PHP2List would not exist without the people and organisations below. Thanking them does not mean they are involved with, or endorse, this unofficial site. All credit for the research and the software list belongs to them. The names here are as credited on php2shell.com and in the NCSC-NL/php2shell repository.
The software list
The inventory of potentially affected software is maintained by NCSC-NL, the National Cyber Security Centre of the Netherlands, together with everyone who has contributed entries, corrections and vendor information to the NCSC-NL/php2shell repository. See the full list of contributors on GitHub.
The list is published under the European Union Public Licence v1.2 (EUPL-1.2) and marked TLP:CLEAR. PHP2List displays it unmodified. Corrections should go to the source: see how to contribute.
The PHP2Shell research
CVE-2026-109618 and CVE-2026-109619 were discovered and reported by the following researchers. Their own write-ups have the technical details.
Research write-ups
- php2shell.com — the official PHP2Shell site
- Wiz Research blog
- OpenAI blog
- Calif blog
Coordination and fixes
As credited on php2shell.com, the researchers worked with the PHP security team and the Gemini team at Google on discovery, coordination and patch verification. Thanks to the PHP project and The PHP Foundation for the fixed releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) and the security advisory.
Industry partners
php2shell.com also thanks Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and other partners for preparing customer guidance, detections and temporary mitigations, and lists Corelight, CrowdStrike, Unit 42 and Cisco Talos among the collaborators. Their published guidance:
CSIRTs and advisories
Thanks to the national and EU CSIRTs publishing guidance, including CERT-EU (Security Advisory 2026-018) and the EU CSIRTs Network advisory list maintained with ENISA.
Something missing or wrong?
If a credit here is incomplete or inaccurate, the authoritative sources are php2shell.com and the NCSC-NL repository; this page follows them.