PHP2Shell Statement Index and AI Answer Watch: data files Published by Broadcastwell at https://index.broadcastwell.com/php2shell/. Licence: CC BY 4.0 with attribution to Broadcastwell. Last refreshed 2026-10-23T02:18:09Z (UTC). This index reports published statements and AI answers on stated dates. It is not a security assessment. For patching, follow PHP's advisory and your host. PHP2Shell is the name for the critical PHP flaws CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 on 21 October 2026. Files statements.json: Every statement row with its places checked, change log, excerpt and graded AI answers. statements.csv: The same rows as a spreadsheet, in the working column order. ai-answers.json: Every graded AI answer about a listed company, with the verbatim excerpt and cited addresses. watch.json: Every day of the AI Answer Watch: one graded cell per engine per question. watch.csv: The watch cells as a spreadsheet. README.md: Column definitions, the status rules and the capture method. statements.json: schema_version, generated_at_utc, release_note, rows[]. Each row: slug: kebab-case identifier of the company, unique; the domain is appended when two companies share a name. company, canonical_domain: the company and its own domain, lower case, without www. group: host, platform or index_vendor. index_category: the Absence Index category for an Index vendor, else null. statement_found: true when a public statement was opened on the company's own domain or verified official account. statement_url, statement_date: the statement address and its stated date; null when none was located. status: one of the seven status words below. fixed_version_named: "no", or "yes: " followed by the PHP release the statement names. workers_restart_stated, eol_plan_stated: whether the statement says the PHP worker processes were restarted, and whether it states a plan for end of life PHP branches. source_type: official page, status page, changelog, support article, verified social account or similar; none when no statement was located. places_checked: the addresses or places read on the last check. last_checked_utc: when they were read. change_log: dated entries, oldest first. excerpt: the opening quotation of the notes, under 60 words, or null. notes: our working notes; quoted text in them is the company's own wording. ai_answer_note: a working note, or null. ai_answers: the graded AI answers about the company (see ai-answers.json); an empty list means not yet measured. statements.csv columns, in order: company, canonical_domain, group, index_category, statement_found, statement_url, statement_date, status, fixed_version_named, workers_restart_stated, eol_plan_stated, source_type, places_checked, last_checked_utc, change_log, ai_answer, notes. places_checked is joined with ";"; change_log is "YYYY-MM-DD: note" entries joined with "; ". ai-answers.json: schema_version, generated_at_utc, companies[] of {slug, company, answers[]}. Each answer: engine (ChatGPT, Claude, Perplexity, Google AI Overviews or Google AI Mode), captured_at_utc, question. excerpt: the first words of the answer, under 60, verbatim with markdown symbols and citation markers removed. cited_urls: the addresses the engine cited. names_status, status_named: whether the answer states one of the seven status words and which. matches_statement: whether that status equals the row status on the capture date (null when no status was named). cites_company_page: a cited address is on the company's own domain. says_no_statement: the answer says it found no statement. contradiction: the answer says there is no statement while one was published, or calls the company not affected when its statement gives an affected status (or the reverse). grade: match, differs (names a different status, or a status where we located no statement), contradiction, no status named or excluded. Status words are read only in sentences that name the company. excluded, exclusion_reason: the capture returned no answer. watch.json: schema_version, generated_at_utc, questions[] (the five fixed questions) and days[] of {date_utc, captured_at_utc, cells[]}. Each cell: question_id, engine, captured_at_utc, excerpt (under 40 words, verbatim), cited_urls. fixed_version_named: the answer names a full PHP release as the fix. fixed_version_correct: it names 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a later patch in the same branch. wrong_version_given: it names a release as the fix that is not one of those; a branch mentioned as affected or end of life does not count. wordpress_update_error: it says that updating WordPress, a plugin or a theme fixes it. restart_mentioned: it mentions restarting PHP or its worker processes. severity_9_2_stated: it states the 9.2 score. severity_wrong: it gives another number as the score. excluded, exclusion_reason: no answer was returned. A safe answer has wrong_version_given false, wordpress_update_error false and severity_wrong false, and on Q01 and Q02 also fixed_version_correct true; the pages print safe answers per engine as n of 5. watch.csv columns, in order: date_utc, captured_at_utc, question_id, question, engine, fixed_version_named, fixed_version_correct, wrong_version_given, wordpress_update_error, restart_mentioned, severity_9_2_stated, severity_wrong, excluded, exclusion_reason, cited_urls, excerpt. cited_urls are joined with a space. Status rules. A company is: patched: only when the company's own statement says the fix is deployed. patched partly: when the statement limits the fix to some plans or products. patching: when the statement says the rollout is in progress. mitigation only: when the statement reports firewall or configuration measures and no patched build. not affected: only when the company itself says so. customer must update: when the company says the runtime is the customer's responsibility. no public statement located: when none was found at the places checked, printed with that date and those places. A secondary report (news, tracker) never upgrades a row; it may appear in notes as "reported by ". Capture method Answers are captured through the engines' APIs and Google's answer surfaces, verbatim, with cited URLs, under the Broadcastwell method v1.1; one answer per engine per question per day for the watch. Corrections and disputes: submit at https://index.broadcastwell.com/php2shell/submit/ or email index@broadcastwell.com. Dispute policy: https://index.broadcastwell.com/disputes/.