Software with a PHP dependency potentially affected by CVE-2026-109618 and CVE-2026-109619, sorted into six categories. NCSC-NL’s list is the primary source; hkoeck/php2shell-status and the main appliance vendors’ own advisories are merged in to cross-check it and bring it up to date. Upstream PHP is fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Accepts NCSC-NL php2shell Markdown: the dated changelog (changelog_software_list.md) or one or more software lists (software_list_a.md … _z.md). Also accepts the README.md of hkoeck/php2shell-status, which replaces the second-source data. Products are matched by name. For each product only its newest changelog row counts, and only if it is newer than the data on this board. Nothing changes until you review and apply.
Or paste the Markdown
Typos are fine: “nextclod”, “wordpres” or “ecomerce” still find matches. Results are grouped by category.
Sources
Two trackers and a direct check of vendor advisories are merged. NCSC-NL stays the reference format; hkoeck adds newer vendor statements and products NCSC-NL does not list yet; the vendor check covers the main appliance vendors.
Operational information from the Dutch National Cyber Security Centre (TLP:CLEAR). Product inventory with a status per CVE, generated from SPDX snapshots.
Vendor advisoriesdirect check
The main appliance vendors’ own security advisories, read directly for this board. A tracker entry dated after this check takes precedence.
Community tracker of vendor and distribution statements, AI-generated by its author with each claim checked against the linked primary source. Verify before acting.
Status shown:“Newest” takes the most recent statement: a vendor advisory read on the check date, else hkoeck where it names the product and is newer, else NCSC-NL.
Status matrix
Select a number to open that category with the status filtered. Counts use the worst status across both CVEs.