PHP Vulnerability View - PHP2Shell (CVE-2026-109618 / CVE-2026-109619)

Vulnerable = declared PHP below 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 (every version found is end of life, no upstream fix). Likely vulnerable = real PHP code or runtime but no version in the repo; verify on the host or image. N/A = PHP files only in bundled JavaScript library samples, no PHP runtime. P1 = active + vulnerable, P2 = active + version not declared, P3 = archived. Remediated = now declares a fixed version or no longer runs PHP; archiving does not count. OS packages (Ubuntu/RHEL) may carry vendor backports - check the installed package.
Branches: the flag reflects each repo's default branch (shown under the repo name). All branches and PRs pushed since 20 Oct 2026 in the 27 active P1/P2 repos were also checked. Fix in progress = a non-default branch/PR moves to a fixed PHP version but is not yet on the default branch or in production, so the flag stays Vulnerable (branch shown in the Change column; "check vendor backport" = targets an EOL version whose distro package may carry the fix). Fix attempt - still vulnerable = branch changes the image but keeps an unfixed PHP version. Fixed (vendor backport) = default branch installs a distro PHP package the vendor has patched for both CVEs although the upstream version is EOL (openldap-playbook: Ubuntu 22.04 php8.1 8.1.2-1ubuntu2.28, USN-8948-1); counted as remediated, confirm on the live host.
Experience: Patient, Study and Data are the 3 experiences; Platform = factbook platform, platform-ai or the deprecated enablement alias; R&D Ops = factbook operations; Unmapped = no signal found.
Experience source (how the experience was found, most to least reliable; hover an experience in the table to see the exact basis):
• Factbook (high) - the repo's own factbook.yaml spec.experience.
• Lighthouse (GoCD) (high) - no experience in the factbook; taken from the Lighthouse view lighthouse.enriched.vw_gocd_pipeline_groups, where the GoCD pipeline group that deploys the repo carries an experience tag (e.g. mytrus-OTK10/OTK39 pipelines sit in Enroll_legacy_ECS = Study). The tag is per pipeline group, linked to the repo by the study code in the pipeline name.
• Owner's other factbooks (medium) - the repo's factbook names an owner but no experience; uses the most common experience across that owner's other factbooks (1,399 factbook documents org-wide).
• Sibling repos (medium) - no factbook; inherits the experience of repos in the same family that do have one (e.g. mytrus-* / enroll-* from team105 factbooks = Patient; TPS-* from TPS-TSM = Study; acorn-cds-* and coder-* from Lighthouse GoCD CDS/Coder groups = Data).
• GitHub topic (low) - only the repo's GitHub topics point to an experience (chief-data-office / data-operations = Data, study-conduct = Study).
• None - no factbook, Lighthouse, owner, sibling or topic signal; experience shown as Unmapped.