Of 148 eligible answers, 23 (15.5%) were marked potentially misleading under our reviewed rubric.
We asked 10 site-owner questions three times on each of ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode. We retained all 150 planned cells. Two Google AI Overviews captures returned no overview and were excluded from answer-level percentages. This is a dated descriptive snapshot.
Reviewed and analysed by the Broadcastwell team. The work was reviewed, analysed and worked on by the Broadcastwell team. Final grades approved unchanged by Priya Nair, Ananya Rao and Vikram Patel, with team approval confirmed by the owner on 23 October 2026.
Potentially misleading: 23 of 148 (15.5%). Wrong fixed version: two of 148 (1.4%). WordPress update error: two of 148 (1.4%). The wrong-version and WordPress flags describe the same two answers and must not be added.
106 of 148 (71.6%) named a correct fixed version. Restart guidance appeared in 31 of 45 (68.9%) answers to the three applicable questions. The 9.2 score appeared in 28 of 148 (18.9%).
Engine
Eligible / planned
Potentially misleading
Correct fixed version
Wrong fixed version
WordPress error
Restart on applicable questions
States 9.2
ChatGPT
30 / 30
2 of 30 (6.7%)
22 of 30 (73.3%)
0 of 30 (0.0%)
0 of 30 (0.0%)
6 of 9 (66.7%)
0 of 30 (0.0%)
Claude
30 / 30
7 of 30 (23.3%)
27 of 30 (90.0%)
0 of 30 (0.0%)
0 of 30 (0.0%)
6 of 9 (66.7%)
19 of 30 (63.3%)
Perplexity
30 / 30
2 of 30 (6.7%)
20 of 30 (66.7%)
0 of 30 (0.0%)
0 of 30 (0.0%)
6 of 9 (66.7%)
0 of 30 (0.0%)
Google AI Overviews
28 / 30
4 of 28 (14.3%)
19 of 28 (67.9%)
2 of 28 (7.1%)
2 of 28 (7.1%)
7 of 9 (77.8%)
6 of 28 (21.4%)
Google AI Mode
30 / 30
8 of 30 (26.7%)
18 of 30 (60.0%)
0 of 30 (0.0%)
0 of 30 (0.0%)
6 of 9 (66.7%)
3 of 30 (10.0%)
Overall
148 / 150
23 of 148 (15.5%)
106 of 148 (71.6%)
2 of 148 (1.4%)
2 of 148 (1.4%)
31 of 45 (68.9%)
28 of 148 (18.9%)
Overall grades among eligible answers: 23 Correct, 113 Incomplete, eight Wrong and four No answer. Potentially misleading is a separate reviewed flag; Incomplete does not automatically mean misleading.
Three useful sentences
Use your operating system's or hosting provider's security updates. Some vendors backport fixes without changing the upstream version number, so check their advisory for **both CVEs**.
ChatGPT, Q01, run 1, captured 23 October 2026.
PHP2Shell is a server-level vulnerability in PHP itself, not in WordPress. No WordPress update, plugin, or theme can patch it. You must ensure your hosting provider updates the PHP runtime to a fixed version.
Claude, Q03, run 1, captured 23 October 2026.
Upgrade to a fixed PHP release: 8.2.35, 8.3.36, 8.4.27, or 8.5.12, or use a vendor package with a confirmed backport.
Perplexity, Q10, run 1, captured 23 October 2026.
Three sentences needing correction
Updating WordPress core to a patched version (such as 6.9.5, 7.0.2, or later) fixes the REST API batch flaws (CVE-2026-63030 and related core issues) that allow unauthenticated remote code execution.
Google AI Overviews, Q03, run 2, captured 23 October 2026. This answer substituted a different WordPress vulnerability for PHP2Shell. Updating WordPress does not update the PHP runtime.
Yes, updating WordPress fixes the WP2Shell (or wp2shell) vulnerability suite by patching the core security flaws, though additional cleanup steps are required if your site was already compromised before the patch.
Google AI Overviews, Q03, run 3, captured 23 October 2026. This answer also substituted WordPress flaws for PHP2Shell. A WordPress update does not supply the PHP runtime fix.
If your site sits behind a robust cloud security provider (like Cloudflare) that has deployed virtual patches or firewall rules blocking the exploit signatures, you are heavily insulated while you schedule your core updates.
Google AI Mode, Q10, run 1, captured 23 October 2026. A firewall claim is not proof that a PHP runtime has been patched. PHP says there is no complete mitigation and directs users to fixed releases.
Most cited sources
Number of eligible answers citing the domain at least once. This counts citations, not source quality.
Domain
Answers citing
Source type
watchtowr.com
32 of 148
vendor
github.com
26 of 148
forum / official
youtube.com
21 of 148
forum
php.net
20 of 148
official
brandefense.io
20 of 148
vendor
wiz.io
19 of 148
vendor
sansec.io
18 of 148
vendor
php2shell.com
17 of 148
tracker
socradar.io
17 of 148
vendor
helpnetsecurity.com
17 of 148
news
meowapps.com
17 of 148
vendor
reddit.com
16 of 148
forum
en.wikipedia.org
15 of 148
tracker
cloud.google.com
15 of 148
vendor
tuxcare.com
13 of 148
vendor
aikido.dev
12 of 148
vendor
recordedfuture.com
12 of 148
vendor
unlimitedwebhosting.co.uk
12 of 148
vendor
armis.com
11 of 148
vendor
huntress.com
11 of 148
vendor
Sources by engine
ChatGPT
php2shell.com: 17 of 30 eligible answers (tracker)
php.net: 16 of 30 eligible answers (official)
thephp.foundation: 4 of 30 eligible answers (official)
ubuntu.com: 4 of 30 eligible answers (vendor)
wordpress.org: 4 of 30 eligible answers (official)
Claude
watchtowr.com: 15 of 30 eligible answers (vendor)
socradar.io: 11 of 30 eligible answers (vendor)
brandefense.io: 10 of 30 eligible answers (vendor)
activeset.co: 9 of 30 eligible answers (tracker)
meowapps.com: 9 of 30 eligible answers (vendor)
Perplexity
github.com: 18 of 30 eligible answers (forum / official)
unlimitedwebhosting.co.uk: 12 of 30 eligible answers (vendor)
sansec.io: 9 of 30 eligible answers (vendor)
aikido.dev: 6 of 30 eligible answers (vendor)
arvion.ai: 6 of 30 eligible answers (vendor)
Google AI Overviews
youtube.com: 12 of 28 eligible answers (forum)
reddit.com: 10 of 28 eligible answers (forum)
watchtowr.com: 7 of 28 eligible answers (vendor)
huntress.com: 5 of 28 eligible answers (vendor)
armis.com: 4 of 28 eligible answers (vendor)
Google AI Mode
wiz.io: 14 of 30 eligible answers (vendor)
youtube.com: 9 of 30 eligible answers (forum)
cloud.google.com: 7 of 30 eligible answers (vendor)
watchtowr.com: 7 of 30 eligible answers (vendor)
arcticwolf.com: 6 of 30 eligible answers (vendor)
The complete per-engine source counts are in study-summary.json.
Hosts most often named
Recorded review comparisons against the dated Statement Index snapshot, with the approved grades retained unchanged. These are comparisons of published claims, not checks of running systems. Combined labels and platform components remain as recorded. A match does not independently verify a host is secure.
Recorded label
Answers naming, of 15
Matches
Differs
Cannot tell
Not in Index
Hostinger
9
9
0
0
0
SiteGround
8
3
4
1
0
GoDaddy
7
0
7
0
0
Flywheel
7
6
1
0
0
WP Engine
7
1
2
4
0
Kinsta
6
5
1
0
0
Cloudways
6
6
0
0
0
OVHcloud
6
1
5
0
0
Pantheon
6
1
5
0
0
DreamHost
6
1
4
1
0
Namecheap
5
1
4
0
0
Cloudflare
5
4
1
0
0
Bluehost
4
3
1
0
0
DigitalOcean
4
0
3
1
0
IONOS
3
1
1
1
0
Host comparisons by engine
Engine
Matches
Differs
Cannot tell
Not in Index
ChatGPT
22
12
2
1
Claude
21
18
5
0
Perplexity
6
4
3
9
Google AI Overviews
9
12
3
0
Google AI Mode
4
5
3
0
These columns count recorded host comparisons, so several may come from one answer. Each engine has three Q05 answers.
ChatGPT: most named labels
Hostinger 3 of 3; GoDaddy 3 of 3; SiteGround 3 of 3; Namecheap 3 of 3; Kinsta 3 of 3.
Claude: most named labels
WP Engine 3 of 3; Flywheel 3 of 3; Kinsta 3 of 3; SiteGround 3 of 3; Cloudways 3 of 3.
Perplexity: most named labels
Hostinger 3 of 3; OVHcloud 3 of 3; WP Engine 3 of 3; xCloud 3 of 3; SmartHost 3 of 3.
Google AI Overviews: most named labels
WP Engine 1 of 3; SiteGround 1 of 3; GoDaddy 1 of 3; cPanel & CloudLinux (EasyApache 4) 1 of 3; DreamHost 1 of 3.
Google AI Mode: most named labels
DigitalOcean 3 of 3; GoDaddy Managed WordPress 2 of 3; AWS 2 of 3; CloudLinux 1 of 3; Hostinger 1 of 3.
Method and limits
Ten questions, five engines and three runs per question, captured on 23 October 2026 through the engines' APIs and Google's answer surfaces. The final grades use the PHP project's fixed releases and dated official statements. Per-engine percentages use 30 eligible answers, except Google AI Overviews with 28. Restart coverage uses Q01, Q02 and Q09 only, 45 eligible answers overall.
This is a dated, descriptive snapshot of 10 questions, five engines and three runs per question. It is not a random sample of all answers or a statistical ranking.
The 150 planned cells include two Google AI Overviews captures with no overview returned. These are excluded from the 148-answer headline base. Four other eligible answers were graded No answer and remain in that base.
Potentially misleading is the reviewed rubric judgement, not evidence that anyone acted on an answer or remained unpatched. Incomplete does not automatically mean misleading.
Restart coverage uses the 45 eligible answers to the three questions whose rubric required restart guidance. Other answer-level percentages use 148 eligible answers.
Source counts are eligible answers citing a domain at least once, not links, source quality scores or independent verification of every cited claim. A domain may have more than one source type.
The public answer text preserves captured wording except for explicitly marked exploit-mechanics removals in nine answer rows. All 150 rows, including both exclusions, remain available. The private originals were retained.
The owner confirmed team approval of all existing grades without corrections. No per-row reviewer initials or comments were invented. Host comparisons preserve those approved review judgements against the dated Index snapshot.
The study and Statement Index document answers and published statements. They do not scan, probe or assess the security of any company.
See which buyer questions leave you out, the sources visible in those answers, and the three changes worth testing first. The Category Audit covers ten buyer questions on five engines, three runs each. AI answers vary, so repeated observations and disagreements are reported.
Findings within 48 hours of your category confirmation. Refundable in full within 30 days of delivery.
One time price. No annual contract. All five engines included. The $490 credits once against the $2,900 Fix Sprint within 30 days of delivery, so the Sprint is $2,410.