Hosts, panels and Linux distributions added
Fix status for 14 package sources (Ubuntu, Debian, Red Hat and its rebuilds, Alpine, Docker, Homebrew, Windows and others), 16 control panels and 26 hosting companies, each with the page we read it on. Hosts with no public statement are listed as such.
Site launched with the official fix information
Fixed versions, affected SAPIs, official temporary mitigations and end-of-life guidance for 8.3, 8.2, 8.1 and 7.4, each with its source.
PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35
The PHP project fixed CVE-2026-109618 and CVE-2026-109619 (CVSS v4.0 9.2) and published source backport branches for 8.1, 8.0 and 7.4.
What changed, and when
Each correction or new fact gets an entry here. Subscribe with RSS.