PHP Vulnerability Responses by Company

Sonatype

Global cloud / infrastructure
Aliases / services
ソナタイプ / Nexus / Sonatype Lifecycle / Sonatype
Official website
https://www.sonatype.com/

Each response applies only to its stated service scope. “Not listed” does not mean unpatched or unaffected.

Response status by service

Sonatype products (official impact assessment)

Response status
Not affected
Response information checked
2026-10-27

Current re-audit: Official response verified · Research date: 2026-10-27

Provides software dependency analysis and management.

Products need no update or reconfiguration for these CVEs.

Scope: Customer PHP applications, containers and appliances are excluded.

What users should do

Patch separately operated PHP environments.

Official service URL

Source URLs

  1. PHP2Shell — Impact on Sonatype Productshttps://help.sonatype.com/en/php2shell.htmlResponse evidence
Related official sources
  1. PHP application analysisOfficial information directoryThe previously unavailable reference is now readable. The conclusion remains limited to the scope of the official incident/update notice.
  2. PHP2Shell — Impact on Sonatype ProductsOfficial notice

Comments