PHP2Shell statement record · Host
Status in the company's own words: patched. Statement dated 2026 October 21 (EasyApache 4 release 25.91).
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Submit a correction or your statement Get the badge All statements
Read the statement on docs.cpanel.net, dated 2026 October 21 (EasyApache 4 release 25.91). Source type: official page.
EasyApache 4 release 25.91 (2026 October 21): EA-13607: Update `ea-php85` from v8.5.11 to v8.5.12.
and EA-13611: Backport the fix for CVE-2026-109618 and CVE-2026-109619 to `ea-php81`.
(likewise EA-13612 for ea-php80 and EA-13613 for ea-php74; ea-php82 to 8.2.35, ea-php83 to 8.3.36, ea-php84 to 8.4.27) quoted from https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/; each entry lists Two vulnerabilities in PHP (critical)
. This is a product changelog, not an advisory: no blog, news, support or community post was found; server administrators install the EA4 packages (see hosts' notices such as Liquid Web and Bluehost).
no status named
Yes—cPanel & WHM is affected, and cPanel released fixes for both CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. There are two separate components to check: internal cPanel PHP and the EasyApache PHP used by hosted websites. | Component | Fixed releases | |---|---| | Internal PHP, used by cPanel interfaces, including Roundcube webmail | 138.0.18, 136.0.50, and 134.0.66 include
no status named
Yes, cPanel is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and patches have been released. Here is a detailed breakdown: What Is PHP2Shell? PHP2Shell refers to two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. | CVE | Type |
no status named
Yes. cPanel systems are affected because the vulnerabilities are in PHP itself, including PHP installations managed through cPanel/EasyApache—not necessarily in the cPanel interface code. Patching status: cPanel has released fixed EasyApache packages. EasyApache 4 updates ea-php82–ea-php85 to PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, which contain the fixes for CVE-2026-109618 and CVE-2026-109619. cPanel also reportedly backported fixes for ea-php74, ea-php80,
no status named
Yes, cPanel and WHM installations are affected because they use PHP packages (such as EasyApache 4 builds), though the vulnerabilities themselves reside in the PHP core runtime rather than cPanel's custom code. cPanel has released patches for the affected PHP versions (ea-php74 and newer). How to Patch and Verify on cPanel/WHM Update packages: Run package updates via the command
no status named
The cPanel platform is affected by the PHP2Shell vulnerabilities, as it ships with and supports various PHP versions (ea-php). However, cPanel has already released patches to mitigate the issue. According to the official cPanel Knowledge Base Advisory, all shipped PHP versions were initially suspected to be vulnerable. To address CVE-2026-109618 and CVE-2026-109619, cPanel released updates for EasyApache PHP versions
One card per engine, the latest capture. Every capture is in ai-answers.json. Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch.
Submit a correction or your statement. We list a statement only once we have opened it on your own domain or verified official account. Disputes follow the dispute policy. Or email the statement link to index@broadcastwell.com.
The badge for cPanel reads PHP2Shell statement listed, Verified 23 October 2026, Broadcastwell, and links to this record. Badge and embed code · Badge terms.
cPanel's customers can ask us for the PHP2Shell Record Check: we capture what ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode say about cPanel and PHP2Shell, trace every wrong or missing statement to its source and deliver a statement page in the format the engines quote. Record Check $490 once.
This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host.
Last refreshed .
PHP2Shell Statement Index · AI Answer Watch · Download the data · Submit a statement · Dispute policy