PHP2Shell statement record · Host
Status in the company's own words: patching. Statement dated Posted 21st October, 2026; latest update Oct 22nd 10:00est.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on www.bluehost.com, dated Posted 21st October, 2026; latest update Oct 22nd 10:00est. Source type: status page.successfully patched the majority of servers
successfully patched the majority of servers
(Oct 21st 23:00est) and significant progress deploying patched PHP builds across our hosting infrastructure
(Oct 22nd 10:00est) quoted from https://www.bluehost.com/status/announcement/271 (title: PHP Updates). No completion notice at this check. Customers on patched versions need no action; self-managed VPS/dedicated customers told to run a package update through their control panel; some customers may receive emails with steps; upload file size limits possible while mitigations are in place. Lists patched builds for older branches (5.2 to 7.4) under CloudLinux alt-php and cPanel vendor backports without calling them end-of-life.
differs
Bluehost is treating these CVEs as affecting its hosting infrastructure and has patched the majority of its systems—but has not confirmed a complete rollout. As checked on October 23, 2026, its latest posted update is October 22 at 18:15 (labeled “EST” by Bluehost). It says patched PHP builds are still being deployed to the remaining infrastructure. Bluehost’s official “PHP
contradiction
Based on thorough searching across multiple security sources, there is no public statement, advisory, or announcement from Bluehost specifically addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619). No security researcher, vendor bulletin, or news outlet has published information confirming whether Bluehost has patched or even formally acknowledged these vulnerabilities at this time. Here is what is known about the vulnerabilities themselves, and
differs
Yes—Bluehost is potentially affected wherever it hosts websites running vulnerable PHP versions. PHP2Shell affects the PHP runtime itself, not a particular CMS or hosting brand; vulnerable versions include PHP 8.2.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, and 8.5.0–8.5.11. The PHP fixes were released on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. However, no reliable public Bluehost statement confirming that all
differs
Bluehost was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the hosting provider has rolled out patches across the majority of its infrastructure. Status and Patching Details Impact: Bluehost platforms running unpatched PHP versions inherit the risk of the critical remote code execution (RCE) flaws (CVSS 9.2). Patch Status: Bluehost has made significant progress deploying patched PHP builds
differs
Yes, Bluehost's hosting infrastructure is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which impact underlying PHP core runtimes globally. Patch Status In Progress / Partially Patched: Bluehost's teams have been actively rolling out patched PHP builds across their hosting infrastructure. As of their latest updates, the majority of their shared and managed platforms have been updated, though deployment
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Bluehost reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Bluehost's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Bluehost and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy