# PHP2Shell Answer Study: method v1.1

We captured 10 fixed site-owner questions on ChatGPT, Claude, Perplexity, Google AI Overviews and Google AI Mode, three times per engine, on 23 October 2026. The planned grid was 10 × 5 × 3 = 150 cells. We retained answer wording, capture time and cited URLs. Answers were captured through the engines' APIs and Google's answer surfaces; these observations do not claim to reproduce every consumer session.

## Questions

- Q01: How do I fix PHP2Shell?
- Q02: Which PHP version fixes CVE-2026-109618 and CVE-2026-109619?
- Q03: Does updating WordPress fix PHP2Shell?
- Q04: Is PHP 7.4 patched for PHP2Shell?
- Q05: Which web hosts have patched PHP2Shell?
- Q06: Is my WordPress site safe from PHP2Shell?
- Q07: How do I check if my server was compromised by PHP2Shell?
- Q08: Which tools check for PHP2Shell?
- Q09: Do I need to restart PHP after patching PHP2Shell?
- Q10: Should I take my website offline because of PHP2Shell?

## Ground truth

The PHP project announced fixed PHP releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October 2026. We used the dated PHP announcements, upstream records and official company statements in the review pack. A vendor backport is not rejected solely because its package retains an earlier upstream version number. WordPress, plugin and theme updates do not replace the PHP runtime fix. Statements about mitigation must distinguish a temporary measure from a complete fix.
- PHP announcement, read 23 October 2026: https://www.php.net/archive/2026.php#2026-10-21-5
- WordPress project announcement, read 23 October 2026: https://wordpress.org/news/2026/10/critical-php-security-release/
- Dated statement records: https://index.broadcastwell.com/php2shell/

## Grading and review

Each answer was graded for a correct or wrong fixed version, the WordPress update error, restart guidance, end-of-life branches, severity, exploitation, mitigation, host claims, invented facts and an overall grade. Potentially misleading is the separate misled flag recorded in the review sheet. Overall grades are Correct, Incomplete, Wrong or No answer. We have published the reasons and evidence with each row.
The owner confirmed that Priya Nair (Management Consultant), Ananya Rao (AI Engineer) and Vikram Patel (AI Architect) reviewed the pack and approved all existing grades unchanged. Every row carries the attribution "Priya Nair, Ananya Rao, Vikram Patel (team approval confirmed by the owner)", the owner message timestamp 2026-10-23T04:42:26.686Z and the note "approved as graded". No row-specific reviewer initials or commentary were inferred. All grades are final; zero grade corrections were applied.
Reviewed and analysed by the Broadcastwell team. The work was reviewed, analysed and worked on by the Broadcastwell team.

## Denominators and calculation

Two Google AI Overviews cells returned no overview and remain in the dataset as excluded. All answer-level headline shares divide the reviewed count by 148 eligible cells, including four eligible No answer grades. Per-engine denominators are 30 except Google AI Overviews, which has 28. Restart coverage divides by the 45 eligible answers to Q01, Q02 and Q09. The two wrong-version and two WordPress-error flags refer to the same pair of answers and are not additive.
A cited domain is counted at most once per eligible answer. Types describe the cited URL: official project or authority, vendor, news, tracker, or forum/social. A domain carrying several types is labelled with each. Host counts describe Q05 review records; comparisons retain the exact approved judgement against the Index snapshot and do not verify a running host.
We select three useful sentences and three sentences needing correction from the reviewed quotations and print the engine, question and run. They are examples, not a second sample or an independent grade.

## Publication and limitations

The CSV and JSON Lines are CC BY 4.0 with attribution to Broadcastwell. Answer wording is retained except for explicit markers replacing exploit-mechanics lines in nine answer rows. The public file contains all 150 cells, including exclusions; no private billing, execution, credential or model-configuration metadata is included.
- This is a dated, descriptive snapshot of 10 questions, five engines and three runs per question. It is not a random sample of all answers or a statistical ranking.
- The 150 planned cells include two Google AI Overviews captures with no overview returned. These are excluded from the 148-answer headline base. Four other eligible answers were graded No answer and remain in that base.
- Potentially misleading is the reviewed rubric judgement, not evidence that anyone acted on an answer or remained unpatched. Incomplete does not automatically mean misleading.
- Restart coverage uses the 45 eligible answers to the three questions whose rubric required restart guidance. Other answer-level percentages use 148 eligible answers.
- Source counts are eligible answers citing a domain at least once, not links, source quality scores or independent verification of every cited claim. A domain may have more than one source type.
- The public answer text preserves captured wording except for explicitly marked exploit-mechanics removals in nine answer rows. All 150 rows, including both exclusions, remain available. The private originals were retained.
- The owner confirmed team approval of all existing grades without corrections. No per-row reviewer initials or comments were invented. Host comparisons preserve those approved review judgements against the dated Index snapshot.
- The study and Statement Index document answers and published statements. They do not scan, probe or assess the security of any company.

Corrections and disputes: https://index.broadcastwell.com/disputes/.