensions: Unknown\nLimitations: The vendor update establishes product-level maintenance scope, not the exact PHP component, version, SAPI or reachable service path.\nPatch owner: N-able for hosted service remediation\nDownstream surface: Password, documentation and administrative service workflows\nRelease pin: N-able php2shell update published 2026-10-21; service artifact identity not published\nSource accessed: 2026-10-21\nAliases: N-able Passportal\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nVulnerability status: Vendor update 2026-10-21: N-able names Passportal in emergency php2shell maintenance; exact affected/fixed service scope remains pending.\nCVE-2026-109618: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE-2026-109619: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"N-able for hosted service remediation","links":["https://www.n-able.com/blog/n-able-update-on-the-global-php-issue"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."},"CVE-2026-109619":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."}}},{"id":"PHP-0657","name":"MyUTM portal","vendor":"Sophos","category":"Hosting and cloud","version":"Not specified","summary":"Sophos says its legacy MyUTM portal ran an affected PHP version and was taken offline for update, while stating that Sophos products themselves are not affected.","scope":"Inventory record: PHP-0657\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Legacy hosted portal web runtime\nPHP version scope: Sophos states the MyUTM portal ran an affected PHP version; exact version and fixed deployment identity are not published.\nExtensions: Unknown\nLimitations: This row covers the legacy hosted MyUTM portal only. Sophos explicitly says no Sophos products are affected, so this must not be generalized to Sophos UTM or other product lines.\nPatch owner: Sophos for hosted portal remediation\nDownstream surface: Legacy licensing portal accounts and service operations\nRelease pin: Sophos advisory SA-20261021-PHP2SHELL published 2026-10-21; portal build not published\nSource accessed: 2026-10-21\nAliases: Sophos MyUTM portal\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the hosted service, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the service identity. Provider boundaries, tenant escape and lateral movement require separate evidence.\nVulnerability status: Vendor advisory 2026-10-21: Sophos states the legacy MyUTM portal ran an affected PHP version and was taken offline for update; exact fixed portal deployment remains unpublished.\nCVE-2026-109618: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE-2026-109619: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Sophos for hosted portal remediation","links":["https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."},"CVE-2026-109619":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."}}},{"id":"PHP-0658","name":"phpMyFAQ","vendor":"phpMyFAQ project","category":"Education and knowledge","version":"Not specified","summary":"The official phpMyFAQ Composer manifest declares PHP >=8.4.0, and the release process documents signed CycloneDX SBOM publication.","scope":"Inventory record: PHP-0658\nCategory: Education and knowledge\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime and CLI tooling where configured\nPHP version scope: Official main Composer manifest declares PHP >=8.4.0; exact released artifact pin pending.\nExtensions: Manifest-declared extension set not exhaustively resolved in this candidate pass\nLimitations: A moving branch manifest and release-process SBOM documentation do not prove an installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: phpMyFAQ maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: FAQ content, administration and configured integrations\nRelease pin: Moving official composer.json and release documentation retrieved 2026-10-21\nSource accessed: 2026-10-21\nAliases: thorsten/phpMyFAQ\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement and SBOM publication evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"phpMyFAQ maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/thorsten/phpMyFAQ/blob/main/composer.json","https://github.com/thorsten/phpMyFAQ/blob/main/docs/release.md"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0659","name":"OpenEMR","vendor":"OpenEMR project","category":"Business applications","version":"Binary Docker recipe b171ac28a57e5da96b1b8eaceb7324edac045948; Forge release 10212026 with PHP 8.5.12 (OpenEMR 8.4.1)","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0659\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Server-side PHP web application runtime\nPHP version scope: Binary Docker recipe b171ac28a57e5da96b1b8eaceb7324edac045948; Forge release 10212026 with PHP 8.5.12 (OpenEMR 8.4.1)\nExtensions: Official Composer manifest lists required PHP extensions; exact deployed set not measured\nLimitations: A moving branch manifest and Composer platform pin do not establish the exact supported release matrix, installed runtime, loaded modules or reachable affected path.\nPatch owner: OpenEMR maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Clinical records, scheduling, billing and administrative workflows\nRelease pin: Binary Docker recipe b171ac28a57e5da96b1b8eaceb7324edac045948; Forge release 10212026 with PHP 8.5.12 (OpenEMR 8.4.1)\nSource accessed: 2026-10-22\nAliases: openemr/openemr\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: OpenEMR's maintainer merged PR 14773, adopting the published binary-forge release 10212026 with fixed PHP 8.5.12. This confirms the corrected binary Docker recipe and its named forge build only. The separate standard Alpine-image update PR 14771 was still unmerged when reviewed; no blanket fix for all OpenEMR distributions is claimed.\nCVE-2026-109619: OpenEMR's maintainer merged PR 14773, adopting the published binary-forge release 10212026 with fixed PHP 8.5.12. This confirms the corrected binary Docker recipe and its named forge build only. The separate standard Alpine-image update PR 14771 was still unmerged when reviewed; no blanket fix for all OpenEMR distributions is claimed.\nVendor advisory sources: https://github.com/openemr/openemr/pull/14773; https://github.com/openemr/openemr/blob/b171ac28a57e5da96b1b8eaceb7324edac045948/docker/binary/README.md\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"OpenEMR maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/openemr/openemr/blob/master/composer.json","https://github.com/openemr/openemr/pull/14773","https://github.com/openemr/openemr/blob/b171ac28a57e5da96b1b8eaceb7324edac045948/docker/binary/README.md"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"OpenEMR's maintainer merged PR 14773, adopting the published binary-forge release 10212026 with fixed PHP 8.5.12. This confirms the corrected binary Docker recipe and its named forge build only. The separate standard Alpine-image update PR 14771 was still unmerged when reviewed; no blanket fix for all OpenEMR distributions is claimed.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/openemr/openemr/pull/14773; https://github.com/openemr/openemr/blob/b171ac28a57e5da96b1b8eaceb7324edac045948/docker/binary/README.md\nAction statement: Rebuild/deploy using the corrected binary Docker recipe or independently update the actual hosting PHP runtime. Do not assume standard Alpine images or existing installations were rebuilt."},"CVE-2026-109619":{"status":"Fix","notes":"OpenEMR's maintainer merged PR 14773, adopting the published binary-forge release 10212026 with fixed PHP 8.5.12. This confirms the corrected binary Docker recipe and its named forge build only. The separate standard Alpine-image update PR 14771 was still unmerged when reviewed; no blanket fix for all OpenEMR distributions is claimed.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/openemr/openemr/pull/14773; https://github.com/openemr/openemr/blob/b171ac28a57e5da96b1b8eaceb7324edac045948/docker/binary/README.md\nAction statement: Rebuild/deploy using the corrected binary Docker recipe or independently update the actual hosting PHP runtime. Do not assume standard Alpine images or existing installations were rebuilt."}}},{"id":"PHP-0660","name":"Akeneo PIM Community Edition","vendor":"Akeneo","category":"Business applications","version":"Not specified","summary":"The official Akeneo PIM Community Edition Composer manifest declares PHP 8.1.* and required extensions.","scope":"Inventory record: PHP-0660\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web application and CLI runtime\nPHP version scope: Official master Composer manifest declares PHP 8.1.*; exact released artifact pin pending.\nExtensions: Official Composer manifest lists required PHP extensions; exact deployed set not measured\nLimitations: A moving branch manifest does not establish the exact release support matrix, installed runtime, loaded modules or reachable affected path.\nPatch owner: Akeneo for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Product catalogue, imports, APIs and administrative workflows\nRelease pin: Moving official composer.json retrieved 2026-10-21; immutable release artifact pin pending\nSource accessed: 2026-10-21\nAliases: akeneo/pim-community-dev\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Akeneo for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/akeneo/pim-community-dev/blob/master/composer.json"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0661","name":"FreshRSS","vendor":"FreshRSS project","category":"CMS and publishing","version":"Not specified","summary":"Official FreshRSS server requirements state that current releases are PHP web applications requiring PHP 8.1+.","scope":"Inventory record: PHP-0661\nCategory: CMS and publishing\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime\nPHP version scope: Official current server requirements state PHP 8.1+; exact release artifact pin pending.\nExtensions: Official requirements page lists required modules; exact deployed set not measured\nLimitations: Moving requirements documentation does not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: FreshRSS maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Feed ingestion, reader sessions and administrative configuration\nRelease pin: Moving official server requirements retrieved 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: FreshRSS/FreshRSS\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"FreshRSS maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://freshrss.github.io/FreshRSS/en/admins/02_Prerequisites.html"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0662","name":"HumHub","vendor":"HumHub","category":"Collaboration and storage","version":"Not specified","summary":"Official HumHub requirements document Apache/mod_php or PHP-FPM deployment options and a current PHP compatibility matrix.","scope":"Inventory record: PHP-0662\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime via Apache/mod_php or PHP-FPM\nPHP version scope: Official requirements page publishes a current PHP compatibility matrix; exact release row not pinned here.\nExtensions: Official requirements page lists PHP modules; exact deployed set not measured\nLimitations: A moving requirements page does not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: HumHub maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Community content, identity, messaging and administrative workflows\nRelease pin: Moving official requirements documentation retrieved 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: humhub/humhub\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"HumHub maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://docs.humhub.org/docs/admin/requirements/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0663","name":"wallabag","vendor":"wallabag project","category":"Collaboration and storage","version":"Not specified","summary":"Official wallabag requirements state compatibility with PHP >=7.4 and require PHP-FPM plus extensions.","scope":"Inventory record: PHP-0663\nCategory: Collaboration and storage\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP-FPM web runtime\nPHP version scope: Official requirements state PHP >=7.4; exact release artifact pin pending.\nExtensions: Official requirements page lists PHP extensions; exact deployed set not measured\nLimitations: Moving requirements documentation does not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: wallabag maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Saved content, user sessions, imports and administrative configuration\nRelease pin: Moving official requirements documentation retrieved 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: wallabag/wallabag\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"wallabag maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://doc.wallabag.org/admin/installation/requirements/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0664","name":"Clientexec","vendor":"Clientexec","category":"Business applications","version":"Not specified","summary":"Official Clientexec system requirements list PHP runtime support for Clientexec 6.x and 7.x plus required extensions and ionCube Loader versions.","scope":"Inventory record: PHP-0664\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime\nPHP version scope: Official requirements page lists PHP support by Clientexec 6.x and 7.x branch; exact installed branch not measured.\nExtensions: Official requirements page lists required PHP extensions and ionCube Loader versions; exact deployed set not measured\nLimitations: Branch-level requirements documentation does not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Clientexec for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Billing, hosting management, customer accounts and administrative workflows\nRelease pin: Moving official system requirements retrieved 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: Clientexec 6.x, Clientexec 7.x\nConditional downstream consequence: If untrusted requests or media reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Application data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Clientexec for application releases; PHP runtime provider and operator for runtime fixes","links":["https://docs.clientexec.com/en/article/system-requirements-yl750s/"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or SBOM evidence only; CVE match unknown","action":"","detail":"Added from official product manifests, requirements pages or SBOM documentation reviewed 2026-10-21. These sources establish PHP product relationships, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0665","name":"Coolify","vendor":"Coolify","category":"Hosting and cloud","version":"Coolify 4.0.1 / 4.1.3 / 4.2.1 / 4.3.24 / 4.4.7 on their respective v4 lines","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0665\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Server-side Laravel/PHP web runtime and control-plane workers\nPHP version scope: Coolify 4.0.1 / 4.1.3 / 4.2.1 / 4.3.24 / 4.4.7 on their respective v4 lines\nExtensions: Manifest-declared extension set not exhaustively resolved in this candidate pass\nLimitations: A moving branch manifest and repository SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Coolify maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Deployment credentials, hosted service configuration, secrets and administrative workflows\nRelease pin: Coolify 4.0.1 / 4.1.3 / 4.2.1 / 4.3.24 / 4.4.7 on their respective v4 lines\nSource accessed: 2026-10-22\nAliases: coollabsio/coolify\nConditional downstream consequence: If untrusted requests or control-plane workflows reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Managed workloads, stored credentials and configuration could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes.\nCVE-2026-109619: Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes.\nVendor advisory sources: https://github.com/coollabsio/coolify/issues/12266\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Coolify maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/coollabsio/coolify/blob/main/composer.json","https://api.github.com/repos/coollabsio/coolify/dependency-graph/sbom","https://github.com/coollabsio/coolify/issues/12266"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/coollabsio/coolify/issues/12266\nAction statement: Update Coolify to the fixed release for its v4 line, preferably 4.4.7, using the official supported procedure; patch hosted application runtimes separately."},"CVE-2026-109619":{"status":"Fix","notes":"Coolify's project-member security announcement explicitly states both CVEs affect its v4 releases and lists released backports for every v4 line. It recommends 4.4.7 and confirms Coolify Cloud is already patched. This does not establish that arbitrary PHP applications deployed by Coolify have updated their own runtimes.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/coollabsio/coolify/issues/12266\nAction statement: Update Coolify to the fixed release for its v4 line, preferably 4.4.7, using the official supported procedure; patch hosted application runtimes separately."}}},{"id":"PHP-0666","name":"Firefly III","vendor":"Firefly III project","category":"Business applications","version":"Rebuilt existing Firefly III container tags with PHP 8.5.12; maintainer confirmation 2026-10-21","summary":"Vendor-confirmed fix available in the listed PHP runtime/build scope; see the CVE assessment for exclusions and deployment requirements.","scope":"Inventory record: PHP-0666\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed runtime/build scope\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime and REST API\nPHP version scope: Rebuilt existing Firefly III container tags with PHP 8.5.12; maintainer confirmation 2026-10-21\nExtensions: Repository manifest and deployment-specific extension set not exhaustively resolved in this candidate pass\nLimitations: Repository metadata and dependency-graph SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Firefly III maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Personal finance records, imported transactions, API tokens and administrative configuration\nRelease pin: Rebuilt existing Firefly III container tags with PHP 8.5.12; maintainer confirmation 2026-10-21\nSource accessed: 2026-10-22\nAliases: firefly-iii/firefly-iii\nConditional downstream consequence: If untrusted requests or imported data reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Financial data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nPublic vendor CVE review: 2026-10-22\nVulnerability status: Fix available within the scope below for both PHP2Shell CVEs.\nCVE-2026-109618: Firefly III's maintainer JC5 explicitly confirms that Firefly III and its data importer now run PHP 8.5.12 and closes the CVE issue. Existing image tags were rebuilt without a new application release. This confirms the container runtime fix, not a PHP update for independently hosted non-container installations.\nCVE-2026-109619: Firefly III's maintainer JC5 explicitly confirms that Firefly III and its data importer now run PHP 8.5.12 and closes the CVE issue. Existing image tags were rebuilt without a new application release. This confirms the container runtime fix, not a PHP update for independently hosted non-container installations.\nVendor advisory sources: https://github.com/firefly-iii/firefly-iii/issues/13087#issuecomment-6324447202\nCVE assessment limit: Only the vendor-confirmed runtime/build scope stated above is assessed. Publication does not establish every deployed instance, unrelated product variant, or prior compromise; no package/image was installed or executed. Earlier dependency context is not an independent vulnerability assessment.","owner":"Firefly III maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/firefly-iii/firefly-iii","https://api.github.com/repos/firefly-iii/firefly-iii/dependency-graph/sbom","https://github.com/firefly-iii/firefly-iii/issues/13087#issuecomment-6324447202"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Firefly III's maintainer JC5 explicitly confirms that Firefly III and its data importer now run PHP 8.5.12 and closes the CVE issue. Existing image tags were rebuilt without a new application release. This confirms the container runtime fix, not a PHP update for independently hosted non-container installations.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/firefly-iii/firefly-iii/issues/13087#issuecomment-6324447202\nAction statement: Pull the rebuilt container tag and recreate the workload, then verify PHP 8.5.12. Non-container installations must update their own PHP runtime."},"CVE-2026-109619":{"status":"Fix","notes":"Firefly III's maintainer JC5 explicitly confirms that Firefly III and its data importer now run PHP 8.5.12 and closes the CVE issue. Existing image tags were rebuilt without a new application release. This confirms the container runtime fix, not a PHP update for independently hosted non-container installations.","action":"","detail":"Official public vendor/upstream evidence independently reviewed 2026-10-22: https://github.com/firefly-iii/firefly-iii/issues/13087#issuecomment-6324447202\nAction statement: Pull the rebuilt container tag and recreate the workload, then verify PHP 8.5.12. Non-container installations must update their own PHP runtime."}}},{"id":"PHP-0667","name":"Monica","vendor":"Monica project","category":"Business applications","version":"Not specified","summary":"The official Monica Composer manifest declares PHP ^8.3 for the personal CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","scope":"Inventory record: PHP-0667\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side Laravel/PHP web runtime\nPHP version scope: Official main Composer manifest declares PHP ^8.3; exact released artifact pin pending.\nExtensions: Official Composer manifest lists required PHP extensions; exact deployed set not measured\nLimitations: A moving branch manifest and repository SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Monica maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Contacts, reminders, notes, identity data and administrative workflows\nRelease pin: Moving official composer.json and GitHub dependency-graph SBOM export reviewed 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: monicahq/monica\nConditional downstream consequence: If untrusted requests or imports reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Personal relationship data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement and GitHub dependency-graph SBOM evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Monica maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/monicahq/monica/blob/main/composer.json","https://api.github.com/repos/monicahq/monica/dependency-graph/sbom"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0668","name":"Cachet","vendor":"Cachet project","category":"Monitoring and administration","version":"Not specified","summary":"The official Cachet repository requires PHP 8.3 or later for the self-hosted status page system, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","scope":"Inventory record: PHP-0668\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side Laravel/PHP web runtime\nPHP version scope: Official repository requirements state PHP 8.3 or later; exact released artifact pin pending.\nExtensions: Official repository requirements and manifest are not exhaustively resolved in this candidate pass\nLimitations: Moving repository requirements and dependency-graph SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Cachet maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Incident data, component status, administrative accounts and integrations\nRelease pin: Moving official repository requirements and GitHub dependency-graph SBOM export reviewed 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: cachethq/cachet\nConditional downstream consequence: If untrusted requests reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Status data, admin sessions and configured integrations could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement and GitHub dependency-graph SBOM evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Cachet maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/cachethq/cachet","https://api.github.com/repos/cachethq/cachet/dependency-graph/sbom"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0669","name":"Krayin CRM","vendor":"Krayin","category":"Business applications","version":"Not specified","summary":"The official Krayin CRM repository requires PHP 8.3 or higher for the Laravel CRM, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","scope":"Inventory record: PHP-0669\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side Laravel/PHP web runtime\nPHP version scope: Official repository requirements state PHP 8.3 or higher; exact released artifact pin pending.\nExtensions: Official repository requirements and manifest are not exhaustively resolved in this candidate pass\nLimitations: Moving repository requirements and dependency-graph SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Krayin maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Customer records, leads, sales pipelines, integrations and administrative workflows\nRelease pin: Moving official repository requirements and GitHub dependency-graph SBOM export reviewed 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: krayin/laravel-crm\nConditional downstream consequence: If untrusted requests or imports reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. CRM data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement and GitHub dependency-graph SBOM evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Krayin maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/krayin/laravel-crm","https://api.github.com/repos/krayin/laravel-crm/dependency-graph/sbom"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0670","name":"QloApps","vendor":"QloApps","category":"Business applications","version":"Not specified","summary":"The official QloApps repository identifies a hotel management and reservation platform with PHP application code, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","scope":"Inventory record: PHP-0670\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side PHP web runtime and back-office workflows\nPHP version scope: Official repository metadata and project guidance establish a PHP backend; exact supported release and runtime pin pending.\nExtensions: Official project guidance lists PHP extensions; exact deployed set not measured\nLimitations: Repository metadata and dependency-graph SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: QloApps maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Guest records, bookings, room inventory, payments and administrative workflows\nRelease pin: Moving official repository and GitHub dependency-graph SBOM export reviewed 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: Qloapps/QloApps\nConditional downstream consequence: If untrusted requests or booking workflows reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Guest, booking and payment-adjacent data could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official repository and GitHub dependency-graph SBOM evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"QloApps maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/Qloapps/QloApps","https://api.github.com/repos/Qloapps/QloApps/dependency-graph/sbom"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0671","name":"UnoPim","vendor":"UnoPim","category":"Business applications","version":"Not specified","summary":"The official UnoPim repository documents a Laravel PIM/DAM platform requiring PHP 8.4.1+, and GitHub exposes an SPDX dependency-graph SBOM for the repository.","scope":"Inventory record: PHP-0671\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side Laravel/PHP web runtime and queue workers\nPHP version scope: Official repository requirements state PHP 8.4.1+; exact released artifact pin pending.\nExtensions: Official repository requirements list PHP extensions; exact deployed set not measured\nLimitations: Moving repository requirements and dependency-graph SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: UnoPim maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Product catalogues, digital assets, import/export jobs, APIs and administrative workflows\nRelease pin: Moving official repository requirements and GitHub dependency-graph SBOM export reviewed 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: unopim/unopim\nConditional downstream consequence: If untrusted requests, imports or assets reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Product data, media and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement and GitHub dependency-graph SBOM evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"UnoPim maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/unopim/unopim","https://api.github.com/repos/unopim/unopim/dependency-graph/sbom"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0672","name":"Crater","vendor":"Crater Invoice","category":"Business applications","version":"Not specified","summary":"The official Crater repository identifies an invoicing application and its installer config sets a minimum PHP version of 7.4.0; GitHub exposes an SPDX dependency-graph SBOM for the repository.","scope":"Inventory record: PHP-0672\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Confirmed relationship\nDeployment status: Not measured\nPHP surface: Server-side Laravel/PHP web runtime\nPHP version scope: Official installer config sets minPhpVersion to 7.4.0; exact released artifact pin pending.\nExtensions: Official installer config lists required PHP extensions; exact deployed set not measured\nLimitations: Moving repository files and dependency-graph SBOM do not prove a particular installed release, PHP build, loaded modules or reachable affected path.\nPatch owner: Crater maintainers for application releases; PHP runtime provider and operator for runtime fixes\nDownstream surface: Invoices, customer records, payment workflows and administrative configuration\nRelease pin: Moving official installer config and GitHub dependency-graph SBOM export reviewed 2026-10-21; immutable release pin pending\nSource accessed: 2026-10-21\nAliases: crater-invoice-inc/crater\nConditional downstream consequence: If untrusted requests or imports reach a matching PHP core/extension flaw, the PHP worker could suffer denial of service, disclosure or code execution. Billing data and configured credentials could then be affected within that worker's permissions; host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Candidate added from official PHP requirement and GitHub dependency-graph SBOM evidence; no product-specific php2shell assessment located in this pass.\nCVE-2026-109618: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE-2026-109619: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Crater maintainers for application releases; PHP runtime provider and operator for runtime fixes","links":["https://github.com/crater-invoice-inc/crater/blob/master/config/installer.php","https://api.github.com/repos/crater-invoice-inc/crater/dependency-graph/sbom"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."},"CVE-2026-109619":{"status":"Investigation","notes":"Official PHP requirement or GitHub SBOM evidence only; CVE match unknown","action":"","detail":"Added from official repositories, manifests, requirements and GitHub dependency-graph SPDX SBOM exports reviewed 2026-10-21. These sources establish PHP product relationships and dependency-graph presence, not CVE-specific affected or fixed deployment scope."}}},{"id":"PHP-0673","name":"KACE Systems Management Appliance","vendor":"Quest Software","category":"Monitoring and administration","version":"Not specified","summary":"Quest published KB 4385046 in the KACE Systems Management Appliance support feed as a response to CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0673\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named appliance web/admin surface; exact PHP component and SAPI are not published in the accessible RSS evidence\nPHP version scope: Quest KB 4385046 names both CVEs in a KACE Systems Management Appliance support item; exact affected/fixed PHP build and appliance versions are not available from the accessible RSS evidence.\nExtensions: Unknown\nLimitations: The article body is blocked by Quest's WAF/JavaScript challenge in this pass; the RSS feed proves publication and product association, not exact affected versions, fix state or reachable path.\nPatch owner: Quest for appliance remediation\nDownstream surface: Device management, patching, asset inventory, service desk and administrative workflows\nRelease pin: Quest KB 4385046 published 2026-10-21 09:58:20 GMT in the KACE Systems Management Appliance RSS feed; appliance artifact and version not pinned\nSource accessed: 2026-10-22\nAliases: KACE SMA, Quest KACE Systems Management Appliance\nConditional downstream consequence: If a matching PHP or enabled native-extension flaw is reachable through the appliance web surface, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the appliance service identity. Host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Vendor bulletin 2026-10-21: Quest published a KACE Systems Management Appliance response item for both php2shell CVEs; exact affected/fixed appliance scope remains unresolved.\nCVE-2026-109618: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE-2026-109619: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Quest for appliance remediation","links":["https://support.quest.com/kace-systems-management-appliance/kb/4385046/4385046","https://support.quest.com/kace-systems-management-appliance/rss"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."},"CVE-2026-109619":{"status":"Investigation","notes":"Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation","action":"","detail":"Added from vendor php2shell notices published 2026-10-21 and reviewed through 2026-10-22. The notices name these products or hosted services in the response, but the exact affected/fixed PHP artifact scope and deployment state remain unresolved."}}},{"id":"PHP-0674","name":"Checkmk Appliance","vendor":"Checkmk GmbH","category":"Appliances and embedded","version":"1.7.25","summary":"Checkmk's appliance 1.7.25 release manifest upgrades bundled PHP 8.2 packages from 8.2.34 to 8.2.35, the upstream fixed release for both php2shell CVEs.","scope":"Inventory record: PHP-0674\nCategory: Appliances and embedded\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor release manifest plus upstream fixed release\nDeployment status: Not measured\nPHP surface: Appliance-bundled PHP 8.2 packages, including php8.2-cgi and libphp8.2-embed; exact reachable appliance web paths and SAPI use are not independently measured\nPHP version scope: Checkmk Appliance 1.7.25 ChangedPackages upgrades libphp8.2-embed, php8.2, php8.2-cgi, php8.2-cli, php8.2-common and related modules from 8.2.34-1~deb12u1 to 8.2.35-1~deb12u1. PHP upstream identifies 8.2.35 as a fixed release for both CVEs.\nExtensions: ChangedPackages lists gd, opcache, readline, snmp, sqlite3 and xml packages alongside common/CGI/CLI/embed; full loaded module set remains deployment-specific\nLimitations: This row records the fixed 1.7.25 appliance firmware scope only. It does not prove update rollout, worker restart, the exact vulnerable path in earlier firmware, or applicability to separately installed Checkmk packages, Docker images or hosted services.\nPatch owner: Checkmk for appliance firmware; operator for firmware rollout and service restart\nDownstream surface: Appliance administration and embedded monitoring workflows\nRelease pin: Checkmk Appliance 1.7.25 published 2026-10-21; ChangedPackages manifest reviewed 2026-10-22\nSource accessed: 2026-10-22\nAliases: CMA, Checkmk virtual appliance, Checkmk physical appliance\nConditional downstream consequence: Updating to the fixed bundled PHP package removes the underlying php2shell runtime flaws for workers actually using the updated appliance firmware. Older appliance builds and services still running pre-update workers remain separate deployment questions.\nVulnerability status: Fixed in Checkmk Appliance 1.7.25 by bundled PHP 8.2.35 package update, based on the vendor release manifest and PHP upstream's fixed-release advisory.\nCVE-2026-109618: Fixed in appliance firmware 1.7.25 via bundled PHP 8.2.35 package update\nCVE-2026-109619: Fixed in appliance firmware 1.7.25 via bundled PHP 8.2.35 package update\nCVE assessment limit: Vendor manifest proves the 1.7.25 package delta; installed firmware, service restart, configuration, loaded modules and reachable path still need deployment-specific evidence.","owner":"Checkmk for appliance firmware; operator for firmware rollout and service restart","links":["https://checkmk.com/werks?product=cma","https://download.checkmk.com/appliance/1.7.25/ChangedPackages","https://www.php.net/archive/2026.php#2026-10-21-5"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update","action":"","detail":"Added from the Checkmk Appliance 1.7.25 changed-package manifest published 2026-10-21 and the PHP upstream advisory. The manifest upgrades bundled PHP 8.2 packages from 8.2.34-1~deb12u1 to 8.2.35-1~deb12u1; PHP upstream identifies 8.2.35 as fixed for both CVEs.\nAction statement: Update the appliance to firmware 1.7.25 or later and verify the running appliance services use the updated packages."},"CVE-2026-109619":{"status":"Fix","notes":"Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update","action":"","detail":"Added from the Checkmk Appliance 1.7.25 changed-package manifest published 2026-10-21 and the PHP upstream advisory. The manifest upgrades bundled PHP 8.2 packages from 8.2.34-1~deb12u1 to 8.2.35-1~deb12u1; PHP upstream identifies 8.2.35 as fixed for both CVEs.\nAction statement: Update the appliance to firmware 1.7.25 or later and verify the running appliance services use the updated packages."}}},{"id":"PHP-0675","name":"Securepoint Resellerportal","vendor":"Securepoint GmbH","category":"Business applications","version":"Not specified","summary":"Securepoint's live Resellerportal login HTML exposes Laravel application markers and a Securepoint resellerportal session cookie.","scope":"Inventory record: PHP-0675\nCategory: Business applications\nOriginal relationship: requires\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Live vendor portal implementation evidence\nDeployment status: Not measured\nPHP surface: Server-side Laravel web application exposed by the vendor-operated reseller portal login page\nPHP version scope: The live login HTML exposes window.Laravel and a Securepoint resellerportal session cookie, but does not disclose the Laravel release, PHP branch, patch level, SAPI or loaded modules.\nExtensions: Unknown\nLimitations: Live HTML markers establish a Laravel/PHP relationship, not an affected PHP build or a product-specific php2shell advisory. No authenticated area, application version, deployment topology, reachable vulnerable path or fix state was measured.\nPatch owner: Securepoint for hosted portal remediation\nDownstream surface: Reseller portal authentication and account workflows\nRelease pin: Live portal HTML observed 2026-10-22; immutable release or deployment artifact not published\nSource accessed: 2026-10-22\nAliases: Securepoint Reseller Portal, my.securepoint.de\nConditional downstream consequence: If untrusted requests reach a matching PHP core or enabled-extension flaw in the portal worker, possible effects include worker denial of service, disclosure of service-accessible secrets, data modification or code execution with the portal service identity. Host privilege, tenant escape and lateral movement require separate evidence.\nVulnerability status: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope remain unknown.\nCVE-2026-109618: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown\nCVE-2026-109619: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown\nCVE assessment limit: This candidate record confirms PHP relationship evidence only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path still need deployment-specific evidence.","owner":"Securepoint for hosted portal remediation","links":["https://my.securepoint.de/","https://laravel.com/framework/docs/deployment"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown","action":"","detail":"Added from the Securepoint Resellerportal login page reviewed 2026-10-22. The live vendor page exposes Laravel application markers, but does not publish the portal's PHP runtime version, SAPI, loaded modules or a product-specific php2shell assessment."},"CVE-2026-109619":{"status":"Investigation","notes":"Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown","action":"","detail":"Added from the Securepoint Resellerportal login page reviewed 2026-10-22. The live vendor page exposes Laravel application markers, but does not publish the portal's PHP runtime version, SAPI, loaded modules or a product-specific php2shell assessment."}}},{"id":"PHP-0676","name":"Check Point firewall web interfaces","vendor":"Check Point","category":"Appliances and embedded","version":"Force/Cloud: R81.20, R82, R82.10, R82.20; EoS R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10. Spark: R81.10.x, R82.00.x; EoS R77.20.x, R80.20.x","summary":"Check Point sk1000302 identifies both CVEs as affecting listed Force, Spark and Cloud Firewall web interfaces only when specified portal or VPN features are enabled; Check Point Portal and SaaS services are already patched.","scope":"Inventory record: PHP-0676\nCategory: Appliances and embedded\nOriginal relationship: component\nRelationship direction: depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: Check Point says PHP vulnerabilities may allow remote code execution through firewall web interfaces under certain circumstances.\nPHP version scope: Force and Cloud Firewalls: R81.20, R82, R82.10, R82.20; EoS R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10. Spark Firewalls: R81.10.x and R82.00.x; EoS R77.20.x and R80.20.x.\nExtensions: Unknown\nImportant boundary: Exposure requires one or more listed features: Mobile Access Portal, Remote Access VPN with SSL Network Extender, Remote Access VPN with SAML Realm authentication, or Identity Awareness Captive Portal. Mobile Access Portal and SSL Network Extender do not apply to Spark Firewalls. Check Point Portal and SaaS services are already patched, and this assessment does not extend to unrelated firewall paths.\nPatch owner: Check Point for firewall software and mitigations; operator for Automatic Updates, manual mitigation and future Jumbo Hotfix rollout\nPossible abuse: The vendor states that the PHP flaws may allow remote code execution through the affected firewall web interfaces. Wider appliance control and downstream impact remain deployment-specific.\nPHP component loss: The affected portal or authentication interface could be unavailable after mitigation or compromise; packet forwarding and other appliance functions are not independently assessed here.\nWhole appliance loss: Whole-firewall shutdown could interrupt protected traffic if failover or alternative routing does not preserve connectivity.\nConditions: Requires an affected listed version and at least one vendor-listed portal or VPN feature enabled; deployment, exposure and mitigation state remain unmeasured.\nSource accessed: 2026-10-22\nPublic vendor CVE review: 2026-10-22\nVendor advisory sources: https://support.checkpoint.com/results/sk/sk1000302\nVulnerability status: Check Point sk1000302 identifies both CVEs as affecting listed Force, Spark and Cloud Firewall web interfaces when specified portal or VPN features are enabled; fixes are planned for 2026-11-11.\nCVE-2026-109618: Vendor-confirmed affected firewall web-interface scope with feature-dependent exposure; fix planned for 2026-11-11\nCVE-2026-109619: Vendor-confirmed affected firewall web-interface scope with feature-dependent exposure; fix planned for 2026-11-11\nCVE assessment limit: Installed versions, enabled features, Automatic Updates state, manual mitigation state, reachable inputs and exploitation remain deployment-specific.","owner":"Check Point for firewall software and mitigations; operator for Automatic Updates, manual mitigation and future Jumbo Hotfix rollout","links":["https://support.checkpoint.com/results/sk/sk1000302"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"Check Point sk1000302 identifies listed Force, Spark and Cloud Firewall web interfaces as affected when specified portal or VPN features are enabled; Jumbo Hotfix fixes are planned for 2026-11-11.","action":"Follow the vendor mitigation guidance pending the planned Jumbo Hotfix release, and verify Automatic Updates or manual mitigation state on affected firewall deployments.","detail":"Added from Check Point sk1000302 created 2026-10-21 and updated/reviewed 2026-10-22. The vendor identifies both CVEs as affecting listed Force, Spark and Cloud Firewall versions that use Mobile Access Portal, Remote Access VPN with SSL Network Extender, Remote Access VPN with SAML Realm authentication, or Identity Awareness Captive Portal. Check Point says Portal and SaaS services are already patched, plans an Automatic Updates mitigation before 2026-10-22 21:00 GMT, and plans fixes in Jumbo Hotfix Accumulators on 2026-11-11."},"CVE-2026-109619":{"status":"Vulnerable","notes":"Check Point sk1000302 identifies listed Force, Spark and Cloud Firewall web interfaces as affected when specified portal or VPN features are enabled; Jumbo Hotfix fixes are planned for 2026-11-11.","action":"Follow the vendor mitigation guidance pending the planned Jumbo Hotfix release, and verify Automatic Updates or manual mitigation state on affected firewall deployments.","detail":"Added from Check Point sk1000302 created 2026-10-21 and updated/reviewed 2026-10-22. The vendor identifies both CVEs as affecting listed Force, Spark and Cloud Firewall versions that use Mobile Access Portal, Remote Access VPN with SSL Network Extender, Remote Access VPN with SAML Realm authentication, or Identity Awareness Captive Portal. Check Point says Portal and SaaS services are already patched, plans an Automatic Updates mitigation before 2026-10-22 21:00 GMT, and plans fixes in Jumbo Hotfix Accumulators on 2026-11-11."}}},{"id":"PHP-0686","name":"Cisco Hypershield","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Hypershield as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0686\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Hypershield under 'Products Under Investigation' (Network and Content Security Devices); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0687","name":"Cisco Identity Services Engine (ISE)","vendor":"Cisco","category":"Appliances and embedded","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Identity Services Engine (ISE) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0687\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Identity Services Engine (ISE) under 'Products Under Investigation' (Network and Content Security Devices); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0688","name":"Cisco Business Process Automation (BPA)","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Business Process Automation (BPA) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0688\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Business Process Automation (BPA) under 'Products Under Investigation' (Network Management and Provisioning); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0689","name":"Cisco Catalyst Center (formerly DNA Center)","vendor":"Cisco","category":"Appliances and embedded","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Catalyst Center (formerly DNA Center) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0689\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Catalyst Center (formerly DNA Center) under 'Products Under Investigation' (Network Management and Provisioning); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0690","name":"Cisco Catalyst SD-WAN Manager","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Catalyst SD-WAN Manager as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0690\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Catalyst SD-WAN Manager under 'Products Under Investigation' (Network Management and Provisioning); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0691","name":"Cisco Nexus Dashboard Insights","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Nexus Dashboard Insights as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0691\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Nexus Dashboard Insights under 'Products Under Investigation' (Network Management and Provisioning); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0692","name":"Cisco WAN Automation Engine (WAE)","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco WAN Automation Engine (WAE) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0692\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco WAN Automation Engine (WAE) under 'Products Under Investigation' (Network Management and Provisioning); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0693","name":"Cisco ASR 5000 Series Software (StarOS)","vendor":"Cisco","category":"Appliances and embedded","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco ASR 5000 Series Software (StarOS) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0693\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco ASR 5000 Series Software (StarOS) under 'Products Under Investigation' (Routing and Switching - Service Provider); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0694","name":"Cisco Policy Suite (CPS)","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Policy Suite (CPS) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0694\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Policy Suite (CPS) under 'Products Under Investigation' (Routing and Switching - Service Provider); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0695","name":"Cisco Ultra Cloud Core - Converged Policy and Charging","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra Cloud Core - Converged Policy and Charging as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0695\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Ultra Cloud Core - Converged Policy and Charging under 'Products Under Investigation' (Routing and Switching - Service Provider); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0696","name":"Cisco Ultra Cloud Core - Policy Control Function","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra Cloud Core - Policy Control Function as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0696\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Ultra Cloud Core - Policy Control Function under 'Products Under Investigation' (Routing and Switching - Service Provider); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0697","name":"Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0697\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Ultra Cloud Core - Subscriber Microservices Infrastructure under 'Products Under Investigation' (Routing and Switching - Service Provider); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0698","name":"Cisco Expressway Series","vendor":"Cisco","category":"Appliances and embedded","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Expressway Series as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0698\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Expressway Series under 'Products Under Investigation' (Voice and Unified Communications Devices); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0699","name":"Cisco Ultra-Reliable Wireless Backhaul (URWB)","vendor":"Cisco","category":"Appliances and embedded","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Ultra-Reliable Wireless Backhaul (URWB) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0699\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Ultra-Reliable Wireless Backhaul (URWB) under 'Products Under Investigation' (Wireless); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0700","name":"Cisco Unified Industrial Wireless Software","vendor":"Cisco","category":"Appliances and embedded","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Unified Industrial Wireless Software as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0700\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Unified Industrial Wireless Software under 'Products Under Investigation' (Wireless); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0701","name":"AppDynamics On-Premises Secure Application","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists AppDynamics On-Premises Secure Application as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0701\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists AppDynamics On-Premises Secure Application under 'Products Under Investigation' (Application Observability); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0702","name":"AppDynamics PHP Agent","vendor":"Cisco","category":"SDKs and integrations","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists AppDynamics PHP Agent as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0702\nCategory: SDKs and integrations\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists AppDynamics PHP Agent under 'Products Under Investigation' (Application Observability); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0703","name":"AppDynamics SaaS Secure Application","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists AppDynamics SaaS Secure Application as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0703\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists AppDynamics SaaS Secure Application under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0704","name":"Cisco CX Cloud","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco CX Cloud as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0704\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco CX Cloud under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0705","name":"Cisco Defense Orchestrator","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Defense Orchestrator as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0705\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Defense Orchestrator under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0706","name":"Cisco IoT Control Center","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco IoT Control Center as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0706\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco IoT Control Center under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0707","name":"Cisco Multicloud Defense","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Multicloud Defense as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0707\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Multicloud Defense under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0708","name":"Cisco Panoptica","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Panoptica as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0708\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Panoptica under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0709","name":"Cisco Secure Access","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Secure Access as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0709\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Secure Access under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0710","name":"Cisco Secure Email Threat Defense","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Secure Email Threat Defense as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0710\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Secure Email Threat Defense under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0711","name":"Cisco Vulnerability Management (formerly Kenna.VM)","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco Vulnerability Management (formerly Kenna.VM) as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0711\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Vulnerability Management (formerly Kenna.VM) under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0712","name":"Cisco+ Secure Connect","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Cisco+ Secure Connect as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0712\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco+ Secure Connect under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0713","name":"Slido","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Slido as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0713\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Slido under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0714","name":"Webex","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists Webex as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0714\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Webex under 'Products Under Investigation' (Cisco Cloud Hosted Services); affected and fixed releases are not published.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: under investigation; no Cisco product confirmed vulnerable yet.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."},"CVE-2026-109619":{"status":"Investigation","notes":"Cisco advisory cisco-sa-php-october26-Jj384Daq lists product as under investigation; no Cisco product confirmed vulnerable yet","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22). Cisco lists these products under investigation; no product is confirmed vulnerable yet and there are no workarounds."}}},{"id":"PHP-0715","name":"Cisco Umbrella","vendor":"Cisco","category":"Hosting and cloud","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco Umbrella as not vulnerable to CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0715\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco Umbrella under 'Products Confirmed Not Vulnerable'. The same advisory version also still lists Cisco Umbrella under 'Products Under Investigation' (Cisco Cloud Hosted Services); the explicit not-vulnerable confirmation is recorded here.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: confirmed not vulnerable.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product under 'Products Confirmed Not Vulnerable'\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product under 'Products Confirmed Not Vulnerable'\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Not vuln","notes":"","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22), section 'Products Confirmed Not Vulnerable'. Cisco Umbrella is also still listed under investigation in the same advisory version."},"CVE-2026-109619":{"status":"Not vuln","notes":"","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22), section 'Products Confirmed Not Vulnerable'. Cisco Umbrella is also still listed under investigation in the same advisory version."}}},{"id":"PHP-0716","name":"Cisco AI Defense (hybrid on-premises deployment)","vendor":"Cisco","category":"Monitoring and administration","version":"Not specified","summary":"Cisco advisory cisco-sa-php-october26-Jj384Daq confirms Cisco AI Defense (hybrid on-premises deployment) as not vulnerable to CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0716\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in Cisco's php2shell advisory; exact PHP component and SAPI are not published\nPHP version scope: Cisco advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, 2026-10-22) lists Cisco AI Defense (hybrid on-premises deployment) under 'Products Confirmed Not Vulnerable'.\nExtensions: Unknown\nLimitations: A vendor advisory listing establishes review scope, not a confirmed PHP dependency, affected build or reachable path. The advisory is interim and Cisco states there are no workarounds.\nPatch owner: Cisco; operator for deployment of fixed releases where on-premises\nSource accessed: 2026-10-22\nVulnerability status: Cisco interim advisory: confirmed not vulnerable.\nCVE-2026-109618: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product under 'Products Confirmed Not Vulnerable'\nCVE-2026-109619: Cisco advisory cisco-sa-php-october26-Jj384Daq lists product under 'Products Confirmed Not Vulnerable'\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Cisco; operator for deployment of fixed releases where on-premises","links":["https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq"],"cves":{"CVE-2026-109618":{"status":"Not vuln","notes":"","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22), section 'Products Confirmed Not Vulnerable'. Cisco Umbrella is also still listed under investigation in the same advisory version."},"CVE-2026-109619":{"status":"Not vuln","notes":"","action":"","detail":"Added from Cisco Security Advisory cisco-sa-php-october26-Jj384Daq (interim, version 1.1, last updated 2026-10-22), section 'Products Confirmed Not Vulnerable'. Cisco Umbrella is also still listed under investigation in the same advisory version."}}},{"id":"PHP-0717","name":"QNAP QuTScloud","vendor":"QNAP","category":"Hosting and cloud","version":"QuTScloud c5.2.9 and earlier","summary":"QNAP QSA-26-18 lists QuTScloud c5.2.9 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.","scope":"Inventory record: PHP-0717\nCategory: Hosting and cloud\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications; exact component boundary and SAPI are not published for this product.\nPHP version scope: QSA-26-18 lists QuTScloud c5.2.9 and earlier as affected; fixed version to be announced.\nExtensions: Unknown\nLimitations: QSA-26-18 establishes affected product scope, not a live deployment, exact embedded PHP build, enabled feature set, reachable path or exploitation. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP for supported product updates; operator for exposure reduction and update rollout\nSource accessed: 2026-10-22\nVulnerability status: QNAP QSA-26-18 lists QNAP QuTScloud as affected; fixed version to be announced.\nCVE-2026-109618: Vendor-confirmed affected product scope; fixed version to be announced\nCVE-2026-109619: Vendor-confirmed affected product scope; fixed version to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP for supported product updates; operator for exposure reduction and update rollout","links":["https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0718","name":"QNAP QuMagie","vendor":"QNAP","category":"Content management","version":"QuMagie 2.10.1 and earlier","summary":"QNAP QSA-26-18 identifies QuMagie 2.10.1 and earlier in its affected-products header for CVE-2026-109618 and CVE-2026-109619; fixed version is not yet published.","scope":"Inventory record: PHP-0718\nCategory: Content management\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications; exact component boundary and SAPI are not published for this product.\nPHP version scope: QSA-26-18 lists QuMagie 2.10.1 and earlier as affected; fixed version to be announced.\nExtensions: Unknown\nLimitations: QSA-26-18 establishes affected product scope, not a live deployment, exact embedded PHP build, enabled feature set, reachable path or exploitation. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage. QSA-26-18's affected-products header explicitly names QuMagie 2.10.1 and earlier, although the rendered affected-products table on the same page omits a separate QuMagie row; no fixed version is published.\nPatch owner: QNAP for supported product updates; operator for exposure reduction and update rollout\nSource accessed: 2026-10-22\nVulnerability status: QNAP QSA-26-18 lists QNAP QuMagie as affected; fixed version to be announced.\nCVE-2026-109618: Vendor-confirmed affected product scope; fixed version to be announced\nCVE-2026-109619: Vendor-confirmed affected product scope; fixed version to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP for supported product updates; operator for exposure reduction and update rollout","links":["https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0719","name":"QNAP Note Station 3","vendor":"QNAP","category":"Content management","version":"Note Station 3 3.9.14 and earlier","summary":"QNAP QSA-26-18 lists Note Station 3 3.9.14 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.","scope":"Inventory record: PHP-0719\nCategory: Content management\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications; exact component boundary and SAPI are not published for this product.\nPHP version scope: QSA-26-18 lists Note Station 3 3.9.14 and earlier as affected; fixed version to be announced.\nExtensions: Unknown\nLimitations: QSA-26-18 establishes affected product scope, not a live deployment, exact embedded PHP build, enabled feature set, reachable path or exploitation. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP for supported product updates; operator for exposure reduction and update rollout\nSource accessed: 2026-10-22\nVulnerability status: QNAP QSA-26-18 lists QNAP Note Station 3 as affected; fixed version to be announced.\nCVE-2026-109618: Vendor-confirmed affected product scope; fixed version to be announced\nCVE-2026-109619: Vendor-confirmed affected product scope; fixed version to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP for supported product updates; operator for exposure reduction and update rollout","links":["https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0720","name":"QNAP QNE (ADRA)","vendor":"QNAP","category":"Appliances and embedded","version":"QNE (ADRA) 1.0.7 and earlier","summary":"QNAP QSA-26-18 lists QNE (ADRA) 1.0.7 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.","scope":"Inventory record: PHP-0720\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications; exact component boundary and SAPI are not published for this product.\nPHP version scope: QSA-26-18 lists QNE (ADRA) 1.0.7 and earlier as affected; fixed version to be announced.\nExtensions: Unknown\nLimitations: QSA-26-18 establishes affected product scope, not a live deployment, exact embedded PHP build, enabled feature set, reachable path or exploitation. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP for supported product updates; operator for exposure reduction and update rollout\nSource accessed: 2026-10-22\nVulnerability status: QNAP QSA-26-18 lists QNAP QNE (ADRA) as affected; fixed version to be announced.\nCVE-2026-109618: Vendor-confirmed affected product scope; fixed version to be announced\nCVE-2026-109619: Vendor-confirmed affected product scope; fixed version to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP for supported product updates; operator for exposure reduction and update rollout","links":["https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0721","name":"QNAP QVR Surveillance","vendor":"QNAP","category":"Monitoring and administration","version":"QVR Surveillance 3.0.3 and earlier (ARM32 models)","summary":"QNAP QSA-26-18 lists QVR Surveillance 3.0.3 and earlier on ARM32 models as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.","scope":"Inventory record: PHP-0721\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications; exact component boundary and SAPI are not published for this product.\nPHP version scope: QSA-26-18 lists QVR Surveillance 3.0.3 and earlier (ARM32 models) as affected; fixed version to be announced.\nExtensions: Unknown\nLimitations: QSA-26-18 establishes affected product scope, not a live deployment, exact embedded PHP build, enabled feature set, reachable path or exploitation. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP for supported product updates; operator for exposure reduction and update rollout\nSource accessed: 2026-10-22\nVulnerability status: QNAP QSA-26-18 lists QNAP QVR Surveillance as affected; fixed version to be announced.\nCVE-2026-109618: Vendor-confirmed affected product scope; fixed version to be announced\nCVE-2026-109619: Vendor-confirmed affected product scope; fixed version to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP for supported product updates; operator for exposure reduction and update rollout","links":["https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0722","name":"QNAP TVR OS","vendor":"QNAP","category":"Appliances and embedded","version":"TVR OS 1.0.4 and earlier","summary":"QNAP QSA-26-18 lists TVR OS 1.0.4 and earlier as affected by CVE-2026-109618 and CVE-2026-109619; fixed version is to be announced.","scope":"Inventory record: PHP-0722\nCategory: Appliances and embedded\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed affected product scope\nDeployment status: Not measured\nPHP surface: QNAP says PHP is used in web components of QNAP operating systems and several QNAP applications; exact component boundary and SAPI are not published for this product.\nPHP version scope: QSA-26-18 lists TVR OS 1.0.4 and earlier as affected; fixed version to be announced.\nExtensions: Unknown\nLimitations: QSA-26-18 establishes affected product scope, not a live deployment, exact embedded PHP build, enabled feature set, reachable path or exploitation. PHP included in containers running on Container Station or in third-party applications is outside QNAP update coverage.\nPatch owner: QNAP for supported product updates; operator for exposure reduction and update rollout\nSource accessed: 2026-10-22\nVulnerability status: QNAP QSA-26-18 lists QNAP TVR OS as affected; fixed version to be announced.\nCVE-2026-109618: Vendor-confirmed affected product scope; fixed version to be announced\nCVE-2026-109619: Vendor-confirmed affected product scope; fixed version to be announced\nCVE assessment limit: Affected product release scope is vendor-confirmed; installed version, exposure, configuration and exploitation need separate evidence.","owner":"QNAP for supported product updates; operator for exposure reduction and update rollout","links":["https://www.qnap.com/en/security-advisory/qsa-26-18"],"cves":{"CVE-2026-109618":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."},"CVE-2026-109619":{"status":"Vulnerable","notes":"QNAP QSA-26-18 lists these product versions as affected by both PHP2Shell CVEs; fixed versions are to be announced.","action":"Keep affected devices off the internet where possible, disable direct exposure and unnecessary PHP-based services, use VPN and trusted-network restrictions, and apply QNAP fixes when released.","detail":"Added from QNAP Security Advisory QSA-26-18 released 2026-10-22 and reviewed 2026-10-22. The advisory states that PHP is used in web components of QNAP operating systems and several QNAP applications, lists these product versions as affected, and says fixed versions will be published later. The QuMagie scope is taken from the advisory's explicit affected-products header; the rendered affected-products table on the same page omits a separate QuMagie row."}}},{"id":"PHP-0723","name":"EfficientIP DNS and network automation product suite","vendor":"EfficientIP","category":"Monitoring and administration","version":"Not specified","summary":"A trusted party reported to NCSC-NL that EfficientIP management interfaces for DNS and network automation products use .php URL paths; exact product scope and PHP runtime details are not publicly confirmed.","scope":"Inventory record: PHP-0723\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Trusted-party report; product scope unresolved\nDeployment status: Not measured\nPHP surface: A trusted party reported to NCSC-NL that EfficientIP management interfaces for DNS and network automation products expose .php URL paths.\nPHP version scope: Unknown; no official vendor product or release scope has been published.\nExtensions: Unknown\nLimitations: .php URL paths are an indicator of PHP-backed routing or legacy naming, not proof of a specific PHP runtime, affected build, enabled extension set, reachable vulnerable path or exploitation. Exact EfficientIP product names, versions and deployment scope remain unresolved.\nPatch owner: EfficientIP for product assessment and updates; operator for exposure review\nDownstream surface: DNS and network automation management workflows\nRelease pin: Trusted-party report received by NCSC-NL; no public vendor artifact or advisory available\nSource accessed: 2026-10-22\nVulnerability status: Under investigation based on trusted-party report of .php management URL paths; no official vendor confirmation or product-specific php2shell assessment available.\nCVE-2026-109618: Trusted-party report indicates possible PHP management surface; exact product and CVE scope unknown\nCVE-2026-109619: Trusted-party report indicates possible PHP management surface; exact product and CVE scope unknown\nCVE assessment limit: This candidate record captures a suspected PHP relationship only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"EfficientIP for product assessment and updates; operator for exposure review","links":[],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available.","action":"","detail":"Added from trusted-party reporting received by NCSC-NL and reviewed 2026-10-22. The reporting indicates .php URL paths in EfficientIP DNS/network automation management interfaces and the Entelliweb building management system interface. This is implementation-surface evidence only; no official vendor advisory, product/version scope or affected/fixed conclusion is available."},"CVE-2026-109619":{"status":"Investigation","notes":"Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available.","action":"","detail":"Added from trusted-party reporting received by NCSC-NL and reviewed 2026-10-22. The reporting indicates .php URL paths in EfficientIP DNS/network automation management interfaces and the Entelliweb building management system interface. This is implementation-surface evidence only; no official vendor advisory, product/version scope or affected/fixed conclusion is available."}}},{"id":"PHP-0724","name":"Entelliweb building management system","vendor":"Entelliweb","category":"Monitoring and administration","version":"Not specified","summary":"A trusted party reported to NCSC-NL that the Entelliweb building management system uses .php URL paths in its management interface; exact product release and PHP runtime details are not publicly confirmed.","scope":"Inventory record: PHP-0724\nCategory: Monitoring and administration\nOriginal relationship: requires\nRelationship direction: product_depends_on_php\nParent component: PHP-0037\nEvidence status: Trusted-party report; product scope unresolved\nDeployment status: Not measured\nPHP surface: A trusted party reported to NCSC-NL that the Entelliweb building management system management interface exposes .php URL paths.\nPHP version scope: Unknown; no official vendor product or release scope has been published.\nExtensions: Unknown\nLimitations: .php URL paths are an indicator of PHP-backed routing or legacy naming, not proof of a specific PHP runtime, affected build, enabled extension set, reachable vulnerable path or exploitation. Exact Entelliweb release, version and deployment scope remain unresolved.\nPatch owner: Entelliweb for product assessment and updates; operator for exposure review\nDownstream surface: Building management administration workflows\nRelease pin: Trusted-party report received by NCSC-NL; no public vendor artifact or advisory available\nSource accessed: 2026-10-22\nVulnerability status: Under investigation based on trusted-party report of .php management URL paths; no official vendor confirmation or product-specific php2shell assessment available.\nCVE-2026-109618: Trusted-party report indicates possible PHP management surface; exact product and CVE scope unknown\nCVE-2026-109619: Trusted-party report indicates possible PHP management surface; exact product and CVE scope unknown\nCVE assessment limit: This candidate record captures a suspected PHP relationship only. Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Entelliweb for product assessment and updates; operator for exposure review","links":[],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available.","action":"","detail":"Added from trusted-party reporting received by NCSC-NL and reviewed 2026-10-22. The reporting indicates .php URL paths in EfficientIP DNS/network automation management interfaces and the Entelliweb building management system interface. This is implementation-surface evidence only; no official vendor advisory, product/version scope or affected/fixed conclusion is available."},"CVE-2026-109619":{"status":"Investigation","notes":"Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available.","action":"","detail":"Added from trusted-party reporting received by NCSC-NL and reviewed 2026-10-22. The reporting indicates .php URL paths in EfficientIP DNS/network automation management interfaces and the Entelliweb building management system interface. This is implementation-surface evidence only; no official vendor advisory, product/version scope or affected/fixed conclusion is available."}}},{"id":"PHP-0725","name":"FortiADC Manager","vendor":"Fortinet","category":"Appliances and embedded","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiADC Manager as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0725\nCategory: Appliances and embedded\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiADC Manager under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0677","name":"FortiDDoS","vendor":"Fortinet","category":"Appliances and embedded","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiDDoS as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0677\nCategory: Appliances and embedded\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiDDoS under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0678","name":"FortiDDoS-F","vendor":"Fortinet","category":"Appliances and embedded","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiDDoS-F as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0678\nCategory: Appliances and embedded\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiDDoS-F under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0679","name":"FortiSIEM","vendor":"Fortinet","category":"Monitoring and administration","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiSIEM as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0679\nCategory: Monitoring and administration\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiSIEM under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0680","name":"FortiMonitor","vendor":"Fortinet","category":"Monitoring and administration","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiMonitor as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0680\nCategory: Monitoring and administration\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiMonitor under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0681","name":"FortiClient Cloud Services","vendor":"Fortinet","category":"Hosting and cloud","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiClient Cloud Services as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0681\nCategory: Hosting and cloud\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiClient Cloud Services under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0682","name":"FortiSOAR","vendor":"Fortinet","category":"Monitoring and administration","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiSOAR as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0682\nCategory: Monitoring and administration\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiSOAR under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0683","name":"FortiSOAR PaaS","vendor":"Fortinet","category":"Hosting and cloud","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiSOAR PaaS as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0683\nCategory: Hosting and cloud\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiSOAR PaaS under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0685","name":"FortiEndpoint","vendor":"Fortinet","category":"Monitoring and administration","version":"Not specified","summary":"Fortinet PSIRT advisory FG-IR-26-186 lists FortiEndpoint as under investigation for CVE-2026-109618 and CVE-2026-109619.","scope":"Inventory record: PHP-0685\nCategory: Monitoring and administration\nOriginal relationship: candidate association\nRelationship direction: unconfirmed\nParent component: PHP-0037\nEvidence status: Vendor advisory candidate\nDeployment status: Not measured\nPHP surface: Vendor-named product in the FG-IR-26-186 php2shell response; exact PHP component and SAPI are not published\nPHP version scope: Fortinet FG-IR-26-186 (published 2026-10-21, updated 2026-10-22) lists FortiEndpoint under 'Products Under Investigation'; affected and fixed product versions are not published.\nExtensions: Unknown\nLimitations: An under-investigation listing establishes vendor review scope, not a confirmed PHP dependency, affected build or reachable path.\nPatch owner: Fortinet; operator for deployment of fixed releases\nSource accessed: 2026-10-22\nVulnerability status: Vendor advisory FG-IR-26-186: under investigation.\nCVE-2026-109618: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE-2026-109619: Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published\nCVE assessment limit: Installed version, vendor backport, configuration, SAPI, loaded modules and reachable path need separate evidence.","owner":"Fortinet; operator for deployment of fixed releases","links":["https://fortiguard.fortinet.com/psirt/FG-IR-26-186"],"cves":{"CVE-2026-109618":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."},"CVE-2026-109619":{"status":"Investigation","notes":"Fortinet PSIRT FG-IR-26-186 lists product as under investigation; affected/fixed versions not yet published","action":"","detail":"Reviewed Fortinet PSIRT FG-IR-26-186, published 2026-10-21 and updated 2026-10-22. These products remain under investigation; no affected or fixed builds are specified. The advisory links OT IPS signatures 10009977 and 10009978, released in version 37.316, while its Virtual Patch field remains No. Signature availability does not establish a software fix. FortiADC retains its existing separate VEX assessments."}}},{"id":"PHP-0726","name":"UnoPim official Docker images (webkul/unopim, webkul/unopim-queue)","vendor":"UnoPim","category":"Containers and distribution","version":"Images 3.1.3 / 3.1 / latest rebuilt 2026-10-22 on PHP 8.4.27","summary":"Vendor-confirmed fix available in the named official Docker image scope; see the CVE assessment for self-hosted and deployment caveats.","scope":"Inventory record: PHP-0726\nCategory: Containers and distribution\nOriginal relationship: bundles\nRelationship direction: distributes_php\nParent component: PHP-0037\nEvidence status: Vendor-confirmed fixed images\nDeployment status: Not measured\nPHP surface: Official webkul/unopim Apache/mod_php image and webkul/unopim-queue PHP CLI image\nPHP version scope: UnoPim v3.1.3 release note, updated 2026-10-22, confirms tags 3.1.3, 3.1 and latest for both official images were rebuilt on PHP 8.4.27; it publishes image digests sha256:733a1ac27259acd59a9542eefbde1417edfc1920458b52dcc7fa1fd09f03ca50 and sha256:a3a66b4bd8ef015683bcfbfea7cdddf66536d7b1148e522af0c5a75f6d61144f.\nExtensions: Image-specific extension inventory unresolved; bundled php.ini disables session.upload_progress as extra hardening\nLimitations: This row is limited to the named official Docker images and published digests. Mutable tags, cached layers and existing running containers do not prove rollout. Self-hosted non-Docker installs use the operator's PHP runtime and are not fixed by the image publication.\nPatch owner: UnoPim maintainers for official image rebuilds; operator for pull/redeploy; self-hosted operator for PHP runtime updates\nDownstream surface: UnoPim web requests, queue workers, product catalogues, digital assets, imports/exports and configured credentials\nRelease pin: UnoPim v3.1.3 release note security update published 2026-10-22; webkul/unopim digest sha256:733a1ac27259acd59a9542eefbde1417edfc1920458b52dcc7fa1fd09f03ca50; webkul/unopim-queue digest sha256:a3a66b4bd8ef015683bcfbfea7cdddf66536d7b1148e522af0c5a75f6d61144f\nSource accessed: 2026-10-23\nAliases: webkul/unopim, webkul/unopim-queue\nConditional downstream consequence: If a matching PHP flaw is reachable through UnoPim web requests, imports, uploads or queue work, it could cause denial of service, disclosure, data alteration or worker-level code execution within the container's permissions. Host compromise, tenant escape and lateral movement require separate evidence.\nVulnerability status: Fixed official UnoPim Docker images are published on PHP 8.4.27; self-hosted deployments remain dependent on their own PHP runtime update.\nCVE-2026-109618: Fixed in the named official Docker images rebuilt on PHP 8.4.27\nCVE-2026-109619: Fixed in the named official Docker images rebuilt on PHP 8.4.27\nCVE assessment limit: Published replacement images only; cached images and running deployments require pull/redeploy and verification. Self-hosted non-Docker installs must update PHP separately.","owner":"UnoPim maintainers for official image rebuilds; operator for pull/redeploy; self-hosted operator for PHP runtime updates","links":["https://github.com/unopim/unopim/releases/tag/v3.1.3","https://github.com/unopim/unopim/pull/787"],"cves":{"CVE-2026-109618":{"status":"Fix","notes":"UnoPim's v3.1.3 release note confirms the official webkul/unopim and webkul/unopim-queue images were rebuilt on PHP 8.4.27 for both CVEs. This confirms the named Docker image scope only; self-hosted installs must update their own PHP runtime and cached/running containers require pull and redeploy.","action":"","detail":"Added from the official UnoPim v3.1.3 release note reviewed 2026-10-23: https://github.com/unopim/unopim/releases/tag/v3.1.3. The release note explicitly names both CVEs, publishes fixed image tags and digests, and states self-hosted installs must update PHP separately.\nAction statement: Pull and redeploy the named official images and verify PHP 8.4.27; self-hosted non-Docker installs must update PHP to 8.4.27, 8.3.36 or 8.2.35 or later and restart PHP-FPM or Apache."},"CVE-2026-109619":{"status":"Fix","notes":"UnoPim's v3.1.3 release note confirms the official webkul/unopim and webkul/unopim-queue images were rebuilt on PHP 8.4.27 for both CVEs. This confirms the named Docker image scope only; self-hosted installs must update their own PHP runtime and cached/running containers require pull and redeploy.","action":"","detail":"Added from the official UnoPim v3.1.3 release note reviewed 2026-10-23: https://github.com/unopim/unopim/releases/tag/v3.1.3. The release note explicitly names both CVEs, publishes fixed image tags and digests, and states self-hosted installs must update PHP separately.\nAction statement: Pull and redeploy the named official images and verify PHP 8.4.27; self-hosted non-Docker installs must update PHP to 8.4.27, 8.3.36 or 8.2.35 or later and restart PHP-FPM or Apache."}}}]}