# PHP2Shell statement template Published by Broadcastwell, 23 October 2026. Free to use, CC BY 4.0. The format the AI engines quote: a headline that names the company and PHP2Shell, a date with its time zone, one line per product with its status, the fixed version or the reason the company is not affected, and a dated update log. Built from the clearest published statements of 21 and 22 October 2026. This template is not security advice. For patching, follow PHP's advisory (php.net, 21 October 2026) and your host. Replace every bracket. Delete any field that does not apply, but keep the headline, the date, the product list, the customer action line and the update log. --- ## [Company name] statement on PHP2Shell (CVE-2026-109618 and CVE-2026-109619) **Published:** [day month year], [time] [time zone, for example UTC or US Eastern] **Last updated:** [day month year], [time] [time zone] ### Summary [One sentence that states the outcome for customers. Examples: "All [Company] hosting plans run a fixed PHP build and no customer action is required." or "[Company] products do not use PHP and are not affected." or "[Company] is deploying the fixed PHP builds across its platform; this page is updated as each product completes."] ### Products and services covered One line per product or service, with one of these words: patched, patched partly, patching, mitigation only, not affected, customer must update. - [Product or plan name]: [status]. [One clause with the fact behind the word, for example "fixed build 8.3.36 deployed on 21 October 2026 at 19:40 UTC".] - [Product or plan name]: [status]. [...] - [Product or plan name]: [status]. [...] ### Fixed version deployed, or why we are not affected [If patched: the exact PHP version or vendor package deployed, for example "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 from the PHP project" or "the distribution package [name and version] that carries both CVE identifiers in its changelog". If not affected: the reason in one sentence, for example "our services do not serve web requests through PHP".] ### PHP workers restarted [For hosts and operators: "Every PHP worker was restarted after the update, completed [day month year] [time] [time zone]." If restarts are still in progress, say which fleet is done and which is not.] ### Temporary measures in place [If any: the measures, the date they were applied, and whether they stay in place after the update, for example "Web application firewall rules were applied on 21 October 2026 at 03:30 UTC and remain in place as an additional layer." If none, write "None."] ### Older and end-of-life installations [What happens to PHP 8.1 and older on your platform or in your product, for example "Customers on PHP 8.1 and older receive our vendor backport [package name] on [date]" or "PHP 7.4 and 8.0 plans are being moved to PHP 8.2.35" or "Older versions are no longer offered."] ### What customers need to do [Often "Nothing." Otherwise the exact step and where to find it, for example "Self-managed servers must update PHP themselves; see [link]."] ### Where updates will be posted [The one URL where this statement is kept current, for example your status page or this page.] ### Contact [A monitored address or form for questions about this statement.] ### Update log - [day month year] [time] [time zone]: statement published. - [day month year] [time] [time zone]: [what changed]. --- ## Guidance per field **Headline.** Name the company and the word PHP2Shell, and print both CVE identifiers once. The engines match on the names people type. **Date and time zone.** Print the publication time and the last update with a time zone. Undated statements are quoted as "undated" by the engines and by trackers. **Products and services.** One line per product or plan, each with one status word. A mixed estate reads clearly when every product has its own line; a single blanket line is where misreadings start. **Fixed version.** Print the exact PHP version or the vendor package name. Distribution packages keep their own version numbers, so name the package and say that its changelog lists both CVE identifiers. **Workers restarted.** Hosts and operators: say it, with the time. Readers and engines look for it. **Temporary measures.** Say what was applied and whether it remains. PHP's advisory says such measures reduce exposure but do not make an installation safe, so a statement should never present them as the fix. **Older installations.** Say what happens to PHP 8.1 and older. The PHP project no longer updates those branches; some distributions and long-term-support vendors ship backported fixes. **What customers need to do.** One line. "Nothing" is a complete answer when it is true. **Where updates are posted.** One URL, kept current. Link to it from your status page and your security page. **Contact.** A monitored address. **Update log.** Every change, dated. A statement that changes without a log is quoted in two conflicting versions. --- ## Once it is published Submit the statement to the PHP2Shell Statement Index at index.broadcastwell.com/php2shell/submit/. We list a statement only once we have opened it on your own domain or verified official account, and we reply from index@broadcastwell.com within one business day. Verified statements can carry the free badge that links to the row. The PHP2Shell Record Check: when customers ask ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode whether your company is affected, we capture what they say, trace every wrong or missing statement to its source, and deliver a statement page in the format the engines quote. $490 once, findings within 48 hours, refundable in full within 30 days. broadcastwell.com/php2shell Sources: PHP security advisory, 21 October 2026 (php.net/archive/2026.php#2026-10-21-5); UK NCSC alert, 21 October 2026; CERT-EU Security Advisory 2026-018, 21 October 2026.