PHP2Shell by Broadcastwell
What AI engines say about PHP2Shell, and who has published.
PHP2Shell is the name researchers gave two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. Security vendors and hosts publish the patches. We publish the layer nobody else measures: what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode tell site owners about PHP2Shell, what they answer when a customer asks whether a company is affected, and which companies have published a statement. Every answer is captured verbatim with its date and sources, and every row of the index links to the company's own words.
Free statement templateOur own PHP2Shell statementDownload the data (CC BY 4.0)
The AI Answer Watch
Are the engines giving site owners the right answers?
Every day we ask the five engines the five questions that matter most to safety: how to fix PHP2Shell, which PHP version fixes it, whether a WordPress update fixes it, whether PHP 7.4 is patched, and whether PHP must be restarted after patching. Each answer is graded on checks anyone can verify against PHP's advisory: a correct fixed version named, a wrong version given, the WordPress-update error, the restart mentioned, the 9.2 severity stated.
Day 1 of the watch was recorded on 23 October 2026. The grades for each engine and each question, with the verbatim excerpt and the UTC time of every answer, are published at index.broadcastwell.com/php2shell/watch, and the page is re-measured every day.
The Statement Index
Who has published a PHP2Shell statement
The reference the engines can cite when someone asks whether a company has patched. A company is "patched" only when its own statement says the fix is deployed, "mitigation only" when it reports firewall or configuration measures and no patched build, "not affected" only when the company itself says so, and "no public statement located" when we found nothing at the places we checked, printed with that date and those places. A news report never upgrades a row.
The index opens with web hosts and platforms, products that bundle PHP, and the 286 software vendors of the Absence Index. Every row prints the company's own statement, its date and status, or the places we checked and found nothing, with the date of the check. Read it at index.broadcastwell.com/php2shell.
The study
What AI engines tell you about PHP2Shell
Ten questions site owners are asking, on ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode, three runs each, captured on 23 October 2026 under our published method v1.1 and graded against PHP's advisory. Team review is in progress. The study, every answer, every grade and every cited source are published here with a DOI when the review is complete.
Free statement template
The statement format the engines quote
A free template built from the clearest published statements: the company name and PHP2Shell in the headline, the date and time zone, every product with its status, the fixed version deployed or the reason the company is not affected, whether workers were restarted, any temporary measures, the plan for older installations, what customers need to do, where updates will be posted, a contact and an update log. Publish it on your own domain, then submit it to the index.
Check what AI says about your company
Check what AI says about your company
The free check asks one engine ten buyer questions about your category and shows you the answers. The PHP2Shell question, "Is your company affected, and has it patched?", is in the paid Record Check below and arrives in the free check when its measurement is ready.
The $490 PHP2Shell Record Check
The $490 PHP2Shell Record Check
What the engines tell your customers, corrected
When customers ask ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode whether your company is affected, we capture what they say, trace every wrong or missing statement to its source, and deliver a statement page in the format the engines quote. $490 once, findings within 48 hours, refundable in full within 30 days. Agencies: $490 per client report, white-label.
The facts we grade against
The facts we grade against
- The flaws. CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 by the PHP project. The PHP project does not use the name PHP2Shell; the name comes from the researchers.
- The fix. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026. PHP's release notes: "There are no complete mitigations, updating is the only safe choice."
- Older branches. PHP's advisory: PHP 8.1 and older no longer receive updates from the PHP project; some distributions and long-term-support vendors provide backported fixes; the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1.
- WordPress. WordPress.org, 21 October 2026: no WordPress update is required or planned for these issues; check with your web host.
Sources: PHP security advisory, 21 October 2026, UK NCSC alert, 21 October 2026, CERT-EU Security Advisory 2026-018, 21 October 2026, WordPress.org, 21 October 2026.
This page reports published statements and AI answers. For patching, follow PHP's advisory and your host. Last updated 23 October 2026.
Questions about PHP2Shell and this page
Questions about PHP2Shell and this page
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released by the PHP project on 21 October 2026. PHP's advisory says PHP 8.1 and older no longer receive updates from the PHP project and that some distributions and long-term-support vendors provide backported fixes, so contact your vendor or upgrade to a supported version.
Does updating WordPress fix PHP2Shell?
No. WordPress.org wrote on 21 October 2026 that no WordPress update is required or planned for these issues. The fix is in PHP itself, applied by your host or by whoever manages your server. The AI Answer Watch records each day whether the five engines get this right.
Is there a configuration workaround?
PHP's release notes say there are no complete mitigations and that updating is the only safe choice. PHP's advisory lists temporary settings that reduce exposure to specific attack paths but, in PHP's words, do not make an installation safe. We quote the advisory and add nothing to it.
How do we add or correct a statement in the index?
Publish the statement on your own domain or a verified official account, then submit the link on the index. We list a statement only after opening it on your own domain, and we reply from index@broadcastwell.com within one business day. Corrections to our rows follow the published dispute policy.
Put the evidence to work
See which buyer questions leave you out, the sources visible in those answers, and the three changes worth testing first. The Category Audit covers ten buyer questions on five engines, three runs each. AI answers vary, so repeated observations and disagreements are reported.
Start with the $490 Category AuditFindings within 48 hours of your category confirmation. Refundable in full within 30 days of delivery.
One time price. No annual contract. All five engines included. The $490 credits once against the $2,900 Fix Sprint within 30 days of delivery, so the Sprint is $2,410.