# What AI engines tell site owners about PHP2Shell

Reviewed and analysed by the Broadcastwell team
The work was reviewed, analysed and worked on by the Broadcastwell team.

Captured 23 October 2026. Final grades approved unchanged by Priya Nair, Ananya Rao and Vikram Patel; team approval confirmed by the owner at 2026-10-23T04:42:26.686Z.

Study: https://broadcastwell.com/php2shell/study
DOI: 10.5281/zenodo.23586713
Licence: CC BY 4.0, https://creativecommons.org/licenses/by/4.0/.

## Findings

Of 148 eligible answers, 23 (15.5%) were marked potentially misleading, two (1.4%) named a wrong fixed version and two (1.4%) made the WordPress update error. The last two measures refer to the same two answers.
106/148 (71.6%) named a correct fixed version. Restart guidance appeared in 31/45 (68.9%) answers to the three applicable questions. The 9.2 severity score appeared in 28/148 (18.9%).

| Engine | Eligible / planned | Misleading | Correct fixed version | Wrong fixed version | WordPress error | Restart in applicable answers | States 9.2 |
|---|---:|---:|---:|---:|---:|---:|---:|
| ChatGPT | 30/30 | 2/30 (6.7%) | 22/30 (73.3%) | 0/30 (0.0%) | 0/30 (0.0%) | 6/9 (66.7%) | 0/30 (0.0%) |
| Claude | 30/30 | 7/30 (23.3%) | 27/30 (90.0%) | 0/30 (0.0%) | 0/30 (0.0%) | 6/9 (66.7%) | 19/30 (63.3%) |
| Perplexity | 30/30 | 2/30 (6.7%) | 20/30 (66.7%) | 0/30 (0.0%) | 0/30 (0.0%) | 6/9 (66.7%) | 0/30 (0.0%) |
| Google AI Overviews | 28/30 | 4/28 (14.3%) | 19/28 (67.9%) | 2/28 (7.1%) | 2/28 (7.1%) | 7/9 (77.8%) | 6/28 (21.4%) |
| Google AI Mode | 30/30 | 8/30 (26.7%) | 18/30 (60.0%) | 0/30 (0.0%) | 0/30 (0.0%) | 6/9 (66.7%) | 3/30 (10.0%) |

The overall rubric grades among eligible answers were: 113 Incomplete, 23 Correct, 8 Wrong, 4 No answer.

## Files

- study-grades.csv: 150 final answer-level review records and the exact owner-confirmed team attribution.
- study-answers.jsonl: 150 captured answer records with cited URLs, UTC timestamps, exclusions and explicit redaction flags.
- study-summary.json: recomputed counts, source domains, host comparisons, attributed quotations and limitations.
- STUDY_README.md: this file.
- METHOD.md: questions, grading rules, denominators, exclusions and publication controls.

The answer file is verbatim except for marked exploit-mechanics removals. Do not describe it as unmodified text. Redactions change no grades or exclusions.

## Limits

- This is a dated, descriptive snapshot of 10 questions, five engines and three runs per question. It is not a random sample of all answers or a statistical ranking.
- The 150 planned cells include two Google AI Overviews captures with no overview returned. These are excluded from the 148-answer headline base. Four other eligible answers were graded No answer and remain in that base.
- Potentially misleading is the reviewed rubric judgement, not evidence that anyone acted on an answer or remained unpatched. Incomplete does not automatically mean misleading.
- Restart coverage uses the 45 eligible answers to the three questions whose rubric required restart guidance. Other answer-level percentages use 148 eligible answers.
- Source counts are eligible answers citing a domain at least once, not links, source quality scores or independent verification of every cited claim. A domain may have more than one source type.
- The public answer text preserves captured wording except for explicitly marked exploit-mechanics removals in nine answer rows. All 150 rows, including both exclusions, remain available. The private originals were retained.
- The owner confirmed team approval of all existing grades without corrections. No per-row reviewer initials or comments were invented. Host comparisons preserve those approved review judgements against the dated Index snapshot.
- The study and Statement Index document answers and published statements. They do not scan, probe or assess the security of any company.

Corrections: https://index.broadcastwell.com/php2shell/submit/ or index@broadcastwell.com.

When you broadcast, broadcast well.