php2shell and dental software: what practices should know. A Standard Computer (Little Rock) briefing for dentists, office managers, and peer IT providers. Office PC practice management is largely unaffected; some cloud products use PHP. Ask vendors for confirmation — possible is not confirmed vulnerable.
Standard Computer (Little Rock, ASDA-endorsed) reviewed public signals only. No practice names appear here. Vendors may send clarifications for updates.
On October 21, 2026, the PHP project published fixes for two critical issues tracked as CVE-2026-109618 and CVE-2026-109619, widely called php2shell. In the worst case, an attacker who can send crafted web requests to an affected PHP web server may run code without logging in. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older no longer receive official fixes from the PHP project.
This affects PHP web servers (FPM, mod_php, CGI). Desktop imaging and most on-premises Windows PMS packages do not run that stack for patient records. A WordPress marketing site is a different risk than a PHP-backed product with schedules or clinical data.
| Vendor | Category | Tier | Confidence | Short reason |
|---|---|---|---|---|
| Adit | Practice Analytics | High | High | Public product login appears to use Laravel (a PHP framework). |
| Curve Dental | Practice Management | High | High | Vendor job posting mentions PHP among backend services (alongside .NET). |
| Dental Intelligence | Practice Analytics | High | High | Public materials list PHP/Laravel; related products include Modento. |
| Jarvis Analytics | Practice Analytics | High | High | Public hiring materials describe Laravel/PHP for product work. |
| Modento | Digital Forms; Online Scheduling | High | High | Public materials describe Laravel/PHP in the product services. |
| Rectangle Health | Payments | High | Medium | Job posting describes PHP/Symfony in engineering work. |
| DentalXChange | Insurance Verification | Medium | Medium | Public materials mention PHP; some portals also look Java-based (mixed stack). |
| DentalXChange (ClaimConnect) | Claims / Clearinghouse | Medium | Medium | Same ecosystem as DentalXChange; mixed PHP/Java signals. |
| Dentrix Ascend | Practice Management | Medium | Medium | Core cloud app looks Java-based; the login hub showed a PHP session cookie. |
| Edge Cloud (ortho2) | Specialty PMS | Medium | Low | Weak public web signal only; product stack not confirmed as PHP. |
| Lighthouse 360 | Patient Communication | Medium | Low | Mixed public signals (PHP listed alongside other stacks); not confirmed. |
| PayConnect | Payments | Medium | Medium | Related to DentalXChange payment portals; mixed stack signals. |
| RevenueWell | Patient Communication; Reputation | Medium | Medium | Older PBHS platform used PHP; current product described as .NET. |
| Solutionreach | Patient Communication | Medium | Low | Marketing site looks WordPress; product materials point elsewhere. |
| Tesia | Claims / Clearinghouse | Medium | Low | Third-party profile lists PHP; not confirmed from product signals. |
| Yapi | Digital Forms | Medium | Medium | Older versions used PHP; newer path described as .NET - confirm your version. |
| Zuub | Insurance Verification | Medium | Low | Third-party profile lists PHP among other languages; not confirmed. |
| EdgeExpress | Payments | Unknown | Low | Not enough public information to classify. |
| Local billing firm | RCM / Billing Services | Unknown | Low | Placeholder - identify your actual billing firm. |
| Onederful | Insurance Verification | Unknown | Low | No product PHP evidence found. |
| Vyne Trellis | Claims / Clearinghouse; Insurance Verification | Unknown | Low | No product PHP evidence found; marketing site only. |
| 3Shape Dental System | CAD/CAM & 3D Printing | Low | High | Not PHP product (public signals). |
| 3Shape TRIOS | Intraoral Scanners | Low | High | Not PHP product (public signals). |
| Alphaeon Credit | Patient Financing | Low | Medium | Not PHP product (public signals). |
| Apteryx XrayVision | Imaging Software | Low | High | Not PHP product (public signals). |
| Arini | AI Front Office / Agents | Low | Medium | Not PHP product (public signals). |
| Birdeye | Reputation | Low | Medium | Not PHP product (public signals). |
| Bola AI | AI Clinical Notes / Voice | Low | Medium | Not PHP product (public signals). |
| CareCredit | Patient Financing | Low | Medium | Not PHP product (public signals). |
| Carestream CS 8200 / 9600 | Pano / CBCT | Low | High | Not PHP product (public signals). |
| Carestream RVG | Intraoral Sensors | Low | High | Not PHP product (public signals). |
| CEREC | CAD/CAM & 3D Printing | Low | High | Not PHP product (public signals). |
| Cherry | Patient Financing | Low | Medium | Not PHP product (public signals). |
| Claim.MD | Claims / Clearinghouse | Low | Medium | Not PHP product (public signals). |
| Cloud 9 Ortho | Specialty PMS | Low | Medium | Not PHP product (public signals). |
| CS Imaging | Imaging Software | Low | High | Not PHP product (public signals). |
| Dental ClaimSupport | RCM / Billing Services | Low | Low | Not PHP product (public signals). |
| Denti.AI | AI Radiograph Analysis | Low | High | Not PHP product (public signals). |
| Denti.AI Voice | AI Clinical Notes / Voice | Low | High | Not PHP product (public signals). |
| Dentrix | Practice Management | Low | High | Not PHP product (public signals). |
| Dentrix ePrescribe | ePrescribing | Low | Medium | Not PHP product (public signals). |
| Dexis IS | Intraoral Scanners | Low | High | Not PHP product (public signals). |
| Dexis OP 3D | Pano / CBCT | Low | High | Not PHP product (public signals). |
| Dexis Titanium | Intraoral Sensors | Low | High | Not PHP product (public signals). |
| Diagnocat | AI Radiograph Analysis | Low | High | Not PHP product (public signals). |
| Dolphin Management | Specialty PMS | Low | High | Not PHP product (public signals). |
| DoseSpot | ePrescribing | Low | High | Not PHP product (public signals). |
| Dr. Clippy | AI Front Office / Agents | Low | Medium | Not PHP product (public signals). |
| DrFirst Rcopia | ePrescribing | Low | Medium | Not PHP product (public signals). |
| DTX Studio Clinic | Imaging Software | Low | High | Not PHP product (public signals). |
| Eaglesoft | Practice Management | Low | High | Not PHP product (public signals). |
| eAssist | RCM / Billing Services | Low | Low | Not PHP product (public signals). |
| exocad | CAD/CAM & 3D Printing | Low | High | Not PHP product (public signals). |
| Formlabs | CAD/CAM & 3D Printing | Low | High | Not PHP product (public signals). |
| Freed | AI Clinical Notes / Voice | Low | Medium | Not PHP product (public signals). |
| Gaidge | Practice Analytics | Low | Medium | Not PHP product (public signals). |
| Heidi Health | AI Clinical Notes / Voice | Low | Medium | Not PHP product (public signals). |
| iTero | Intraoral Scanners | Low | High | Not PHP product (public signals). |
| LocalMed | Online Scheduling | Low | Medium | Not PHP product (public signals). |
| Mango Voice | Phones / VoIP | Low | High | Not PHP product (public signals). |
| MDToolbox | ePrescribing | Low | High | Not PHP product (public signals). |
| Medit i700 / i900 | Intraoral Scanners | Low | High | Not PHP product (public signals). |
| Medusind | RCM / Billing Services | Low | Medium | Not PHP product (public signals). |
| Microsoft DAX Copilot | AI Clinical Notes / Voice | Low | Medium | Not PHP product (public signals). |
| NexHealth | Online Scheduling; Patient Communication | Low | High | Not PHP product (public signals). |
| NexHealth Forms | Digital Forms | Low | High | Not PHP product (public signals). |
| NexHealth Payments | Payments | Low | High | Not PHP product (public signals). |
| Nextiva | Phones / VoIP | Low | High | Not PHP product (public signals). |
| Open Dental | Practice Management | Low | High | Not PHP product (public signals). |
| Open Dental eForms | Digital Forms | Low | High | Not PHP product (public signals). |
| Open Dental Web Sched | Online Scheduling | Low | High | Not PHP product (public signals). |
| Optum / Change Healthcare | Claims / Clearinghouse | Low | Low | Not PHP product (public signals). |
| Overjet | AI Radiograph Analysis | Low | High | Not PHP product (public signals). |
| Pearl | AI Radiograph Analysis | Low | High | Not PHP product (public signals). |
| Planmeca ProSensor HD | Intraoral Sensors | Low | High | Not PHP product (public signals). |
| Planmeca Viso / ProMax | Pano / CBCT | Low | High | Not PHP product (public signals). |
| Podium | Reputation | Low | Medium | Not PHP product (public signals). |
| Practice by Numbers | Practice Analytics | Low | High | Not PHP product (public signals). |
| Primescan | Intraoral Scanners | Low | High | Not PHP product (public signals). |
| Proceed Finance | Patient Financing | Low | Medium | Not PHP product (public signals). |
| RingCentral | Phones / VoIP | Low | High | Not PHP product (public signals). |
| Romexis | Imaging Software | Low | High | Not PHP product (public signals). |
| RxNT | ePrescribing | Low | Medium | Not PHP product (public signals). |
| Schick 33 / Elite | Intraoral Sensors | Low | High | Not PHP product (public signals). |
| Sidexis 4 | Imaging Software | Low | High | Not PHP product (public signals). |
| Sirona Orthophos / Axeos | Pano / CBCT | Low | High | Not PHP product (public signals). |
| SprintRay | CAD/CAM & 3D Printing | Low | High | Not PHP product (public signals). |
| Sunbit | Patient Financing | Low | Medium | Not PHP product (public signals). |
| SuperDial | AI Front Office / Agents; Insurance Verification | Low | Medium | Not PHP product (public signals). |
| Swell | Reputation | Low | Medium | Not PHP product (public signals). |
| TDO | Specialty PMS | Low | Medium | Not PHP product (public signals). |
| Teams Phone | Phones / VoIP | Low | High | Not PHP product (public signals). |
| TrueLark | AI Front Office / Agents | Low | Medium | Not PHP product (public signals). |
| Vatech Green | Pano / CBCT | Low | High | Not PHP product (public signals). |
| VideaHealth | AI Radiograph Analysis | Low | High | Not PHP product (public signals). |
| Weave | Patient Communication; Phones / VoIP | Low | High | Not PHP product (public signals). |
| Weave AI | AI Front Office / Agents | Low | High | Not PHP product (public signals). |
| Weave Forms | Digital Forms | Low | High | Not PHP product (public signals). |
| Weave Payments | Payments | Low | High | Not PHP product (public signals). |
| Weave Reviews | Reputation | Low | High | Not PHP product (public signals). |
| WinOMS | Specialty PMS | Low | High | Not PHP product (public signals). |
| XDR | Intraoral Sensors | Low | High | Not PHP product (public signals). |
| Zentist | RCM / Billing Services | Low | Medium | Not PHP product (public signals). |
| Zocdoc | Online Scheduling | Low | Medium | Not PHP product (public signals). |
| No vendors match. | ||||
| Vendor | Tier | App URLs | Announcement pages | BuiltWith scan | PHP statement |
|---|---|---|---|---|---|
| Adit | High | https://go.adit.com; https://form.adit.com | https://status.adit.com; https://www.adit.com/blog | pending | — |
| Curve Dental | High | unknown | https://www.curvedental.com/status; https://curvedental.statuspage.io; https://www.curvedental.com/blog | pending | — |
| Dental Intelligence | High | https://app.dentalintel.com | https://dentalintelligence.statuspage.io; https://www.dentalintel.com/blog | pending | — |
| Jarvis Analytics | High | https://schedule.jarvisanalytics.com/app/login | https://status.jarvisanalytics.com; https://www.jarvisanalytics.com/blog | pending | — |
| Modento | High | https://app.modento.io | unknown | pending | — |
| Rectangle Health | High | https://pmb.rectanglehealth.com/login | https://status.rectanglehealth.com; https://www.rectanglehealth.com/blog | pending | — |
| DentalXChange | Medium | https://register.dentalxchange.com | unknown | pending | — |
| DentalXChange (ClaimConnect) | Medium | https://register.dentalxchange.com | unknown | pending | — |
| Dentrix Ascend | Medium | https://go.dentrixascend.com; https://hub.dentrixascend.com | https://henryscheinone.statuspage.io | pending | — |
| Edge Cloud (ortho2) | Medium | https://edgeportal.ortho2.com | https://help.ortho2.com | pending | — |
| Lighthouse 360 | Medium | https://live.lh360.com/cas/login | https://henryscheinone.statuspage.io | pending | — |
| PayConnect | Medium | https://payconnect.dentalxchange.com | unknown | pending | — |
| RevenueWell | Medium | https://www.rwlogin.com | https://henryscheinone.statuspage.io | pending | — |
| Solutionreach | Medium | https://app.solutionreach.com | https://status.solutionreach.com | pending | — |
| Tesia | Medium | unknown | unknown | pending | — |
| Yapi | Medium | https://www.getyapi.com/login | unknown | pending | — |
| Zuub | Medium | unknown | unknown | pending | — |
| EdgeExpress | Unknown | https://www.edgeexpress.com | unknown | pending | — |
| Local billing firm | Unknown | unknown | unknown | pending | — |
| Onederful | Unknown | unknown | https://developers.onederful.co | pending | — |
| Vyne Trellis | Unknown | unknown | https://vynedental.com | pending | — |
| 3Shape Dental System | Low | unknown | unknown | pending | — |
| 3Shape TRIOS | Low | https://www.3shapecommunicate.com | https://www.3shape.com | pending | — |
| Alphaeon Credit | Low | unknown | unknown | pending | — |
| Apteryx XrayVision | Low | unknown | unknown | pending | — |
| Arini | Low | unknown | unknown | pending | — |
| Birdeye | Low | https://app.birdeye.com | https://status.birdeye.com | pending | — |
| Bola AI | Low | unknown | unknown | pending | — |
| CareCredit | Low | unknown | unknown | pending | — |
| Carestream CS 8200 / 9600 | Low | unknown | https://csdental.statuspage.io | pending | — |
| Carestream RVG | Low | unknown | https://csdental.statuspage.io | pending | — |
| CEREC | Low | unknown | unknown | pending | — |
| Cherry | Low | unknown | unknown | pending | — |
| Claim.MD | Low | https://www.claim.md | unknown | pending | — |
| Cloud 9 Ortho | Low | https://oa.cloud9ortho.com/portal/LoginAccount/Login | unknown | pending | — |
| CS Imaging | Low | unknown | https://csdental.statuspage.io | pending | — |
| Dental ClaimSupport | Low | unknown | unknown | pending | — |
| Denti.AI | Low | unknown | unknown | pending | — |
| Denti.AI Voice | Low | unknown | unknown | pending | — |
| Dentrix | Low | unknown | https://henryscheinone.statuspage.io | pending | — |
| Dentrix ePrescribe | Low | https://my.dosespot.com | https://status.dosespot.com | pending | — |
| Dexis IS | Low | unknown | unknown | pending | — |
| Dexis OP 3D | Low | unknown | unknown | pending | — |
| Dexis Titanium | Low | unknown | unknown | pending | — |
| Diagnocat | Low | unknown | unknown | pending | — |
| Dolphin Management | Low | unknown | unknown | pending | — |
| DoseSpot | Low | https://my.dosespot.com | https://status.dosespot.com | pending | — |
| Dr. Clippy | Low | unknown | unknown | pending | — |
| DrFirst Rcopia | Low | https://rcopia.drfirst.com | unknown | pending | — |
| DTX Studio Clinic | Low | unknown | unknown | pending | — |
| Eaglesoft | Low | unknown | unknown | pending | — |
| eAssist | Low | unknown | unknown | pending | — |
| exocad | Low | unknown | unknown | pending | — |
| Formlabs | Low | https://formlabs.com/dashboard | unknown | pending | — |
| Freed | Low | unknown | unknown | pending | — |
| Gaidge | Low | https://secure.gaidge.com | unknown | pending | — |
| Heidi Health | Low | unknown | unknown | pending | — |
| iTero | Low | https://myitero.com | unknown | pending | — |
| LocalMed | Low | unknown | unknown | pending | — |
| Mango Voice | Low | https://app.mangovoice.com | unknown | pending | — |
| MDToolbox | Low | unknown | unknown | pending | — |
| Medit i700 / i900 | Low | https://www.meditlink.com | unknown | pending | — |
| Medusind | Low | unknown | unknown | pending | — |
| Microsoft DAX Copilot | Low | unknown | https://security.microsoft.com | pending | — |
| NexHealth | Low | https://app.nexhealth.com | https://status.nexhealth.com; https://security.nexhealth.com; https://www.nexhealth.com/blog | pending | — |
| NexHealth Forms | Low | https://app.nexhealth.com | https://status.nexhealth.com; https://security.nexhealth.com | pending | — |
| NexHealth Payments | Low | https://app.nexhealth.com | https://status.nexhealth.com; https://security.nexhealth.com | pending | — |
| Nextiva | Low | https://login.nextiva.com | unknown | pending | — |
| Open Dental | Low | https://patientviewer.com | https://www.opendental.com | pending | — |
| Open Dental eForms | Low | https://patientviewer.com | https://www.opendental.com | pending | — |
| Open Dental Web Sched | Low | https://patientviewer.com | https://www.opendental.com | pending | — |
| Optum / Change Healthcare | Low | unknown | unknown | pending | — |
| Overjet | Low | unknown | https://www.overjet.com/security | pending | — |
| Pearl | Low | https://app.hellopearl.com | unknown | pending | — |
| Planmeca ProSensor HD | Low | unknown | unknown | pending | — |
| Planmeca Viso / ProMax | Low | unknown | unknown | pending | — |
| Podium | Low | https://app.podium.com | https://status.podium.com; https://trust.podium.com | pending | — |
| Practice by Numbers | Low | https://app.practicenumbers.com | unknown | pending | — |
| Primescan | Low | unknown | unknown | pending | — |
| Proceed Finance | Low | unknown | unknown | pending | — |
| RingCentral | Low | https://app.ringcentral.com | https://status.ringcentral.com; https://trust.ringcentral.com | pending | — |
| Romexis | Low | unknown | unknown | pending | — |
| RxNT | Low | unknown | unknown | pending | — |
| Schick 33 / Elite | Low | unknown | unknown | pending | — |
| Sidexis 4 | Low | unknown | unknown | pending | — |
| Sirona Orthophos / Axeos | Low | unknown | unknown | pending | — |
| SprintRay | Low | https://sprintray.com/login | unknown | pending | — |
| Sunbit | Low | unknown | unknown | pending | — |
| SuperDial | Low | unknown | unknown | pending | — |
| Swell | Low | unknown | unknown | pending | — |
| TDO | Low | unknown | unknown | pending | — |
| Teams Phone | Low | https://teams.microsoft.com | https://security.microsoft.com | pending | — |
| TrueLark | Low | unknown | unknown | pending | — |
| Vatech Green | Low | unknown | unknown | pending | — |
| VideaHealth | Low | https://app.videa.ai | unknown | pending | — |
| Weave | Low | https://app.getweave.com | https://weave.statuspage.io; https://www.getweave.com/security | pending | — |
| Weave AI | Low | https://app.getweave.com | https://weave.statuspage.io; https://www.getweave.com/security | pending | — |
| Weave Forms | Low | https://app.getweave.com | https://weave.statuspage.io; https://www.getweave.com/security | pending | — |
| Weave Payments | Low | https://app.getweave.com | https://weave.statuspage.io; https://www.getweave.com/security | pending | — |
| Weave Reviews | Low | https://app.getweave.com | https://weave.statuspage.io; https://www.getweave.com/security | pending | — |
| WinOMS | Low | unknown | https://csdental.statuspage.io | pending | — |
| XDR | Low | unknown | unknown | pending | — |
| Zentist | Low | https://app.zentist.io | unknown | pending | — |
| Zocdoc | Low | unknown | unknown | pending | — |
| No vendors match. | |||||
Showing 104 of 104. Confidence is signal clarity, not severity. BuiltWith and PHP statement columns are for later fills.
104 products. Overview vs URLs view. App URLs = product hosts (not marketing). Announcement = status/trust/news. BuiltWith and PHP statement pending. unknown = not verified. Oct 22, 2026.
Focus on High and Medium first. Use the URLs view for product login hosts and vendor announcement pages to watch.
Request whether any internet-facing product services run PHP; if so, whether they are on 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or an equivalent vendor-patched build); and when the patch was applied. Possible PHP is not the same as confirmed vulnerable.
Have your website host or IT provider confirm the PHP version on any practice marketing site, patient forms hosted on WordPress, or similar. Apply host updates promptly.
Watch for unexpected password resets, new admin users, or odd remote access. Report anything unusual to your IT provider.
Map each client's cloud tools against this table, open tickets with High/Medium vendors, and track WordPress PHP versions on sites you manage.
We used only passive, public information: vendor job posts and engineering write-ups, public technology profiles, ordinary HTTPS response headers, and verified product/status URLs. We did not attempt exploits, vulnerability scans, or credentialed testing. We did not find dental-vendor security advisories naming these CVEs as of October 22, 2026 (America/Chicago). Domains marked unknown were not guessed.
If you are a vendor and have a public advisory or stack clarification, send it to Standard Computer and we will update this page. This briefing is informational, not a penetration test report and not a claim that any named product is currently exploitable.
Prepared by Standard Computer, Little Rock — ASDA-endorsed dental IT.