PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated Oct 22, 2026 - 10:20 UTC (completion; latest Oct 22, 2026 - 10:22 UTC; first Oct 21, 2026 - 09:16 UTC).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on status.cloudways.com, dated Oct 22, 2026 - 10:20 UTC (completion; latest Oct 22, 2026 - 10:22 UTC; first Oct 21, 2026 - 09:16 UTC). Source type: status page.The PHP security patch rollout is complete, and all active servers have been successfully updated.
The PHP security patch rollout is complete, and all active servers have been successfully updated.
quoted from https://status.cloudways.com/incidents/xxjt802wwhpk (title: Critical PHP Remote Code Execution Vulnerabilities - Monitoring & Mitigations Underway). Autonomous patched at 01:02 UTC, Flexible deployment from 04:07 UTC; branches named 5.6, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 with no point releases; For deprecated PHP versions, we are working with our ELTS partners to apply the appropriate security patches.
No action is needed from the customers.
Support contacting a small subset of customers.
match
Yes—Cloudways was affected, and it now reports that patching is complete. As of October 23, 2026, the official sources say: Affected: DigitalOcean’s advisory for CVE-2026-109618 and CVE-2026-109619 explicitly lists Cloudways as “Affected”, with remediation handled by DigitalOcean. It covers Cloudways-supported PHP versions from 5.6 onward, using extended-LTS partners for older versions. Patched: Cloudways’ official status update dated October 22,
differs
Yes — Cloudways is affected by PHP2Shell, and patching is actively in progress. Here is a full breakdown: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — in PHP versions 5.4–8.5 that allow remote code execution (RCE). Both are rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: a fatal error during a
differs
Yes. Cloudways was affected because the PHP2Shell vulnerabilities affect PHP installations broadly, including the PHP versions used on Cloudways. DigitalOcean states that Cloudways was actively patching supported PHP versions, including PHP 5.6 and newer, while applying temporary mitigations and targeted WAF rules during the rollout. As of October 22, Cloudways reported that patching was complete across active Autonomous and
differs
Cloudways is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and patching is currently in progress. Status: Affected and actively being patched. Actions Taken by Cloudways / DigitalOcean: Cloudways is actively patching supported PHP versions (5.6 and above) using extended LTS partnership support for older PHP instances without forcing customers to migrate versions. Temporary Mitigations: Cloudways has applied PHP's
no status named
Affected Status: Cloudways itself is a managed hosting platform, but the servers and applications it hosts run PHP. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) affects the core PHP runtime engine across virtually all unpatched versions, any Cloudways server running an unpatched version of PHP is inherently vulnerable to unauthenticated remote code execution. Patch Status: Official security patches for PHP were
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for Cloudways reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
Cloudways's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about Cloudways and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy