PHP2Shell by Broadcastwell
The PHP2Shell statement format the engines quote.
A free template, CC BY 4.0, built from the clearest statements published on 21 and 22 October 2026: the company name and PHP2Shell in the headline, the date with its time zone, every product with its status, the fixed version deployed or the reason you are not affected, whether workers were restarted, any temporary measures, the plan for older installations, what customers need to do, where updates are posted, a contact and an update log. It is not security advice. For patching, follow PHP's advisory and your host.
PHP2Shell: what AI engines say, and who has publishedThe Statement Index
The template
The template, field by field
Replace every bracket. Delete a field that does not apply, but keep the headline, the date, the product list, the customer action line and the update log. Each field shows what to write and, underneath, why it is there.
Headline
Name the company and the word PHP2Shell, and print both CVE identifiers once. The engines match on the names people type.
Date and time zone
Print the publication time and the last update with a time zone. Undated statements are quoted as undated by the engines and by trackers.
Summary
One sentence, the outcome first. It is the sentence most likely to be quoted whole.
Products and services covered
One line per product or plan, each with one status word. A mixed estate reads clearly when every product has its own line; a single blanket line is where misreadings start.
Fixed version deployed, or why you are not affected
Print the exact PHP version or the vendor package name. Distribution packages keep their own version numbers, so name the package and say that its changelog lists both CVE identifiers.
PHP workers restarted
Hosts and operators: say it, with the time. Readers and engines look for it. If restarts are still in progress, say which fleet is done and which is not.
Temporary measures in place
Say what was applied and whether it remains. PHP's advisory says such measures reduce exposure but do not make an installation safe, so a statement should never present them as the fix.
Older and end-of-life installations
Say what happens to PHP 8.1 and older. The PHP project no longer updates those branches; some distributions and long-term-support vendors ship backported fixes.
What customers need to do
One line. Nothing is a complete answer when it is true.
Where updates will be posted
One URL, kept current. Link to it from your status page and your security page.
Contact
A monitored address.
Update log
Every change, dated. A statement that changes without a log is quoted in two conflicting versions.
Once it is published
Once it is published
Submit the statement to the PHP2Shell Statement Index. We list a statement only once we have opened it on your own domain or verified official account, and we reply from index@broadcastwell.com within one business day. Verified statements can carry the free badge that links to the row.
Submit your statementRead the index
The PHP2Shell Record Check: when customers ask ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode whether your company is affected, we capture what they say, trace every wrong or missing statement to its source, and deliver a statement page in the format the engines quote. $490 once, findings within 48 hours, refundable in full within 30 days. The PHP2Shell Record Check
Questions about the statement
Questions about the statement
Why publish a PHP2Shell statement at all?
Because the engines answer the question whether you publish or not. When a customer asks ChatGPT, Claude, Perplexity, Google AI Overviews or Google AI Mode whether your company is affected, the engines answer from whatever they can find: a tracker, a forum, an old page. A dated statement on your own domain is the source they quote first.
We are not affected. Do we still need one?
A not-affected statement is still a statement, and it is the shortest to write: the headline, the date, one line per product marked not affected, the reason in one sentence, what customers need to do (nothing), a contact and the update log.
Where should the statement live?
On your own domain, at one URL you keep current: your status page, your security page or a dated post. We list only statements published on a company's own domain or a verified official account.
How do we get it into the Statement Index?
Publish it, then submit the link at index.broadcastwell.com/php2shell/submit/. We open it, verify it on your domain and reply from index@broadcastwell.com within one business day. Verified statements can carry the free badge that links to the row.
Sources: PHP security advisory, 21 October 2026 (php.net); UK NCSC alert, 21 October 2026; CERT-EU Security Advisory 2026-018, 21 October 2026. Last updated 23 October 2026.
Put the evidence to work
See which buyer questions leave you out, the sources visible in those answers, and the three changes worth testing first. The Category Audit covers ten buyer questions on five engines, three runs each. AI answers vary, so repeated observations and disagreements are reported.
Start with the $490 Category AuditFindings within 48 hours of your category confirmation. Refundable in full within 30 days of delivery.
One time price. No annual contract. All five engines included. The $490 credits once against the $2,900 Fix Sprint within 30 days of delivery, so the Sprint is $2,410.