{ "schema_version": "1.0", "generated_at_utc": "2026-10-23T02:18:09Z", "companies": [ { "slug": "a2-hosting", "company": "A2 Hosting", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "A2 Hosting has addressed PHP2Shell and reports its managed-platform update complete; self-managed servers require customer action. A2 Hosting now operates as hosting.com, so its official status page is the relevant source. As checked on October 23, 2026: Affected? The provider’s security-update notice explicitly references CVE-2026-109618 and CVE-2026-109619 and describes deploying patches across its platforms. This confirms remediation was applicable,", "cited_urls": [ "https://hosting.com/about/news/?utm_source=openai", "https://status.hosting.com/incident/3174" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my research, I was unable to find any public statement, advisory, or announcement from A2 Hosting specifically addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619). There is no press release, knowledge base article, or blog post from A2 Hosting in the available search results regarding this vulnerability. I cannot confirm whether A2 Hosting has patched or officially responded to PHP2Shell", "cited_urls": [ "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "A2 Hosting is potentially affected, because PHP2Shell affects unpatched PHP installations serving web requests, regardless of hosting provider. However, there is no publicly verifiable A2 Hosting statement in the available sources confirming whether its servers were affected or whether patching has been completed. The PHP fixes were released on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.", "cited_urls": [ "https://github.com/hkoeck/php2shell-status", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://sansec.io/research/php2shell", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, A2 Hosting uses standard cPanel/EasyApache and shared infrastructure affected by the core PHP vulnerabilities known as PHP2Shell ( CVE-2026-109618 and CVE-2026-109619), and platform vendors and upstream package maintainers (such as cPanel and CloudLinux) have been rolling out backported patches across shared hosting and managed environments. hosting.com +2 Overview of Impact and Patch Status Vulnerability Nature : CVE-2026-109618 (out-of-memory", "cited_urls": [ "https://status.hosting.com/incident/3174", "https://cyberunit.com/insights/cpanel-vulnerability-cve-2026-41940-business-impact/", "https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://blog.cloudlinux.com/php-cve-2026-109618-and-cve-2026-109619" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is A2 Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Yes, potentially. Any hosting environment running unpatched versions of PHP handling web requests (such as Apache, LiteSpeed, or PHP-FPM) is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) until the underlying PHP runtime is upgraded. Because web hosting providers like A2 Hosting host applications running various PHP versions across user accounts, servers are", "cited_urls": [ "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://techcommunity.microsoft.com/blog/azurenetworksecurityblog/addressing-php2shell-cve-2026-109618-and-cve-2026-109619-upgrade-guidance-and-az/4566623", "https://security.paloaltonetworks.com/CVE-2026-109618" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "adobe-commerce-magento", "company": "Adobe Commerce, Magento", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Adobe Commerce (Magento) is affected when it runs on a vulnerable PHP runtime. PHP fixes are available, but that does not establish that Adobe has patched every Commerce deployment. As of October 23, 2026: | Question | Verified status | |---|---| | Is Adobe Commerce affected? | NCSC-NL’s current PHP2Shell tracker lists Adobe Commerce as “Vulnerable” to both CVE-2026-109618", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_a.md", "https://www.php.net/", "https://www.php2shell.com/?utm_source=openai" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive answer based on multiple sources: Is Adobe Commerce (Magento) Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? ✅ Yes — Adobe Commerce (Magento) Is Affected Because the flaws sit in PHP itself, every Magento 2, Adobe Commerce, WooCommerce, and WordPress store is exposed until the PHP on its server is updated. PHP2Shell refers to two critical PHP", "cited_urls": [ "https://www.czargroup.net/blog/php2shell-cve-2026-109618-cve-2026-109619-for-magento-2-adobe-commerce-and-woocommerce/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "http://www.iovista.com/blog/php2shell-vulnerabilities-cve-2026-109618-109619/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Adobe Commerce/Magento is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a PHP-engine vulnerability rather than a Magento application flaw. The affected scope includes PHP 5.4 and later; the application’s own code can be clean and still be exposed. It has not been patched in Adobe Commerce itself. The remediation is to update the", "cited_urls": [ "https://magentoinfo.com/blog/php-critical-rce-flaws-magento-adobe-commerce", "https://everyhost.co.uk/insights/php2shell-magento-cve-2026-109618", "https://www.iovista.com/blog/php2shell-vulnerabilities-cve-2026-109618-109619/", "https://ceymox.com/latest-news/adobe-commerce-php2shell-security-update/", "https://avada.io/blog/php2shell-php-vulnerability/", "https://meetanshi.com/blog/magento-2-php-vulnerabilities-security-alert/", "https://no7software.co.uk/blog/php2shell-php-vulnerability", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_m.md", "https://sansec.io/research/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Adobe Commerce and Magento Open Source are affected because PHP2Shell is a vulnerability in the underlying PHP language runtime rather than a flaw in the application code itself. Impact and Patch Status Affected Status: Any Adobe Commerce or Magento store running on an unpatched PHP version is exposed, even if the Adobe Commerce application itself is fully up", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://zynovo.com/blog/critical-security-alert-php2shell-vulnerabilities-affecting-magento-and-adobe-commerce/", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Adobe Commerce (Magento) affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Is Adobe Commerce (Magento) Affected? Yes. Adobe Commerce and Magento Open Source are affected because they run on PHP, and the PHP2Shell vulnerabilities reside in the underlying PHP runtime environment itself rather than within Magento's application code. The Vulnerabilities: Tracked as CVE-2026-109618 and CVE-2026-109619, these critical flaws (rated 9.2 on CVSS v4.0) impact all vulnerable PHP installations serving web", "cited_urls": [ "https://sansec.io/research/php2shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://projectdiscovery.io/research/php2shell", "https://ceymox.com/latest-news/adobe-commerce-php2shell-security-update/", "https://massmarketretailers.com/critical-php-flaw-puts-retail-websites-and-e-commerce-systems-on-alert/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "bluehost", "company": "Bluehost", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Bluehost is treating these CVEs as affecting its hosting infrastructure and has patched the majority of its systems—but has not confirmed a complete rollout. As checked on October 23, 2026, its latest posted update is October 22 at 18:15 (labeled “EST” by Bluehost). It says patched PHP builds are still being deployed to the remaining infrastructure. Bluehost’s official “PHP", "cited_urls": [ "https://www.bluehost.com/status/announcement/271" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on thorough searching across multiple security sources, there is no public statement, advisory, or announcement from Bluehost specifically addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619). No security researcher, vendor bulletin, or news outlet has published information confirming whether Bluehost has patched or even formally acknowledged these vulnerabilities at this time. Here is what is known about the vulnerabilities themselves, and", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Bluehost is potentially affected wherever it hosts websites running vulnerable PHP versions. PHP2Shell affects the PHP runtime itself, not a particular CMS or hosting brand; vulnerable versions include PHP 8.2.0–8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, and 8.5.0–8.5.11. The PHP fixes were released on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. However, no reliable public Bluehost statement confirming that all", "cited_urls": [ "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/README.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Bluehost was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the hosting provider has rolled out patches across the majority of its infrastructure. Status and Patching Details Impact: Bluehost platforms running unpatched PHP versions inherit the risk of the critical remote code execution (RCE) flaws (CVSS 9.2). Patch Status: Bluehost has made significant progress deploying patched PHP builds", "cited_urls": [ "https://www.bluehost.com/status/announcement/271", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://www.clarin.com/us-news/php-vulnerability-2026-explained-what-happened-with-php2shell-how-it-affects-millions-of-sites-and-what-precautions-you-must-take_0_mIsl8QvvI4.html" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Bluehost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Bluehost's hosting infrastructure is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which impact underlying PHP core runtimes globally. Patch Status In Progress / Partially Patched: Bluehost's teams have been actively rolling out patched PHP builds across their hosting infrastructure. As of their latest updates, the majority of their shared and managed platforms have been updated, though deployment", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://www.bluehost.com/status/announcement/271", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "cisco", "company": "Cisco", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—some Cisco products are confirmed affected, but Cisco’s advisory does not yet list an available patch for them. As of October 23, 2026, the latest advisory is version 1.4, updated October 22, 2026, at 23:00 GMT, covering both CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). | Confirmed affected product | Fix listed by Cisco | Availability | |---|---|---| | Ultra-Reliable Wireless Backhaul", "cited_urls": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of Cisco's status regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), based on the latest available sources: 🔍 What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619 are critical remote code execution (RCE) vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from how PHP handles out-of-memory", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.configlane.io/en/blog/php2shell-cisco-sicherheitsluecken" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cisco has not confirmed any affected products for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) as of its October 22, 2026 advisory. However, Cisco is still investigating multiple products and cloud services, so this is not yet a definitive “not affected” determination. Cisco’s advisory does not list a Cisco product-level patch or fixed release, and it says there are no workarounds. If", "cited_urls": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/", "https://www.configlane.io/en/blog/php2shell-cisco-sicherheitsluecken", "https://www.secnews.gr/en/742100/php-cve-2026-109618-109619-critical-effects/", "https://github.com/hkoeck/php2shell-status", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://sec.cloudapps.cisco.com/security/center/publicationService.x?criteria=exact&cves=&keyword=&last_published_date=&limit=20&offset=0&publicationTypeIDs=1", "https://sec.cloudapps.cisco.com/security/center/psirtrss10/CiscoSecurityAdvisory.xml", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cisco is currently investigating its product line for potential exposure to PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Investigation Status: In its official advisory, Cisco stated that it is reviewing roughly 30 of its products and cloud services (including Identity Services Engine, Catalyst Center, and the AppDynamics PHP Agent). Current Confirmation: As of the latest update, Cisco has not confirmed any products", "cited_urls": [ "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq", "https://www.upguard.com/blog/php2shell-a-clear-explanation-and-response-framework", "https://www.securityweek.com/tech-and-security-companies-respond-to-php2shell-vulnerabilities/amp/", "https://community.cisco.com/t5/duo-release-notes/duo-access-gateway-3-2-0-released-2026-10-21/tac-p/5583260", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Cisco affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cisco is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if it runs vulnerable PHP runtime engines in its software or appliances, and Cisco Talos has issued network intrusion prevention (SNORT) signatures rather than direct universal software patches for all third-party components. Affected Scope & Details The Vulnerability: PHP2Shell consists of two critical memory-safety remote code execution (RCE) flaws", "cited_urls": [ "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://blog.ogwilliam.com/post/php2shell-cve-2026-109618-cve-2026-109619-rce-vulnerability", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "cloudways", "company": "Cloudways", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Cloudways was affected, and it now reports that patching is complete. As of October 23, 2026, the official sources say: Affected: DigitalOcean’s advisory for CVE-2026-109618 and CVE-2026-109619 explicitly lists Cloudways as “Affected”, with remediation handled by DigitalOcean. It covers Cloudways-supported PHP versions from 5.6 onward, using extended-LTS partners for older versions. Patched: Cloudways’ official status update dated October 22,", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://status.cloudways.com/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Cloudways is affected by PHP2Shell, and patching is actively in progress. Here is a full breakdown: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — in PHP versions 5.4–8.5 that allow remote code execution (RCE). Both are rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: a fatal error during a", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://sansec.io/research/php2shell", "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Cloudways was affected because the PHP2Shell vulnerabilities affect PHP installations broadly, including the PHP versions used on Cloudways. DigitalOcean states that Cloudways was actively patching supported PHP versions, including PHP 5.6 and newer, while applying temporary mitigations and targeted WAF rules during the rollout. As of October 22, Cloudways reported that patching was complete across active Autonomous and", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://meowapps.com/php2shell-wordpress/", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://sansec.io/research/php2shell", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Cloudways is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and patching is currently in progress. Status: Affected and actively being patched. Actions Taken by Cloudways / DigitalOcean: Cloudways is actively patching supported PHP versions (5.6 and above) using extended LTS partnership support for older PHP instances without forcing customers to migrate versions. Temporary Mitigations: Cloudways has applied PHP's", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Cloudways affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Cloudways itself is a managed hosting platform, but the servers and applications it hosts run PHP. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) affects the core PHP runtime engine across virtually all unpatched versions, any Cloudways server running an unpatched version of PHP is inherently vulnerable to unauthenticated remote code execution. Patch Status: Official security patches for PHP were", "cited_urls": [ "https://www.wiz.io/blog/php2shell-php-rce", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "cpanel", "company": "cPanel", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—cPanel & WHM is affected, and cPanel released fixes for both CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. There are two separate components to check: internal cPanel PHP and the EasyApache PHP used by hosted websites. | Component | Fixed releases | |---|---| | Internal PHP, used by cPanel interfaces, including Roundcube webmail | 138.0.18, 136.0.50, and 134.0.66 include", "cited_urls": [ "https://docs.cpanel.net/release-notes/release-notes/", "https://docs.cpanel.net/changelogs/easyapache-4-change-log-25/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, cPanel is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and patches have been released. Here is a detailed breakdown: What Is PHP2Shell? PHP2Shell refers to two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. | CVE | Type |", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://computingforgeeks.com/patch-php2shell-cpanel-whm/", "https://phpvulnerability.org/cpanel/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. cPanel systems are affected because the vulnerabilities are in PHP itself, including PHP installations managed through cPanel/EasyApache—not necessarily in the cPanel interface code. Patching status: cPanel has released fixed EasyApache packages. EasyApache 4 updates ea-php82–ea-php85 to PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, which contain the fixes for CVE-2026-109618 and CVE-2026-109619. cPanel also reportedly backported fixes for ea-php74, ea-php80,", "cited_urls": [ "https://www.panellicense.com/kb/php2shell-cve-2026-109618-109619-hosting-servers/", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://github.com/hkoeck/php2shell-status", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://smarthost.ie/php-security-alert-21-10-26/amp/", "https://www.greenbone.net/en/blog/php2shell-remote-code-execution-cve-2026-109618-cve-2026-109619/", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.vpsbg.eu/blog/2-critical-php-vulnerabilities-found-php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, cPanel and WHM installations are affected because they use PHP packages (such as EasyApache 4 builds), though the vulnerabilities themselves reside in the PHP core runtime rather than cPanel's custom code. cPanel has released patches for the affected PHP versions (ea-php74 and newer). How to Patch and Verify on cPanel/WHM Update packages: Run package updates via the command", "cited_urls": [ "https://www.reddit.com/r/webhosting/comments/1xc4wzj/php2shell_some_shared_hosts_still_havent_patched/", "https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619", "https://computingforgeeks.com/patch-php2shell-cpanel-whm/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is cPanel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "The cPanel platform is affected by the PHP2Shell vulnerabilities, as it ships with and supports various PHP versions (ea-php). However, cPanel has already released patches to mitigate the issue. According to the official cPanel Knowledge Base Advisory, all shipped PHP versions were initially suspected to be vulnerable. To address CVE-2026-109618 and CVE-2026-109619, cPanel released updates for EasyApache PHP versions", "cited_urls": [ "https://support.cpanel.net/hc/en-us/articles/44397389677335-Critical-PHP-Security-Release-CVE-2026-109618-and-CVE-2026-109619", "https://www.picussecurity.com/resource/php2shell-the-two-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "digitalocean", "company": "DigitalOcean", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—some DigitalOcean products were affected, and patches have been deployed, but customer-managed PHP workloads are not automatically fixed. DigitalOcean’s official advisory explicitly covers both CVE-2026-109618 and CVE-2026-109619. Status as of October 23, 2026: | Product | Patch status / required action | |---|---| | App Platform | PHP buildpack patched. Redeploy applications to receive the fix; custom containers require", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://status.cloudways.com/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, DigitalOcean is aware of and affected by PHP2Shell, and has communicated patch availability. Here is a detailed breakdown: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): DigitalOcean's Status What is PHP2Shell? PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, two critical vulnerabilities in PHP that can allow unauthenticated remote code execution. Specifically: CVE-2026-109618 – RCE via OOM corruption: out-of-memory handling can interrupt PHP while", "cited_urls": [ "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. DigitalOcean is affected wherever customers run PHP, including Droplets, DOKS workloads, App Platform applications, custom containers, and existing Marketplace 1-Click images. DigitalOcean says PHP versions from 5 onward are potentially affected. Patch status: App Platform: The PHP buildpack has been patched, but applications must be redeployed. Apps using a custom Dockerfile or container image require the customer to", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://x.com/digitalocean/status/2112953857496195200", "https://php2shellcheck.com/hosting-status/", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, DigitalOcean's ecosystem and certain hosted products are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the status of the patches depends on the specific DigitalOcean product being used . DigitalOcean addressed the incident and outlined specific product statuses in its official advisory: Critical PHP RCE Vulnerabilities: Patch Now (CVE-2026-109618, CVE-2026-109619) | DigitalOcean. Product Patch Status on DigitalOcean", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://www.youtube.com/watch?v=cOFt72z7cq8" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is DigitalOcean affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "DigitalOcean itself is not the vulnerable entity, but user droplets, virtual private servers (VPS), and apps running unpatched PHP instances on DigitalOcean infrastructure are directly affected by CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Because DigitalOcean provides cloud infrastructure rather than managing user-level application runtimes, you (the user) are responsible for updating PHP on your own droplets or servers to a patched", "cited_urls": [ "https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.bbc.com/news/articles/c3qjnwye0ep5o" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "dreamhost", "company": "DreamHost", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—DreamHost treated its PHP hosting infrastructure as affected, and says patching is complete. As of October 23, 2026, its latest official update reports that PHP security updates have been deployed across its entire network. The incident covers shared hosting, Managed VPS, DreamPress, and dedicated hosting. DreamHost’s timeline: October 21: Protections were in place, followed by rollout of the official", "cited_urls": [ "https://www.dreamhoststatus.com/pages/incident/575f0f606826303142000510/6ad8c218a7031204d4ca2981" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my thorough search of available sources, I found extensive information about PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but no public statement, advisory, blog post, or announcement from DreamHost specifically addressing these vulnerabilities has appeared in any search results. Here is a full breakdown of what is known: ⚠️ DreamHost — No Public Statement Found There is no publicly available", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": true, "status_named": "no public statement located", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—DreamHost was affected because its servers run PHP, and PHP2Shell affected all PHP installations serving web requests. DreamHost reportedly said it was rolling out PHP’s fix across all servers, while blocking known attack paths in the interim, as of October 21, 2026. The available report does not confirm that the rollout was fully completed; it says only that deployment", "cited_urls": [ "https://tjrobertson.com/php-security-update-wordpress/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/README.md" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "DreamHost is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the provider is actively rolling out fixes across its network while deploying temporary firewall protections. Affected Status: DreamHost servers and shared hosting environments initially ran unpatched PHP runtimes. Patch Progress: DreamHost reported that the fixed PHP builds were rolling out to the bulk of its network, with final", "cited_urls": [ "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://meowapps.com/php2shell-wordpress/", "https://www.reddit.com/r/dreamhost/comments/1xbrnzy/what_is_the_dreamhost_doing_about_the_recent_php/", "https://mjtsai.com/blog/2026/10/21/php2shell/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is DreamHost affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, DreamHost's hosting infrastructure was potentially exposed because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affect the core PHP engine runtime itself rather than a specific web application. DreamHost's Status & Patching Mitigation & WAF Protection: DreamHost's Operations and Technical teams deployed immediate mitigations across all hosting platforms (Shared, VPS, DreamPress, and Dedicated). Their Web Application Firewall (WAF) was configured", "cited_urls": [ "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.reddit.com/r/dreamhost/comments/1xbrnzy/what_is_the_dreamhost_doing_about_the_recent_php/", "https://www.reddit.com/r/dreamhost/comments/1xbrnzy/what_is_the_dreamhost_doing_about_the_recent_php/?tl=it", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "drupal", "company": "Drupal", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Drupal sites running vulnerable PHP are affected, and fixes are available in PHP, not as a Drupal-core patch. As of October 23, 2026: Affected: Researchers demonstrated unauthenticated remote code execution against Drupal. CVE-2026-109618 and CVE-2026-109619 are vulnerabilities in the underlying PHP runtime, rather than Drupal’s application code. Drupal’s response: Its official PSA-2026-10-20 directs administrators or hosting providers to update", "cited_urls": [ "https://www.php2shell.com/", "https://www.drupal.org/psa-2026-10-20", "https://www.php.net/index.php" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Drupal is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), but the fix comes from patching PHP itself, not Drupal. Here is a detailed breakdown: ⚠️ What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. Both allow unauthenticated remote code execution on default configurations. The two", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://sansec.io/research/php2shell", "https://www.upwind.io/feed/initial-assessment-php2shell-two-critical-unpatched-php-rces-cve-2026-109618-cve-2026-109619", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "https://www.technology.org/2026/10/22/php2shell-critical-php-rce-cve-2026-109618-109619-patch/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://github.com/Anton-Barinov/php2shell-patches" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Drupal sites are affected when they run a vulnerable PHP runtime—the flaws are in PHP itself, not Drupal core. Researchers demonstrated unauthenticated remote-code execution against current Drupal images, and Drupal’s own statement says updating Drupal alone is insufficient. Has Drupal patched it? Not in Drupal core. The required fix is to update the underlying PHP installation to a", "cited_urls": [ "https://php2shell.eu/", "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.digitalapplied.com/blog/php2shell-critical-php-vulnerabilities-patch-now", "https://www.scottharvanek.com/2026/10/", "https://sansec.io/research/php2shell", "https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/", "https://www.rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now", "https://sra.io/wp-content/uploads/2026/10/TB20261021-PHP2Shell.pdf", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Drupal sites are affected if they run on an unpatched PHP runtime, because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability in the PHP core engine itself rather than Drupal's application code. Key Details Affected Status: Any Drupal site running on a vulnerable version of PHP can be targeted for unauthenticated remote code execution (RCE) or memory disclosure. The", "cited_urls": [ "https://www.sweet.security/blog/php2shell-critical-php-vulnerabilities-expose-millions-of-applications-to-remote-code-execution", "https://www.drupal.org/association/blog/after-the-php-security-release-auditing-your-drupal-sites", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://www.wiz.io/blog/php2shell-php-rce", "https://securityscorecard.com/blog/php2shell-customer-advisory-cve-2026-109618-and-cve-2026-109619-remediation-guide/", "https://www.drupal.org/psa-2026-10-20" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Drupal affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Drupal sites are affected by PHP2Shell, but because these vulnerabilities (CVE-2026-109618 and CVE-2026-109619) exist within the underlying PHP core engine itself rather than inside Drupal’s application code, Drupal cannot issue an internal software patch to fix them. Security researchers confirmed that unauthenticated remote code execution attacks via PHP2Shell are possible against servers running Drupal 11.4 (as well as", "cited_urls": [ "https://sansec.io/research/php2shell", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.picussecurity.com/resource/php2shell-the-two-critical-php-rce-flaws-cve-2026-109618-cve-2026-109619-explained", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "flywheel", "company": "Flywheel", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Flywheel reports that it has patched its hosting platform. As of October 23, 2026, its official “PHP Security Update” incident is marked Resolved. The completion update, posted October 21, 2026, at 2:00 p.m., states: > “WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform.” Flywheel says the patch was applied", "cited_urls": [ "https://status.getflywheel.com/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Flywheel is affected by PHP2Shell, but it has been fully patched. Here is a detailed breakdown: What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates both CVSSv4.0 9.2 and", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://meowapps.com/php2shell-wordpress/", "https://www.activeset.co/blog/php2shell-host-status", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Flywheel is potentially affected if its hosting stack was running an unpatched PHP version. PHP2Shell affects PHP itself, so applications and hosting platforms using PHP are in scope regardless of the CMS or framework. However, no source found here confirms that Flywheel specifically was affected, or that Flywheel had completed its patching. The available advisories only establish that affected", "cited_urls": [ "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/hkoeck/php2shell-status", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://en.wikipedia.org/wiki/PHP2Shell", "https://sansec.io/research/php2shell", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, sites running on Flywheel (owned by WP Engine) were affected by the core PHP PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619 ), and the parent platform has deployed fixes and edge-layer protections. Key Details Vulnerability Impact: Because PHP powers the underlying runtime for WordPress sites, unpatched PHP installations on the server level were exposed to unauthenticated remote code execution (RCE)", "cited_urls": [ "https://hackernoon.com/nsa-says-patch-or-go-offline-as-ai-found-php2shell-flaws-reach-70percent-of-the-web", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://www.upistudy.com/blog/cybersecurity/wp2shell-vs-php2shell-two-2026-web-security-stories-explained-side-by-side", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.servicenow.com/community/armis-articles/php2shell-how-to-find-prioritize-and-patch-affected-systems/ta-p/3612792" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Flywheel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Flywheel (as a managed WordPress hosting platform running PHP environments) is inherently exposed to core PHP vulnerabilities like PHP2Shell (CVE-2026-109618 and CVE-2026-109619) because these critical remote code execution flaws exist within the PHP interpreter engine itself. Are you affected / Has it patched? Flywheel implemented initial protective measures at the CDN and infrastructure edge/firewall level immediately following the", "cited_urls": [ "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://meowapps.com/php2shell-wordpress/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "fortinet", "company": "Fortinet", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "If you mean FortiGate/FortiOS: no—Fortinet explicitly says FortiOS is not affected by CVE-2026-109618 or CVE-2026-109619. That is different from saying every Fortinet product is unaffected. As checked on October 23, 2026: | Question | Verified answer | |---|---| | Is FortiGate/FortiOS affected? | No, according to Fortinet’s official technical article. | | Has Fortinet released protection? | Yes. FortiGate", "cited_urls": [ "https://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762?utm_source=openai", "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750" ], "names_status": true, "status_named": "not affected", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of Fortinet's status regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), based on the latest available sources: 🔒 PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Fortinet's Status What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. Both allow an unauthenticated attacker to execute their", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://fortiguard.fortinet.com/psirt/FG-IR-26-186", "https://www.fortiguard.com/psirt/FG-IR-26-186", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://www.fortiguard.com/threat-signal-report/6551/php2shell-remote-code-execution-vulnerabilities", "https://fortiguard.fortinet.com/threat-signal-report/6551" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Fortinet’s current position is that FortiOS/FortiGate and several other named products are not affected, while 12 products remain under investigation. Fortinet has not confirmed that any of those products are vulnerable or issued product-specific patches yet. Confirmed not impacted: FortiOS/FortiGate FortiManager FortiAnalyzer FortiWeb FortiMail FortiClient for Linux, Windows, and macOS FortiSASE FortiAuthenticator FortiSwitch FortiNAC Still under investigation: FortiADC and", "cited_urls": [ "https://community.fortinet.com/support-forum-92/critical-vulnerabilities-in-php-cve-2026-109618-and-cve-2026-109619-230731", "https://blog.boll.ch/php2shell-vulnerability-cve-2026-109618-and-cve-2026-109619/", "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750", "https://threatcluster.io/cluster/php2shell-vulnerabilities-impact-fortinet-cisco-and-palo-alt-f7e3532d", "https://blog.rankiteo.com/palforcis1792672003-fortinet-cisco-palo-alto-networks-vulnerability-october-2026/", "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://github.com/ersinkoc/php-fix", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Fortinet’s core products—including FortiOS (running on FortiGate firewalls), FortiManager, FortiAnalyzer, FortiWeb, and FortiMail—are not impacted by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, Fortinet is currently investigating 12 specific products to evaluate potential exposure: FortiADC, FortiADC Manager, FortiClient EMS, FortiDDoS, FortiDDoS-F, FortiSIEM, FortiMonitor, FortiClient Cloud, FortiSOAR, FortiSOAR PaaS, FortiGuard, and FortiEndpoint. For protection and remediation: Patching Status: Because these", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://fortiguard.fortinet.com/threat-signal-report/6551", "https://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762", "https://fortiguard.fortinet.com/psirt/FG-IR-26-186" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Fortinet affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on official Fortinet advisories and documentation: Impact Status: Fortinet's core products (such as FortiOS) are not impacted by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because FortiOS itself does not use the affected PHP implementations. Mitigation / Protection: Because Fortinet products are not vulnerable, no product-specific software patch is required for FortiOS. However, Fortinet has released official IPS (Intrusion", "cited_urls": [ "https://community.fortinet.com/fortigate-3/using-the-fortigate-to-protect-against-php-vulnerabilities-cve-2026-109618-and-cve-2026-109619-230762", "https://community.fortinet.com/fortiweb-40/how-to-block-php2shell-cve-2026-109618-cve-2026-109619-on-fortiweb-230750", "https://fortiguard.fortinet.com/threat-signal-report/6551", "https://fortiguard.fortinet.com/psirt/FG-IR-26-186" ], "names_status": true, "status_named": "not affected", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "godaddy", "company": "GoDaddy", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—GoDaddy’s PHP hosting was affected, but GoDaddy now reports its managed hosting services are patched. Self-managed VPS/server customers must patch PHP themselves. This is the status as of October 23, 2026, based on GoDaddy’s own updates. | GoDaddy service | Reported patch status | |---|---| | Managed Hosting for WordPress | All PHP versions patched; confirmed October 21, 19:30", "cited_urls": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://godaddy.statuspage.io/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a full breakdown of GoDaddy's exposure to PHP2Shell and its patch status, based on available sources: What Is PHP2Shell? PHP2Shell is the name used for two critical flaws in PHP itself, which CERT-EU names CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from", "cited_urls": [ "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—GoDaddy was affected in principle, because PHP2Shell affects unpatched PHP installations. However, GoDaddy states that it patched all PHP versions on its Web Hosting and Windows Hosting platforms as of its October 22, 2026 update, and says customers on those services need take no action. The upstream fixes are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exception: GoDaddy VPS and", "cited_urls": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://php2shellcheck.com/hosting-status/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, GoDaddy is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its patch status varies depending on the hosting tier: Managed Hosting for WordPress: GoDaddy has patched all PHP versions on this tier. Web Hosting and Windows Hosting: GoDaddy stated it is still waiting for upstream vendor and control panel package releases (such as cPanel backports) to roll", "cited_urls": [ "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://www.reddit.com/r/godaddy/comments/1xcge2t/godaddy_still_running_php_8234_almost_24_hours/", "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is GoDaddy affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact: Yes, GoDaddy's hosting environment was exposed to the industry-wide \"PHP2Shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because they affect the core PHP language runtime across all hosting providers, rather than being specific to GoDaddy. Patch Status: Yes, GoDaddy confirmed that they have rolled out updates and patches across their standard Web Hosting services, Managed WordPress, and Windows Hosting environments following", "cited_urls": [ "https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.reddit.com/r/godaddy/comments/1xcge2t/godaddy_still_running_php_8234_almost_24_hours/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "hetzner", "company": "Hetzner", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Hetzner confirmed it was affected, and has patched PHP on all its Webhosting and Managed Servers. As of October 23, 2026, its official incident report gives this timeline: | Date/time (UTC) | Confirmed update | |---|---| | October 21, 2026 | Hetzner acknowledged that its PHP versions were affected by both CVEs. | | October 21, 17:50 | Patches", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Hetzner was affected by PHP2Shell and has deployed patches. Here is a full breakdown, sourced directly from Hetzner's own status page and other authoritative sources: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). CVE-2026-109618 (CVSS 9.2) stems from how PHP handles out-of-memory", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Hetzner was affected, but its current status indicates that patches have been deployed for the PHP versions it supports on its Webhosting and Managed Server platforms. Hetzner initially confirmed that the PHP versions it used were vulnerable to CVE-2026-109618 and CVE-2026-109619. It subsequently reported that patches were deployed for PHP 7.4 and 8.0–8.5, and then for the remaining", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://ubuntu.com/blog/php2shell-vulnerability-fixes-available" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Hetzner confirmed that the PHP versions it uses are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619) , and it is actively rolling out patches across its systems. Status & Details Impacted Systems: Hetzner acknowledged that its managed hosting and related services (konsoleH, Managed Servers, Storage Share / Nextcloud, phpMyAdmin, and Webmail) run affected PHP versions. Mitigation & Patching: Hetzner", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7", "https://status.hetzner.com/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Hetzner affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact on Hetzner: Yes, Hetzner's managed infrastructure and webhosting environments were initially affected because the PHP versions they use rely on the vulnerable core runtime affected by CVE-2026-109618 and CVE-2026-109619. Patch Status: Yes, Hetzner has patched the issue across their systems. They deployed emergency patches for PHP versions 5.6 and 7.3, as well as versions 7.4 and 8.0–8.5, across", "cited_urls": [ "https://status.hetzner.com/incident/f4144d55-38c3-48d1-8664-7a3429355cd7" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "hostgator", "company": "HostGator", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—HostGator has affected PHP infrastructure and has patched most, but has not confirmed that all servers are patched. As of October 23, 2026, its latest official update is October 22 at 18:15 (labeled “est” on its page): deployment continues on remaining infrastructure, with the majority up to date. Its earlier update explicitly identifies CVE-2026-109618 and CVE-2026-109619. Source: HostGator’s official", "cited_urls": [ "https://www.hostgator.com/status/announcement/277" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my thorough search of available sources, I was unable to find any public statement, advisory, or announcement specifically from or about HostGator regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). No security bulletin, blog post, or third-party report mentioning HostGator's specific response to these CVEs appeared in any search results. Here is what is known about the vulnerabilities themselves and", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "HostGator’s status is not publicly confirmed in the available sources. Since PHP2Shell affects the PHP engine itself, HostGator would be affected wherever its shared, reseller, VPS, or dedicated hosting servers run an unpatched PHP version; the vulnerabilities affect PHP installations serving web requests, including PHP-FPM and Apache/mod_php. PHP released fixes on October 21, 2026, in PHP 8.2.35, 8.3.36, 8.4.27,", "cited_urls": [ "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "HostGator was affected by the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and HostGator has been rolling out patches across its hosting infrastructure. Status & Details Impact: HostGator's infrastructure runs on PHP environments affected by the core runtime flaws in CVE-2026-109618 and CVE-2026-109619. Patch Status: HostGator stated that its teams have made significant progress deploying patched PHP builds", "cited_urls": [ "https://www.hostgator.com/status/announcement/277", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is HostGator affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact Status: Yes, HostGator's hosting infrastructure utilizing vulnerable PHP builds was affected by the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Patch Status: HostGator's teams have made significant progress and the majority of their shared and managed hosting platforms are now up-to-date with patched PHP builds, while rollout across remaining infrastructure continues. Source: Official updates and deployment tracking", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.hostgator.com/status/announcement/277" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "hostinger", "company": "Hostinger", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Hostinger says its managed hosting was protected against PHP2Shell and is now patched. VPS is the exception: customers must patch it themselves. As of October 23, 2026: | Hosting type | Affected? | Patch status | |---|---|---| | Managed hosting—Web, Cloud, Agency and cPanel | Hostinger says its environment tests found it was not vulnerable to the circulating exploit;", "cited_urls": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://statuspage.hostinger.com/incidents/pj2zs1lx3n9d" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Hostinger is affected by PHP2Shell — but it has responded quickly and comprehensively. Here is a full breakdown: What is PHP2Shell? On October 21, the PHP project fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS). CVE-2026-109618 (\"RCE via OOM corruption\"): PHP's", "cited_urls": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Hostinger’s managed hosting was not exploitable by the circulating PHP2Shell exploit according to its own testing, and Hostinger says its firewall rules blocked matching attack requests. It has also completed deployment of PHP’s fix across all managed hosting servers as of October 22, 2026 at 06:44 UTC. Web Hosting, Agency Hosting, and cPanel Hosting: patched; customers do not need", "cited_urls": [ "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.hostinger.com/blog/feed/", "https://php2shellcheck.com/hosting-status/", "https://arvindkumar.ca/blog/php2shell-wordpress/", "https://pulsetic.com/status/hostinger/incidents/151752/", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Hostinger stated that its shared and managed hosting environments were not directly vulnerable to the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) due to platform architecture (such as LiteSpeed handling and isolated account permissions), though it has rolled out patched PHP builds across all managed hosting infrastructure . Sources & Status Details Hostinger Status Page & Updates: According to the Hostinger", "cited_urls": [ "https://statuspage.hostinger.com/", "https://www.reddit.com/r/Hostinger/comments/1xbru8x/you_werent_affected_by_the_new_php_vulnerability/", "https://x.com/Hostinger/status/2112943242291343380", "https://www.hostinger.com/blog/protecting-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Hostinger affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "According to Hostinger's incident updates, their platform was not vulnerable to the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Impact Status: After conducting testing in their hosting environments, Hostinger confirmed their platform was not vulnerable and implemented extra layers of protection to block potential attack vectors. Patch/Rollout Status: Although their specific platform configurations prevented exploitation, Hostinger rolled out and deployed patched", "cited_urls": [ "https://statuspage.hostinger.com/", "https://pulsetic.com/status/hostinger/incidents/151752/" ], "names_status": true, "status_named": "not affected", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null } ] }, { "slug": "inmotion-hosting", "company": "InMotion Hosting", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—InMotion Hosting’s PHP infrastructure was affected, but patching is not confirmed complete across every hosting environment. Its official advisory, updated October 22, 2026, explicitly addresses both CVE-2026-109618 and CVE-2026-109619. As checked on October 23, 2026, its latest detailed deployment statement says: | Hosting environment | Reported patch status | |---|---| | Shared, Reseller, WordPress Hosting | Patched, including CloudLinux", "cited_urls": [ "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://status.inmotionhosting.com/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, InMotion Hosting is affected by PHP2Shell, and has been actively working on patching it. Here is a full breakdown: What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, nicknamed \"PHP2Shell,\" are two critical PHP flaws that allow unauthenticated remote code execution — an attacker only needs to send a crafted web request, with no login required. Both are rated CVSS v4.0", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a", "https://status.inmotionhosting.com/", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. InMotion Hosting was affected because PHP2Shell impacts PHP installations serving web requests, but its patch status varies by hosting type. Dedicated servers: Patched. InMotion says patched PHP packages addressing both CVEs were applied across all dedicated-server infrastructure. Shared hosting: Patched/complete. CloudLinux released the fixed packages, and InMotion says they were being applied across shared-hosting servers. The PHP version", "cited_urls": [ "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a", "https://php2shellcheck.com/hosting-status/", "https://misservices.us/php2shell-cve-2026-109618-fix-guide", "https://arvindkumar.ca/blog/php2shell-wordpress/", "https://meowapps.com/php2shell-wordpress/", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, InMotion Hosting was affected by the PHP2Shell vulnerabilities ( and CVE-2026-109619). Patch Status: Patches are complete for shared hosting and dedicated servers (with backported updates possibly showing older version strings), while deployment for VPS is ongoing . Source: Official InMotion Hosting Status Page - Security Maintenance: PHP Configuration Updates . If you are using an InMotion Hosting VPS", "cited_urls": [ "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is InMotion Hosting affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, InMotion Hosting was affected by the \"php2shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which involve critical unauthenticated remote code execution flaws in PHP. InMotion Hosting took proactive mitigation steps and has been addressing the issue: Mitigation Action: Starting on October 20, 2026, InMotion Hosting began applying urgent security mitigations across their server infrastructure by disabling the default session.upload_progress.enabled PHP setting", "cited_urls": [ "https://www.inmotionhosting.com/support/news/php-critical-security-release-october-2026/", "https://status.inmotionhosting.com/incidents/5b3dee2d-6b8e-4a58-88e4-812ef43ef43a" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "ionos", "company": "IONOS", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—IONOS’s PHP-based services were in scope, and IONOS confirms it has patched all platforms it operates itself. Self-managed servers are the exception. As of October 23, 2026: IONOS-operated hosting: patched. IONOS names Web Hosting, Managed WordPress, MyWebsite 8, Managed Nextcloud, and HiDrive Next, and says customers on its operated platforms need not take action. Its official statement says: “IONOS", "cited_urls": [ "https://www.ionos.com/newsroom/news/php-vulnerabilities-websites-hosted-by-ionos-are-protected/", "https://www.ionos-status.com/incidents/3fkdbfd8zldr" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "I was unable to find any specific statement, advisory, or blog post from IONOS (the web hosting and cloud provider) addressing PHP2Shell (CVE-2026-109618 and CVE-2026-109619) — either confirming they are affected or announcing a patch. It is important to note that the IONIX result that appeared in searches refers to IONIX (a cybersecurity attack surface management company), which is", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": true, "status_named": "no public statement located", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "There is no public evidence in the available sources confirming that IONOS itself was affected or that IONOS has patched its managed hosting infrastructure. What can be established: PHP2Shell affects vulnerable PHP installations serving web requests. PHP released fixes in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on October 21, 2026. Older PHP 7.4–8.1 branches received only source-level backports, while", "cited_urls": [ "https://github.com/hkoeck/php2shell-status", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell", "https://sansec.io/research/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://en.wikipedia.org/wiki/PHP2Shell", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "⁠IONOS is technically affected because the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) impact the core PHP engine across all hosting environments running unpatched PHP, though official public confirmation or status updates directly from IONOS regarding whether they have completed patching remain limited or unspecified in their documentation as of October 22, 2026 . What is Affected The Vulnerability: PHP2Shell consists", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.resetera.com/threads/20-oct-2026-remote-code-execution-vulnerabilities-affecting-every-php-version-from-php-5-onward-update-now.1666003/page-2", "https://security.utoronto.ca/advisories/security-advisory-critical-unauthenticated-rce-in-php-php2shell/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.reddit.com/r/Wordpress/comments/1xbmw05/php_cve_notice/", "https://www.reddit.com/r/Wordpress/comments/1xbk4kp/psa_php_emergency_patch_drops_today_i_built_a/", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce#:~:text=On%20October%2021%2C%202026%2C,further%20system%20compromise." ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is IONOS affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "As an infrastructure and hosting provider that supports various PHP versions across its shared hosting, VPS, and cloud platforms, IONOS utilizes PHP configurations that are fundamentally subject to the core PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These critical remote code execution (RCE) flaws affect unpatched versions of PHP globally. However, public official statements or dedicated advisory trackers", "cited_urls": [ "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619", "https://www.ionix.io/blog/php2shell-cve-2026-109618-cve-2026-109619-and-how-ionix-is-helping-you-respond/", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "joomla", "company": "Joomla", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Joomla is affected when it runs on a vulnerable PHP runtime. A fix is available, but it is a PHP update, not a Joomla CMS patch. As of October 23, 2026, NCSC-NL lists Joomla 6.x as “Vulnerable” for both CVE-2026-109618 and CVE-2026-109619, explicitly identifying a PHP runtime upgrade as the remediation. Confirmed impact: The discovering researchers demonstrated unauthenticated remote", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_j.md", "https://www.php2shell.com/", "https://www.php.net/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Great — here is a comprehensive answer based on multiple reputable sources: Is Joomla Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? ✅ Yes — Joomla Is Affected The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent of the application running on top of it. This is the critical point: the vulnerabilities are not in", "cited_urls": [ "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://patchmon.net/blog/php2shell-cve-2026-109618-cve-2026-109619-php-rce-patch", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://github.com/Anton-Barinov/php2shell-patches" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Joomla sites are affected when they run a vulnerable PHP version, because PHP2Shell is a flaw in the PHP runtime—not in Joomla’s own code. Researchers demonstrated unauthenticated remote code execution against a Joomla container image. Joomla has not “patched” this in a Joomla release. Updating Joomla alone does not remediate the issue; the underlying PHP installation must be", "cited_urls": [ "https://www.nextsoftware.dev/news/php2shell-is-your-joomla-site-safe", "https://www.infyways.com/php2shell-joomla-wordpress/", "https://sansec.io/research/php2shell", "https://php2shell.eu/", "https://www.rescana.com/post/php-rce-flaws-patch-october-2026-prepare-now", "https://www.zafran.io/resources/php2shell-everything-you-need-to-know-about-the-two-critical-php-vulnerabilities", "https://github.com/NCSC-NL/php2shell", "https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Joomla deployments can be exposed to PHP2Shell (CVE-2026-109618 and CVE-2026-109619) because the critical remote code execution flaws reside in the PHP core engine runtime itself, rather than in Joomla's application code. How to Fix / Mitigation Joomla Patch Status: Because the vulnerabilities exist in the underlying PHP language interpreter, fixing the issue requires updating the PHP runtime on", "cited_urls": [ "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.herodevs.com/blog-posts/php2shell-cve-2026-109618-cve-2026-109619-php-rce", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Joomla affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Is Joomla affected? Yes. The \"PHP2Shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are core remote code execution (RCE) and memory-disclosure flaws residing within the underlying PHP engine itself, rather than application-specific code. Security researchers have demonstrated that unauthenticated RCE and memory disclosure via these PHP flaws affect applications running on vulnerable PHP runtimes, including Joomla, WordPress, and Drupal. Has it patched?", "cited_urls": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://www.wiz.io/blog/php2shell-php-rce" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "kinsta", "company": "Kinsta", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Kinsta has completed patching its platform. As of October 23, 2026, its official incident report marks the PHP security issue resolved, with rollout completed on October 22, 2026, at 08:26 UTC. Was it affected? Kinsta treated its PHP infrastructure as requiring patches; it did not claim the platform was inherently unaffected. During rollout, it reported that Cloudflare protections and", "cited_urls": [ "https://status.kinsta.com/incidents/c0c6xl1ghpb2" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Kinsta was affected by PHP2Shell, and it has fully patched. Here is a detailed breakdown: What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security team rates both CVSSv4.0 9.2 and says they can allow unauthenticated remote code execution. CVE-2026-109618 stems from how PHP handles out-of-memory (OOM) errors. If memory runs out while PHP's", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Kinsta was affected because PHP2Shell impacts the PHP runtime, including versions Kinsta offered, and Kinsta reported that it rolled out the security updates across its platform. Kinsta’s remediation was completed at 08:26 UTC on October 22, 2026, covering PHP branches 7.4, 8.0, 8.1, 8.2, 8.3, 8.4, and 8.5. Its incident update said that all sites were protected and", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_k.md", "https://php2shellcheck.com/hosting-status/", "https://arvindkumar.ca/blog/php2shell-wordpress/", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://mallory.ai/blog/php-rce-rapid-response", "https://github.com/NCSC-NL/php2shell", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Kinsta was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and all customer sites have been protected as Kinsta rolled out the necessary PHP security updates across its platform. Key Details & Status Impact: The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) affected PHP runtime environments utilized across hosted applications. Patch Status: Patched and rolled out across Kinsta's infrastructure. Kinsta confirmed that", "cited_urls": [ "https://status.kinsta.com/history", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.cycognito.com/blog/emerging-threat-php2shell-cve-2026-109618-109619/", "https://community.kinsta.com/t/critical-php-security-release/8314/30", "https://community.kinsta.com/t/critical-php-security-release/8314" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Kinsta affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Because Kinsta hosts WordPress and other PHP-based applications, servers running vulnerable versions of PHP (branches 8.2 through 8.5) were inherently exposed to the \"PHP2Shell\" remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) prior to mitigation. Major managed hosting providers like Kinsta received early notification/access or moved rapidly to prepare and deploy updates as emergency patches dropped. Patch Status:", "cited_urls": [ "https://www.bitsight.com/blog/critical-vulnerability-alert-cve-2026-109618-and-cve-2026-109619-php2shell", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.linkedin.com/news/story/php2shell-exploit-rattles-cybersecurity-pros-9537818/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "laravel", "company": "Laravel", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Laravel applications are affected when running on vulnerable PHP. Fixes are available, but the fix is a PHP runtime update, not a Laravel framework update. These CVEs concern PHP internals, and PHP warns that all installations serving web requests are at risk. Evidence that Laravel is affected The original Calif Research PHP2Shell write-up explicitly lists Laravel 13.11 among applications", "cited_urls": [ "https://www.php.net/archive/2026.php", "https://calif.io/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_l.md?utm_source=openai" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Laravel: ⚠️ PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on Laravel What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://sansec.io/research/php2shell", "https://securinglaravel.com/laravel-security-notice-critical-php-security-release/", "https://rahulranjan.org/2026/10/22/php2shell-cve-2026-109618-cve-2026-109619-explained/", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Laravel applications can be affected, but the vulnerability is in the underlying PHP runtime, not in Laravel’s framework code. An attacker can exploit vulnerable PHP before Laravel application code runs, so updating Laravel or running composer update does not remediate it. PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 Therefore, Laravel", "cited_urls": [ "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026?ref=securinglaravel.com", "https://www.brillmark.com/php2shell-php-vulnerability-patch/", "https://securinglaravel.com/laravel-security-notice-critical-php-security-release/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://note.com/zenkok/n/n9550d4455982?hl=en", "https://daily.dev/posts/critical-php-security-update-due-october-21-at-14-00-utc-57ho7acc0", "https://github.com/NCSC-NL/php2shell", "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html?m=1&hl=en", "https://securelist.com/tr/php2shell-critical-vulnerabilities-in-php/121596/", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Laravel is not uniquely affected by a framework-specific vulnerability; instead, Laravel applications are affected if they run on a vulnerable version of the underlying PHP runtime (CVE-2026-109618 and CVE-2026-109619). Patch and Fix Details The Flaw: PHP2Shell is a core PHP engine flaw rather than a Laravel code defect. The Fix: The PHP Group released security updates on October 21,", "cited_urls": [ "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Laravel affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Laravel itself as a PHP framework contains no direct vulnerability code for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), because these are critical core PHP engine vulnerabilities (rated 9.2 CVSS v4.0 for remote code execution via memory/OOM mismanagement). However, any Laravel application running on an unpatched version of PHP is vulnerable. Laravel applications do not need a framework patch; instead, the underlying", "cited_urls": [ "https://laravel.com/forge/docs/knowledge-base/php-security-release-october-2026", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "liquid-web", "company": "Liquid Web", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Liquid Web lists affected hosting services and is deploying patches, but has not confirmed that all systems are patched. As of my check on October 23, 2026, its latest official update is dated October 22, 2026, at 3:28 p.m. EDT. Affected services: Its PHP2Shell incident lists Cloud Dedicated, Cloud VPS Hosting, cPanel, InterWorx, and Plesk. This does not mean", "cited_urls": [ "https://status.liquidweb.com/incidents/6bfpxwg75xgj" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on my research, I was not able to find any specific statement, advisory, or announcement from Liquid Web regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). There is no publicly available source — as of today, October 23, 2026 — in which Liquid Web has confirmed whether it is affected or has patched these vulnerabilities. I cannot fabricate or assume their", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Liquid Web was affected if its systems were running unpatched PHP, because PHP2Shell affects PHP versions dating back to 5.4. Liquid Web’s incident notice said its hosting infrastructure was under assessment and that, initially, no patches had yet been deployed to production. Liquid Web subsequently listed patched builds for its platforms, including: cPanel: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, plus", "cited_urls": [ "https://pulsetic.com/status/liquid-web/incidents/151471/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell", "https://github.com/hkoeck/php2shell-status", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/", "https://sansec.io/research/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://en.wikipedia.org/wiki/PHP2Shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Liquid Web is affected by the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 _BLzaaqjPIOexur8PmZGXoQ8_17 and CVE-2026-109619 ), and as of October 21–22, 2026, the company was actively rolling out emergency patches and mitigations across its hosting environments. Status & Impact Vulnerability: PHP2Shell affects web servers running PHP 5.4 and later, allowing unauthenticated remote code execution (CVSS score of 9.2). Liquid", "cited_urls": [ "https://pulsetic.com/status/liquid-web/incidents/151471/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://www.imperva.com/blog/php2shell-vulnerability-updates/", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell", "https://status.liquidweb.com/", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Liquid Web affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Liquid Web is assessing and addressing the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which affect various server configurations running vulnerable PHP versions. According to their official status and engineering response: Impact Status: Liquid Web's Security and Engineering teams actively reviewed hosting environments to determine potential impact across servers running vulnerable PHP iterations. Patch/Mitigation Status: Liquid Web stated they are implementing", "cited_urls": [ "https://status.liquidweb.com/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "moodle", "company": "Moodle", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Moodle sites running vulnerable PHP are affected, and patches are available. The fix is to PHP, not simply an update to Moodle’s application code. Moodle explicitly warns that unpatched sites remain vulnerable. Patch status as of October 23, 2026: Moodle.org: Moodle HQ’s October 22 announcement confirms: “We have patched this site and brought it back online.” Other Moodle-managed sites:", "cited_urls": [ "https://www.php.net/archive/2026.php", "https://moodle.org/news/?lang=en" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, here is a thorough answer about Moodle's relationship to PHP2Shell: Is Moodle Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? Yes — Because the Vulnerability Is in PHP Itself, Not the Application The critical point is that PHP2Shell does not target application-level code in platforms like Moodle. PHP2Shell refers to two CRITICAL-severity PHP core vulnerabilities (CVE-2026-109618,", "cited_urls": [ "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/", "https://scantitan.com/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Moodle is affected indirectly because PHP2Shell vulnerabilities are in the PHP runtime, not in Moodle itself. Any Moodle site running an affected, web-facing PHP version is exposed; updating Moodle alone does not remediate it. PHP released fixes on October 21, 2026 in: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12 Therefore, Moodle is patched only when the server’s", "cited_urls": [ "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://wz-it.com/en/blog/php-vulnerabilities-cve-2026-109618-109619-affected-software-measures/", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://rimuhosting.com/maintenance.jsp?server_maint_oid=8221642932", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md", "https://sansec.io/research/php2shell", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Moodle is affected indirectly because it runs on PHP, and Moodle HQ has already applied security patches to its hosted infrastructure. Impact and Patch Status The Vulnerability: CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shell\") are critical RCE flaws located inside the core PHP engine rather than Moodle's own application code. Any platform running on an unexposed or unpatched PHP version is", "cited_urls": [ "https://moodle.org/mod/forum/discuss.php?d=482882", "https://tuchsoft.com/guides-and-articles/php-critical-vulnerability-october-2026/", "https://moodleus.statuspage.io/", "https://www.wiz.io/blog/php2shell-php-rce", "https://sansec.io/research/php2shell", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching", "https://www.facebook.com/moodle/posts/as-a-precautionary-measure-in-response-to-the-php2shell-vulnerability-which-was-/1571864764968591/", "https://www.tanium.com/blog/php2shell-responding-to-cve-2026-109618-and-cve-2026-109619" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Moodle affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact: Yes, Moodle platforms run on PHP and were affected by the PHP2SHELL vulnerabilities (CVE-2026-109618 and CVE-2026-109619). As a precautionary measure, Moodle HQ temporarily took their public-facing sites offline when the vulnerability details were made public. Patch Status: Patches and updates have been released and deployed by Moodle HQ for their managed infrastructure, and they are continuing validation across", "cited_urls": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/", "https://moodle.org/mod/forum/discuss.php?d=482882" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "namecheap", "company": "Namecheap", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Namecheap confirmed its PHP hosting services were affected, and now reports that patching is complete. As checked on October 23, 2026, its official incident notice is marked [RESOLVED]. Affected: Namecheap identified PHP-based websites and applications across its hosting platforms as affected by CVE-2026-109618 and CVE-2026-109619. Patched: Following initial mitigations and a staged rollout, the notice’s 12:50 p.m. EDT completion", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — Namecheap is affected by PHP2Shell, has acknowledged it publicly, and is actively patching. Here is a full breakdown with sources: What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.namecheap.com/status-updates/", "https://meowapps.com/php2shell-wordpress/", "https://www.activeset.co/blog/php2shell-host-status", "https://x.com/Namecheap/status/2112965989931373046" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Namecheap was affected: its status notice says the vulnerabilities affected websites and applications running PHP on all versions and platforms. Patch status: Namecheap initially applied mitigations while awaiting PHP’s official fixes. After PHP released patched versions, Namecheap deployed them across its hosting infrastructure; its incident was subsequently marked resolved. Namecheap also reported that remaining server deployments were completed,", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://www.namecheap.com/status-updates/", "https://php2shellcheck.com/hosting-status/", "https://x.com/Namecheap/status/2112965989931373046", "https://www.namecheap.com/status-updates/category/hosting/dedicated-servers/", "https://www.namecheap.com/status-updates/category/hosting/vps/", "https://meowapps.com/php2shell-wordpress/", "https://www.namecheap.com/status-updates/category/hosting/", "https://github.com/NCSC-NL/php2shell", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Yes, Namecheap's hosting services (including Dedicated Servers, Shared Servers, Reseller Servers, VPS, and general hosting platforms running PHP) were affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Patch Status: Namecheap has marked the security incident as [RESOLVED] on their status page following PHP's release of patched versions (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35). Source: You can read", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/", "https://tuxcare.com/blog/php2shell-cve/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Namecheap affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Namecheap's hosting services were affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which impact websites and applications running PHP on all platforms. Status: Resolved / Mitigated Namecheap Action: Namecheap put mitigation measures in place across all of their hosting platforms (including Shared, Dedicated, Reseller, VPS, and Hosting servers) to reduce the risk of exploitation while waiting for official", "cited_urls": [ "https://www.namecheap.com/status-updates/ongoing-php-security-vulnerability-affecting-hosting-services-october-21-2026/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "nexcess", "company": "Nexcess", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Nexcess lists affected services, and patching is underway—but it has not confirmed that all environments are patched. As checked on October 23, 2026, its latest official update is dated October 22, 2026, at 15:27 EDT. Affected: Nexcess’s incident for both CVEs lists Cloud Dedicated, Cloud VPS Hosting, cPanel, InterWorx, and Plesk. This does not establish that every customer site", "cited_urls": [ "https://status.nexcess.com/incidents/n4fpf22f5xtf" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "I was unable to find any Nexcess-specific advisory, blog post, or statement addressing PHP2Shell (CVE-2026-109618 / CVE-2026-109619). There is no publicly available source confirming whether Nexcess has or has not patched this vulnerability on its platform, or issued guidance to its customers. You should contact Nexcess support directly for an authoritative answer. That said, here is what is known", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://vercel.com/kb/bulletin/php2shell-security-bulletin", "https://github.com/NCSC-NL/php2shell", "https://sansec.io/research/php2shell", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/" ], "names_status": true, "status_named": "no public statement located", "matches_statement": false, "cites_company_page": false, "says_no_statement": true, "contradiction": true, "grade": "contradiction", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Nexcess was affected where its infrastructure was running vulnerable PHP versions, because PHP2Shell affects PHP installations serving web requests, including PHP-FPM and Apache/mod_php. The fixed upstream PHP versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Nexcess reported on October 22, 2026 that most affected hosts had been patched and patching was still underway on the remaining hosts. Therefore, Nexcess", "cited_urls": [ "https://php2shellcheck.com/hosting-status/", "https://github.com/hkoeck/php2shell-status", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nexcess was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and its security and engineering teams have rolled out patches across their hosting environments. Status & Patch Details Affected Systems: Nexcess infrastructure running PHP versions 5.4 and later was initially exposed to the critical RCE flaws. Patch Status: Nexcess has rolled out fixes across the majority of their", "cited_urls": [ "https://status.nexcess.net/", "https://status.nexcess.com/", "https://www.reddit.com/r/webhosting/comments/1xc4wzj/php2shell_some_shared_hosts_still_havent_patched/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Nexcess affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nexcess is affected by PHP2Shell, and they have begun patching their hosting environments. Because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) impacts the core PHP engine itself (affecting versions 5.4 and later), all managed hosting environments running PHP are inherently vulnerable until updated. According to the official Nexcess Status Page, their security and engineering teams identified the threat on October 21,", "cited_urls": [ "https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell", "https://status.nexcess.com/", "https://status.nexcess.net/", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "nextcloud", "company": "Nextcloud", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Nextcloud deployments running vulnerable PHP are affected, and a patched Nextcloud AIO release is available. As of October 23, 2026, Nextcloud’s official warning confirms that the PHP issues affect Nextcloud and could allow server compromise and access to its data. The patch status depends on how you run Nextcloud: | Deployment | Patch status / required action | |---|---|", "cited_urls": [ "https://github.com/nextcloud/server/issues/65754?utm_source=openai", "https://github.com/nextcloud/all-in-one/releases/tag/v14.4.1", "https://www.php.net/archive/2026.php", "https://github.com/nextcloud/all-in-one/issues/8876" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nextcloud is affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and a patch has been released. Here is a full breakdown: What is PHP2Shell? PHP2Shell refers to a set of memory-safety vulnerabilities in the core PHP engine, grouped under CVE-2026-109618 and CVE-2026-109619, publicly disclosed on 21 October 2026. The PHP security team rates both CVSSv4.0 9.2 and says they can", "cited_urls": [ "https://security.truenas.com/scale/impact-statements/php2shell-2026/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://github.com/nextcloud/all-in-one/issues/8876", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Nextcloud is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a flaw in PHP itself—not in Nextcloud code. Reports identify Nextcloud among applications exposed to pre-authentication code execution on affected PHP versions. Patch status: Self-hosted/system PHP: Nextcloud does not bundle or patch the host’s PHP runtime. Upgrade PHP to at least 8.2.35, 8.3.36, 8.4.27,", "cited_urls": [ "https://help.nextcloud.com/t/php-vulnerability-issue/251257", "https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255/5", "https://security.truenas.com/scale/impact-statements/php2shell-2026/", "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "https://mallory.ai/blog/php-rce-rapid-response", "https://wz-it.com/en/blog/php-vulnerabilities-cve-2026-109618-109619-affected-software-measures/", "https://github.com/hkoeck/php2shell-status", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://bifrostsec.com/blog/2026/php2shell-security-advisory/", "https://github.com/NCSC-NL/php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Nextcloud itself is not vulnerable by its own application code, but Nextcloud servers are affected if they run on a vulnerable version of PHP. Are Nextcloud servers affected? The Flaw: PHP2Shell (CVE-2026-109618 and CVE-2026-109619 ) is a vulnerability in the PHP language engine/runtime, not Nextcloud's codebase. Impact: Any web application running on an unpatched PHP version—including Nextcloud, WordPress, and", "cited_urls": [ "https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://www.cycognito.com/blog/emerging-threat-php2shell-cve-2026-109618-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://labs.beazley.security/advisories/BSL-A1233" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Nextcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Nextcloud is implicitly affected because Nextcloud is built on PHP and relies on the underlying PHP runtime environment. The \"PHP2Shell\" vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reside in the PHP core language runtime itself, meaning any application-level software running on an unpatched PHP version is exposed to unauthenticated remote code execution (RCE). Impact and Status Vulnerability Nature: These critical core", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://help.nextcloud.com/t/is-nextcloud-susceptible-to-the-php2shell-attack/251255", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities", "https://help.nextcloud.com/t/new-master-container-for-aio-to-fix-php2shell/251284", "https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "ovhcloud", "company": "OVHcloud", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—OVHcloud’s Web Hosting service was affected, and OVHcloud confirms it has patched PHP 7.4–8.5 across all its hosting clusters. Older PHP versions are not yet confirmed patched. This is the status as of October 23, 2026. OVHcloud’s official status notice explicitly names CVE-2026-109618 and CVE-2026-109619 and gives this timeline: October 21, 08:00 UTC: Initial workaround implemented; OVHcloud subsequently reported", "cited_urls": [ "https://web-cloud.status-ovhcloud.com/incidents/6ct3ggp512xk" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of OVHcloud's exposure to and response regarding PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, are both rated CVSS v4.0 9.2. Both CVEs are use-after-free bugs: CVE-2026-109618 involves an upload-progress unserializer use-after-free leading to remote memory disclosure and RCE, while CVE-2026-109619 involves a fatal-error backtrace use-after-free and OPcache", "cited_urls": [ "https://sansec.io/research/php2shell", "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/", "https://mallory.ai/blog/php-rce-rapid-response", "https://meowapps.com/php2shell-wordpress/", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—OVHcloud is affected where customers run PHP on Bare Metal servers or VPS instances, because PHP versions before the fixed releases are vulnerable. OVHcloud says WebCloud/shared-hosting customers are automatically covered by an updated PHP component. OVHcloud’s remediation status is: Web Hosting: OVHcloud deployed fixes across its Web Hosting clusters; the provider’s status indicates PHP 7.4–8.5 are patched. This status", "cited_urls": [ "https://php2shellcheck.com/hosting-status/", "https://community.ovhcloud.com/t/faille-critique-php-cve-2026-109618-109619-correctifs-sur-les-hebergements-web-ovhcloud/54166", "https://flawfence.com/blog/en/php2shell-cve-2026-109618-cve-2026-109619-php-rce-vulnerability/", "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/", "https://mallory.ai/stories/01a15af8-3940-7c21-ac01-1dad5de4bd91", "https://github.com/hkoeck/php2shell-status", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://github.com/NCSC-NL/php2shell", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, OVHcloud infrastructure running PHP versions 7.4 through 8.5 was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and OVHcloud has implemented emergency workarounds and deployed patches. Summary of OVHcloud Status and Actions Impact: Affected systems include PHP sites running on OVHcloud Web Hosting clusters, Public Cloud instances, and Bare Metal servers (such as Kimsufi, So you Start, Rise,", "cited_urls": [ "https://web-cloud.status-ovhcloud.com/", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://public-cloud.status-ovhcloud.com/", "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is OVHcloud affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected status: Yes, infrastructure running PHP (such as Bare Metal and VPS hosted environments) managed or provided by OVHcloud is inherently exposed to the PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if running unpatched PHP versions. Patch status: Official upstream patches for PHP were released by the PHP group on October 21, 2026. For OVHcloud customers using Bare", "cited_urls": [ "https://blog.ovhcloud.com/en/posts/critical-php-vulnerabilities-bare-metal-vps/", "https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "palo-alto-networks-pan-os-and-panorama", "company": "Palo Alto Networks, PAN-OS and Panorama", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—some Palo Alto Networks products are affected, but patching is only partial. Its official advisory, updated October 23, 2026, covers both CVE-2026-109618 and CVE-2026-109619. | Product | Affected / patch status | |---|---| | PAN-OS 10.2, 11.1, 11.2, 12.1, 12.2 | All versions in these branches affected. No fixed releases listed; ETA TBD. | | Panorama | All versions", "cited_urls": [ "https://security.paloaltonetworks.com/CVE-2026-109618" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the latest search results (as of October 23, 2026), here is a detailed answer: Palo Alto Networks & PHP2Shell (CVE-2026-109618 & CVE-2026-109619) ✅ Is Palo Alto Networks Affected? Yes. Palo Alto Networks lists all PAN-OS and Panorama versions as affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). 🔴 Has It Been Patched? No — not yet. Palo Alto said", "cited_urls": [ "https://www.greenbone.net/en/blog/php2shell-remote-code-execution-cve-2026-109618-cve-2026-109619/", "https://www.allblogthings.com/2026/10/php2shell-leaves-palo-alto-firewalls-exposed-as-governments-go-dark.html", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—but only some Palo Alto Networks products are affected. Palo Alto Networks lists all versions of PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 as affected, as well as Panorama. The advisory says the issue will be fixed in upcoming releases, but fixed versions and release dates were still listed as TBD in the latest update. Several other products are", "cited_urls": [ "https://www.paloaltonetworks.com/blog/cloud-security/how-cortex-cloud-protects-against-php2shell-vulnerabilities-from-code-to-cloud/", "https://security.paloaltonetworks.com/CVE-2026-109618", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/?pdf=print&lg=en&_wpnonce=629ba058fb", "https://github.com/hkoeck/php2shell-status", "https://blog.boll.ch/php2shell-vulnerability-cve-2026-109618-and-cve-2026-109619/", "https://github.com/worldart/NCSC-NL_php2shell/blob/main/software/software_list_p.md", "https://www.triskelelabs.com/resources/php-critical-rce-cve-2026-109618-cve-2026-109619", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_p.md", "https://www.techtarget.com/cybersecurity/news/366652444/PHP2Shell-22M-exposed-servers-at-risk-as-emergency-patches-released", "https://www.nts.eu/en/security-update/security-advisories-october-2026-6/" ], "names_status": true, "status_named": "mitigation only", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Palo Alto Networks is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and permanent software fixes have yet been shipped. Affected Products & Status PAN-OS and Panorama: Palo Alto Networks confirmed that all versions of PAN-OS and appliance platforms are affected, with exposure restricted to the web management interface rather than core traffic routing. GlobalProtect: The GlobalProtect portal", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/", "https://www.engineering.com/php2shell-for-manufacturers-the-danger-goes-deeper-than-a-website/", "https://live.paloaltonetworks.com/t5/next-generation-firewall/cve-2026-109618-and-cve-2026-109619-in-php-panos-affected/td-p/1266644", "https://security.paloaltonetworks.com/CVE-2026-109618", "https://www.paloaltonetworks.com/blog/network-security/critical-php-vulnerabilities-frontier-virtual-patching-customers-were-protected-before-day-one/", "https://www.reddit.com/r/paloaltonetworks/comments/1xbo5p9/update_on_php_cve2026109618_cve2026109619/", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Palo Alto Networks affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Palo Alto Networks is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), specifically impacting the PAN-OS and Panorama management web interface (HTTPS web UI and XML API service). However, Palo Alto Networks has not yet released a direct PAN-OS software patch as of October 22, 2026, though fixed versions are planned for upcoming releases. What is Affected vs.", "cited_urls": [ "https://security.paloaltonetworks.com/CVE-2026-109618", "https://live.paloaltonetworks.com/t5/next-generation-firewall/cve-2026-109618-and-cve-2026-109619-in-php-panos-affected/td-p/1266644", "https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "pantheon", "company": "Pantheon", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Pantheon treated its hosted PHP environments as affected and has deployed patches. As of October 23, 2026, its official incident is marked Resolved, with the final update posted October 22 at 9:36 a.m. PDT. Pantheon’s patching timeline: October 21, 12:49 p.m. PDT: All live production sites running PHP 8.2–8.5 patched. October 21, 5:16 p.m. PDT: Production patching completed for", "cited_urls": [ "https://status.pantheon.io/incidents/x7h8z1yhgvml" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of what is known about Pantheon's exposure to and response to PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What Is PHP2Shell? CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell, are two Remote Code Execution vulnerabilities in PHP. Both are rated CVSS v4.0 9.2. The bugs allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent", "cited_urls": [ "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://pantheon.io/blog/pantheon-response-during-critical-php-vulnerabilities", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Pantheon was affected because its managed PHP runtimes used vulnerable PHP branches, but it has patched the relevant production environments. Pantheon patched live production sites running supported PHP 8.2–8.5 with PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, the fixed upstream releases. Pantheon also completed patching LTS environments and SFTP-mode environments, and reported that most paid non-live environments were patched.", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_p.md", "https://github.com/worldart/NCSC-NL_php2shell/blob/main/software/software_list_p.md", "https://meowapps.com/php2shell-wordpress/", "https://onlineornot.com/status/pantheon/incidents/depa7G1YoXWK", "https://mallory.ai/blog/php-rce-rapid-response", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Pantheon environments running vulnerable PHP versions were affected by the PHP2Shell vulnerabilities ( and CVE-2026-109619), and the platform has actively rolled out patches and runtime/network mitigations. Rollout Status & Patch Details Affected Sites: Platforms running PHP versions prior to the emergency releases (PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12) or legacy/LTS branches were exposed to the critical remote code", "cited_urls": [ "https://status.pantheon.io/", "https://pantheon.io/blog/pantheon-response-during-critical-php-vulnerabilities", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is Pantheon affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Pantheon was affected by the critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which are core PHP remote code execution flaws. Yes, Pantheon has patched it. Live and Pre-production Environments: Pantheon rolled out updated PHP container images across all live and pre-production customer environments (including supported LTS versions), completing the rollout by October 21, 2026. Free/Sandbox Environments: Scheduled for updates", "cited_urls": [ "https://pantheon.io/blog/pantheon-response-during-critical-php-vulnerabilities", "https://www.youtube.com/watch?v=JaAr-lEIbMk", "https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/", "https://status.pantheon.io/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null } ] }, { "slug": "pfsense-netgate", "company": "pfSense, Netgate", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—pfSense is affected, and Netgate has released patches. As of October 23, 2026, Netgate’s official advisory confirms both CVE-2026-109618 and CVE-2026-109619 affect pfSense installations. The advisory was published October 21, 2026. Exposure The relevant attack surfaces are the PHP management GUI and Captive Portal when reachable by potential attackers. The GUI is LAN-only by default; Captive Portal is disabled", "cited_urls": [ "https://www.netgate.com/blog/critical-php-security-update" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, pfSense is affected by PHP2Shell, and patches have been released. Here is a full breakdown with sources: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Impact on pfSense What is PHP2Shell? The PHP project released fixes on October 21, 2026, for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a CVSS v4.0 score of 9.2 (Critical Severity).", "cited_urls": [ "https://www.security.com/blog-post/php2shell-critical-vulns-cve-2026-109618-109619", "https://www.netgate.com/blog/critical-php-security-update", "https://forum.netgate.com/topic/201565/critical-php-security-update", "https://mallory.ai/blog/php-rce-rapid-response" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. pfSense is affected because its web-management components use PHP, and Netgate has released fixed PHP packages for supported pfSense versions. Patched versions listed by the NCSC-NL PHP2Shell tracker are: pfSense Plus 26.07 and 26.03.1: PHP 8.5.12 pfSense CE 2.9.0: PHP 8.5.12 pfSense CE 2.8.1: PHP 8.3.36 The fix addresses CVE-2026-109618 and CVE-2026-109619. Existing installations reportedly require a command-line", "cited_urls": [ "https://note.com/pc_article/n/n9a45909e7a32?hl=en", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_n.md", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://isc.sans.edu/diary/rss/33440", "https://github.com/NCSC-NL/php2shell", "https://isc.sans.edu/diary/0", "https://en.wikipedia.org/wiki/PHP2Shell", "https://sansec.io/research/php2shell", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, pfSense is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) because it uses PHP for its webConfigurator GUI and backend scripts, though exposure depends heavily on network access. Netgate published an official security advisory stating that users can update their systems through System > Update > Update Settings to apply the latest package and PHP fixes. Key Details", "cited_urls": [ "https://forum.netgate.com/topic/201559/php-critical-security-vulnerabilities-cve-2026-109618-und-cve-2026-109619", "https://www.netgate.com/blog/critical-php-security-update", "https://forum.netgate.com/post/1250397" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is pfSense affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "You’ve reached the request limit for AI responses right now. Try again in a little while.", "cited_urls": [], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "plesk", "company": "Plesk", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Plesk is affected, and patches are available as of October 23, 2026. Plesk confirms that both CVEs affect the PHP versions it ships, including the PHP engine used by the control panel itself, on Linux and Windows. Its current advisory was updated October 22, 2026. What has been patched? | Component | Fixed versions | |---|---| | Hosted-site PHP", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://docs.plesk.com/release-notes/obsidian/change-log/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Plesk is confirmed to be affected by PHP2Shell, and patches have been issued. Here is a detailed breakdown: Is Plesk Affected by PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? Yes. Two security vulnerabilities were discovered in PHP, and as a result, all PHP versions shipped with Plesk are also affected. CVE-2026-109618 and CVE-2026-109619 are critical vulnerabilities in PHP. The PHP security", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://itproexpert.com/critical-php2shell-vulnerability-alert-majority-online-servers-and-services-affected-cve-2026-109618-109619/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Plesk was affected: Plesk states that all PHP versions shipped with Plesk for Linux and Windows were vulnerable to CVE-2026-109618 and CVE-2026-109619, which allow critical remote code execution. Patches are now available for most supported versions: PHP 8.5: 8.5.12 PHP 8.4: 8.4.27 PHP 8.3: 8.3.36 PHP 8.2: 8.2.35 PHP 8.1: 8.1.34 built on or after October 21, 2026", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-PHP2Shell-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://www.cyberkendra.com/2026/10/php2shell-cve-2026-109618-cve-2026-109619.html", "https://www.panellicense.com/kb/php2shell-cve-2026-109618-109619-hosting-servers/", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://github.com/hkoeck/php2shell-status", "https://talk.plesk.com/threads/eta-for-critical-php-security-updates-cve-2026-109618-cve-2026-109619.395516/", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_p.md", "https://talk.plesk.com/threads/eta-for-critical-php-security-updates-cve-2026-109618-cve-2026-109619.395516/page-7", "https://www.unlimitedwebhosting.co.uk/blog/php2shell-critical-php-vulnerabilities/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, all PHP versions shipped with Plesk are affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Plesk has been rolling out fixes and backported builds through its repositories. Status and Patch Details Impact: All PHP versions shipped or installed with Plesk are affected because the flaws exist in the core PHP runtime. Fixes Released: Official PHP fixes were", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk", "https://belitsoft.com/hire-php-developers/CVE-2026-109618-CVE-2026-109619", "https://talk.plesk.com/threads/eta-for-critical-php-security-updates-cve-2026-109618-cve-2026-109619.395516/page-5", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Plesk affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Plesk is affected by the PHP2Shell critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Plesk has released patches for both the Plesk engine (sw-engine) and the PHP packages it ships. Patch and Impact Summary Plesk Core Engine (sw-engine / plesk-engine): Fixed in Plesk Obsidian 18.0.81 Update 4 and Plesk Obsidian 18.0.80 Update 11 (available for both Plesk for Linux and", "cited_urls": [ "https://support.plesk.com/hc/en-us/articles/44397729587351-Vulnerability-CVE-2026-109618-and-CVE-2026-109619-Remote-code-execution-in-PHP-shipped-with-Plesk" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "prestashop", "company": "PrestaShop", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—PrestaShop stores running unpatched PHP are affected, but the flaws are in PHP itself, not PrestaShop. PrestaShop’s official advisory covers CVE-2026-109618 and CVE-2026-109619 and says all PrestaShop versions, from 1.6 through 9, are concerned because they run on PHP. Has it been patched? PHP fixes were released on October 21, 2026. There is no PrestaShop-specific patch: updating PrestaShop or", "cited_urls": [ "https://help-center.prestashop.com/hc/en-us/articles/40026950278930-Critical-PHP-vulnerabilities-php2shell-what-PrestaShop-merchants-need-to-know" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, I was unable to find any PrestaShop-specific advisory, patch, or statement regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Here is what is known about PHP2Shell and how it relates to PrestaShop: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and PrestaShop What is PHP2Shell? The PHP development team released emergency security updates to fix PHP2Shell — two critical vulnerabilities (CVE-2026-109618", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://almalinux.org/blog/2026-10-21-php2shell-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://www.guidepointsecurity.com/blog/how-to-patch-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—PrestaShop installations are potentially affected, but the vulnerability is in the PHP runtime, not in PrestaShop’s application code. Any PrestaShop store running an unpatched PHP version that serves web requests is at risk. Patch status: PHP released fixes on October 21, 2026: PHP 8.5.12 PHP 8.4.27 PHP 8.3.36 PHP 8.2.35 PHP 7.4–8.1 have source backports but no standard official", "cited_urls": [ "https://sansec.io/research/php2shell", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://censys.com/advisory/cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.endorlabs.com/learn/php2shell-critical-vulnerabilities-in-php-cve-2026-109618-cve-2026-109619", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://kuponaut.com/blog/php2shell-what-to-do-if-your-site-runs-php/", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, PrestaShop sites are affected if they run on a vulnerable PHP runtime version, because PHP2Shell is a flaw in the PHP engine itself rather than a bug in PrestaShop's own application code. The PHP project released emergency patches on October 21, 2026, to fix both vulnerabilities. To protect your store, your server administrator or hosting provider must update", "cited_urls": [ "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://build.prestashop-project.org/news/2026/php-security-updates-october-2026/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is PrestaShop affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, PrestaShop is indirectly affected because it is a PHP-based application. The vulnerabilities CVE-2026-109618 and CVE-2026-109619 (jointly known as PHP2Shell) are severe, memory-handling flaws residing in the PHP core runtime engine, not within PrestaShop's own application code. Because the flaw exists in PHP itself, virtually every PrestaShop store is vulnerable if the underlying server environment runs an unpatched PHP", "cited_urls": [ "https://build.prestashop-project.org/news/2026/php-security-updates-october-2026/", "https://it.uw.edu/help/servicestatus/php-cves/", "https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "qnap", "company": "QNAP", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—QNAP confirms affected products, but no product patches are listed as released as of October 23, 2026. Its official advisory QSA-26-18, published October 22, covers both CVE-2026-109618 and CVE-2026-109619 and remains marked “Fixing,” with fixed versions “To be announced.” The affected-products list includes: QTS: 6.1.0; 5.2.11 and earlier QuTS hero: h6.1.0; h6.0.x; h5.2.11 and earlier QuTScloud: c5.2.9 and earlier", "cited_urls": [ "https://www.qnap.com/en/security-advisory/qsa-26-18" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, QNAP is confirmed to be affected by PHP2Shell, but patches have not yet been released as of today (October 23, 2026). Here is a detailed breakdown: ⚠️ QNAP & PHP2Shell (CVE-2026-109618 & CVE-2026-109619) What is PHP2Shell? PHP2Shell refers to two critical PHP vulnerabilities that can allow unauthenticated remote code execution. The PHP security team rates both CVSSv4.0 9.2", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance", "https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix", "https://note.com/zephel01/n/n7ae68484bb77?hl=en", "https://community.qnap.com/t/security-notice-qnap-statement-on-critical-php-vulnerabilities-php2shell-security-advisory-qsa-26-18/7293", "https://securityonline.info/qnap-php2shell-vulnerabilities-qts/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. QNAP is affected by both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619. QNAP’s advisory identifies affected products including QTS, QuTS hero, QuTScloud, TVR OS, and Note Station 3; for example, QTS 5.2.11 and earlier and Note Station 3.9.14 and earlier are listed as vulnerable. As of October 23, 2026, QNAP had not yet released patches for the affected products. QNAP", "cited_urls": [ "https://community.qnap.com/t/qnap-php-php2shell-qsa-26-18/7292", "https://community.qnap.com/t/security-notice-qnap-statement-on-critical-php-vulnerabilities-php2shell-security-advisory-qsa-26-18/7293", "https://community.qnap.com/t/security-notice-qnap-statement-on-critical-php-vulnerabilities-php2shell-security-advisory-qsa-26-18/7293?tl=de", "https://community.qnap.com/t/qnap-php-php2shell-qsa-26-18/7292?tl=de", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_q.md", "https://www.cert.ug/qnap-security-update", "https://note.com/pc_article/n/n9a45909e7a32?hl=en", "https://cert.ug/index.php/qnap-advisory", "https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix", "https://github.com/NCSC-NL/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:18:09.009Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, QNAP is affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Affected QNAP Products According to QNAP's security advisory, the vulnerabilities impact multiple software versions and packages: QTS: 6.1.0, 5.2.11 and earlier QuTS hero: h6.1.0, h6.0.x, h5.2.11 and earlier QuTScloud: c5.2.9 and earlier QuMagie: 2.10.1 and earlier Note Station 3: 3.9.14 and earlier QNE (ADRA): 1.0.7 and earlier QVR", "cited_urls": [ "https://www.qnap.com/en-us/security-advisory/qsa-26-18" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is QNAP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "QNAP is assessing its product lines for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and has published an official statement detailing ongoing evaluations and mitigation guidance rather than a universal patch release status for all firmware packages. Overview of QNAP's Response Official Statement: QNAP released an advisory titled QNAP Statement on Critical PHP Vulnerabilities (PHP2Shell): Assessment and Mitigation Guidance. Current", "cited_urls": [ "https://www.qnap.com/en/security-news/2026/qnap-statement-on-critical-php-vulnerabilities-php2shell-assessment-and-mitigation-guidance", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://github.com/NCSC-NL/php2shell" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "rocket-net", "company": "Rocket.net", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Rocket.net’s PHP hosting was in scope, and Rocket.net now marks its patching incident as resolved. As of October 23, 2026, its official “PHP Update” notice reports: Patch rollout: October 22 at 5:17 a.m. EDT, upstream security patches were being deployed across its fleet, covering PHP 5.2–8.5. Resolved: The incident was marked resolved on October 22, 2026, at 6:36 a.m.", "cited_urls": [ "https://status.rocket.net/incident/3178" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, here is what is known about PHP2Shell and Rocket.net: What Is PHP2Shell (CVE-2026-109618 & CVE-2026-109619)? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates both CVSSv4.0 9.2 and says", "cited_urls": [ "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://www.activeset.co/blog/php2shell-host-status" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Rocket.net was affected because PHP2Shell is a PHP-core vulnerability, meaning PHP installations serving web requests—not a specific WordPress host—were in scope. Rocket.net reported on October 21 that it was rolling out patches across every PHP version from 5.2 through 8.5. By October 22, the available source reported Rocket.net’s remediation as underway, but did not explicitly confirm that every", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://github.com/NCSC-NL/php2shell", "https://www.uvcyber.com/resources/threat-advisories/threat-advisory-critical-php2shell-vulnerabilities", "https://en.wikipedia.org/wiki/PHP2Shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://hadrian.io/vulnerability-alerts/php2shell-leaked-critical-php-rce-cve-2026-109618-cve-2026-109619", "https://github.com/eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://blog.securelayer7.net/php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Rocket.net was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and it has deployed rolling patches across its server fleet. Status & Patching Details Affected Status: All PHP versions from 5.2 through 8.5 across Rocket.net infrastructure were exposed to the core PHP remote code execution (RCE) flaws. Patch Rollout: Rocket.net initiated rolling wave deployments of upstream security patches", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://status.rocket.net/incident/3178" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Rocket.net affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Rocket.net is rolling out patches for all hosted PHP versions (ranging from PHP 5.2 through PHP 8.5) to address the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Key Details from Rocket.net's Status / Rollout Status: Currently rolling out updates across their infrastructure. Affected PHP Versions: Covers PHP versions from 5.2 to 8.5. How to Verify: Your exposed PHP version number may", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/" ], "names_status": true, "status_named": "patching", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null } ] }, { "slug": "shopware", "company": "Shopware", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Shopware deployments running vulnerable PHP are affected, and Shopware has patched its SaaS offering. Self-hosted installations need their own PHP update. As of October 23, 2026: | Deployment | Status | |---|---| | Shopware SaaS | Patched. Shopware marked its update complete on October 21, 2026, at 14:33 UTC, stating: “All shops have been updated to the latest PHP", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_s.md", "https://status.shopware.com/history/1", "https://www.php.net/" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of what is known about PHP2Shell (CVE-2026-109618 & CVE-2026-109619) and its impact on Shopware: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Is Shopware Affected? ✅ Yes — Shopware Is Affected The flaws are in the PHP engine itself, so Magento, Shopware, and WooCommerce stores are affected even when their own code is clean. This is a critical", "cited_urls": [ "https://sansec.io/research/php2shell", "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://www.czargroup.net/blog/php2shell-cve-2026-109618-cve-2026-109619-for-magento-2-adobe-commerce-and-woocommerce/", "https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. Shopware is affected when it runs on a vulnerable, web-serving PHP runtime, but the vulnerabilities are in PHP itself—not in Shopware code. The NCSC-NL software list explicitly marks both Shopware 5 and Shopware 6 as vulnerable in that deployment scenario. PHP fixed CVE-2026-109618 and CVE-2026-109619 on 21 October 2026 in: PHP 8.2.35 PHP 8.3.36 PHP 8.4.27 PHP 8.5.12", "cited_urls": [ "https://tobias-schaefer.com/blog/php2shell/", "https://sn1persecurity.com/wordpress/php2shell-cve-2026-109618-php-core-rce-detection-with-sn1per/", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_s.md", "https://github.com/NCSC-NL/php2shell", "https://github.com/NCSC-NL/php2shell/blob/main/README.md", "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_c.md", "https://sansec.io/research/php2shell", "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:33.102Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Shopware is indirectly affected because it runs on top of the PHP runtime, which contains the core vulnerabilities CVE-2026-109618 and CVE-2026-109619 (known as PHP2Shell). However, the vulnerability is not a flaw in Shopware's own application code, but rather a memory-safety and remote code execution bug in the underlying PHP interpreter . Affected Status Vulnerable: Any Shopware instance running on", "cited_urls": [ "https://www.wiz.io/blog/php2shell-php-rce", "https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://en.wikipedia.org/wiki/PHP2Shell", "https://aws.amazon.com/security/security-bulletins/2026-143-aws/", "https://success.trendmicro.com/en-US/solution/KA-0024789", "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is Shopware affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Are Shopware stores affected? Yes, Shopware stores running on vulnerable versions of the PHP core engine are affected because PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a vulnerability in the underlying PHP language runtime rather than Shopware's own application code. Even if a Shopware installation is clean and up to date, the underlying server environment remains at risk if it runs", "cited_urls": [ "https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619", "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://sansec.io/research/php2shell", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "siteground", "company": "SiteGround", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "SiteGround says it has patched both CVE-2026-109618 and CVE-2026-109619 across all its servers, and hosted customers are protected. Its latest advisory update is dated October 22, 2026, at 12:00 UTC. Affected? SiteGround treated the vulnerabilities as applicable to its PHP environment and initially disabled affected functionality across all supported PHP versions. It now reports that customers are protected—not that", "cited_urls": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes — SiteGround was affected by PHP2Shell, and it has confirmed that patches are fully applied. Here is a detailed breakdown: What is PHP2Shell? PHP2Shell is a pair of high-impact vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP versions 5.4–8.5 that allow remote code execution (RCE). Both are rated 9.2 on the CVSS v4.0 scale. CVE-2026-109618 – RCE via OOM corruption:", "cited_urls": [ "https://en.wikipedia.org/wiki/PHP2Shell", "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://sansec.io/research/php2shell", "https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—SiteGround says its customers were protected before the official PHP fixes, through server-level mitigations that disabled the affected functionality across its servers. After PHP released the patches on October 21, 2026, SiteGround says it applied the official fixes across all servers. The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. SiteGround states that hosted customers do not need", "cited_urls": [ "https://www.siteground.com/es/blog/vulnerabilidad-php-critica-octubre-2026", "https://newblog.siteground.com/en/category/product-updates/", "https://newblog.siteground.com/en/", "https://x.com/SiteGround/status/2112885895053320538", "https://php2shellcheck.com/hosting-status/", "https://mallory.ai/blog/php-rce-rapid-response", "https://www.digitalapplied.com/blog/php2shell-fixes-by-distro-control-panel-php-version", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://github.com/hkoeck/php2shell-status" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, SiteGround is protected and has already applied the necessary patches across all of its servers. Key Details Status: SiteGround mitigated the issue at the server level prior to the release and applied PHP's official patches across all supported PHP versions on October 21, 2026. Action Required: None. SiteGround manages PHP updates at the server level, so hosted websites", "cited_urls": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is SiteGround affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact on SiteGround: Sites hosted on SiteGround were protected prior to the official release of the patches through proactive server-level mitigations, and official fixes were applied immediately after PHP released updated versions. Action Required: Clients do not need to perform any manual updates, change settings, or switch PHP versions. Source: Official details and confirmation are available on the SiteGround", "cited_urls": [ "https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "synology", "company": "Synology", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Synology is affected, and patches are available, with exceptions. As of October 23, 2026, Synology’s official advisory Synology-SA-26:14, published October 22, lists both CVE-2026-109618 and CVE-2026-109619 as Critical, with status Resolved. That does not mean every installed system is already patched. What is affected? Synology identifies systems running these PHP-dependent packages: Calendar, IDrive, Joomla, KodExplorer, MailStation, MediaWiki, phpMyAdmin, vtigerCRM,", "cited_urls": [ "https://www.synology.com/en-us/security/advisory/Synology_SA_26_14", "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive summary of Synology's situation regarding PHP2Shell (CVE-2026-109618 and CVE-2026-109619), fully sourced: What is PHP2Shell? CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) involves request-owned internal state that can survive after its backing memory", "cited_urls": [ "https://community.synology.com/enu/forum/1/post/231447", "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities", "https://www.synology.com/en-global/security/advisory/Synology_SA_26_14" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—Synology is affected, but only when certain PHP-dependent packages are installed and exposed. Synology’s affected list includes PHP 7.3–8.4 packages, Mail Station, Calendar, Joomla, KodExplorer, MediaWiki, phpMyAdmin, vtigerCRM, Web Station, and WordPress; Synology Drive is explicitly not affected. Synology has patched the issue. Its advisory marks PHP2Shell as “Resolved” and provides fixed releases, including PHP 8.0.30-0122, 8.1.34-0120, 8.2.35-0171, 8.3.36-0051,", "cited_urls": [ "https://www.synology.com/en-global/company/news/article/php2shell/Synology%20Statement%20on%20PHP2Shell%20Vulnerabilities", "https://mariushosting.com/synology-mitigating-php2shell-cve-2026-109618-cve-2026-109619/", "https://stadt-bremerhaven.de/synology-sicherheitsupdates-fuer-php-gegen-php2shell-luecken/", "https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix", "https://www.synology.com/en-global/security/advisory/Synology_SA_26_14", "https://note.com/pc_article/n/n9a45909e7a32?hl=en", "https://mallory.ai/blog/php-rce-rapid-response", "https://ground.news/article/synology-security-updates-for-php-against-php2shell-gaps", "https://www.synology.com/en-us/security/advisory/Synology_SA_26_14", "https://github.com/NCSC-NL/php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:16:00.169Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, Synology systems running vulnerable PHP versions via Web Station are affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and Synology has released official updated PHP packages in Package Center to address the issue. Affected Status & Patch Details Vulnerability: CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) allow unauthenticated remote code execution on PHP instances handling web requests (such as via Web Station). Patched", "cited_urls": [ "https://mariushosting.com/synology-mitigating-php2shell-cve-2026-109618-cve-2026-109619/", "https://community.synology.com/enu/forum/1/post/231447" ], "names_status": true, "status_named": "patched", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:50:29.538Z", "question": "Is Synology affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Synology NAS units can be affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) if they run web-facing PHP applications via packages like Web Station or phpMyAdmin, though Synology has not yet published an official company product security advisory or rolling out automated global patches for all affected environments as of October 2026. Details on Synology and PHP2Shell Impact Scope:", "cited_urls": [ "https://mariushosting.com/synology-mitigating-php2shell-cve-2026-109618-cve-2026-109619/", "https://community.synology.com/enu/forum/18/post/231457", "https://community.synology.com/enu/forum/1/post/231447", "https://blog.ogwilliam.com/post/php2shell-cve-2026-109618-cve-2026-109619-rce-vulnerability" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "woocommerce-automattic", "company": "WooCommerce, Automattic", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "As of October 23, 2026: WooCommerce’s specific status is still “under investigation”—not confirmed unaffected, and not confirmed patched. PHP itself has released fixes. Is WooCommerce affected? The Dutch National Cyber Security Centre’s (NCSC-NL) tracker lists WooCommerce as “Investigation” for both CVE-2026-109618 and CVE-2026-109619, stating: “PHP relationship confirmed; CVE match unknown.” This is not confirmation that every WooCommerce installation is", "cited_urls": [ "https://github.com/NCSC-NL/php2shell/blob/main/software/software_list_w.md", "https://www.php.net/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive answer about WooCommerce and PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Is WooCommerce Affected by PHP2Shell? What is PHP2Shell? The PHP development team released emergency security updates to fix PHP2Shell — two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. CVE-2026-109618: RCE via out-of-memory corruption — when memory", "cited_urls": [ "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.czargroup.net/blog/php2shell-cve-2026-109618-cve-2026-109619-for-magento-2-adobe-commerce-and-woocommerce/", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://www.abstract.security/blog/php2shell-critical-php-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619", "https://github.com/Anton-Barinov/php2shell-patches" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes. WooCommerce is affected when it runs on a vulnerable PHP runtime, because PHP2Shell is a flaw in the PHP engine—not in WooCommerce itself. Stores running PHP versions dating back to 5.4 may be exposed, regardless of whether WooCommerce’s own code is clean. WooCommerce has not been “patched” as a plugin; the required fix is to patch PHP. PHP", "cited_urls": [ "https://sansec.io/research/php2shell", "https://www.hostinger.com/blog/protecting-php2shell/", "https://www.eviant.com.au/resources/php2shell-php-rce-cve-2026-109618-australian-businesses/", "https://smarthost.ie/php-security-alert-21-10-26/amp/", "https://connection-technologies.co.uk/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://hamzaahmadaslam.com/blog/php-critical-security-update-php2shell", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://aiidelist.com/blog/php2shell-critical-php-rce-vulnerabilities-wordpress", "https://www.iovista.com/blog/php2shell-vulnerabilities-cve-2026-109618-109619/", "https://github.com/NCSC-NL/php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WooCommerce is not specifically affected, because the CVE-2026-109618 and CVE-2026-109619 (\"PHP2Shell\") vulnerabilities are flaws in the PHP runtime core itself, not in WooCommerce or WordPress code. Patch Status: No WooCommerce or WordPress code patch is required or planned. Instead, the underlying PHP runtime needs to be updated by your server or hosting provider to patched PHP versions (8.5.12, 8.4.27,", "cited_urls": [ "https://x.com/TheHackersNews/status/2112772879997861994", "https://developer.woocommerce.com/2026/10/21/php-security-release/", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T02:11:39.807Z", "question": "Is WooCommerce affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: WooCommerce itself is not a vulnerable component, but any server running WooCommerce on top of a vulnerable PHP core language runtime version is indirectly affected. The flaws (CVE-2026-109618 and CVE-2026-109619, known as \"PHP2Shell\") reside within PHP's core memory/request handling rather than WooCommerce application code. Because WooCommerce requires PHP to run, any underlying environment utilizing an unpatched PHP", "cited_urls": [ "https://www.zscaler.com/blogs/security-research/cve-2026-109618-and-cve-2026-109619-php-vulnerable-unauthenticated-rce", "https://blog.talosintelligence.com/two-critical-rces-in-php-core/", "https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "wordpress-com", "company": "WordPress.com", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WordPress.com says all hosted sites are protected against PHP2Shell, and customers need take no action. Its announcement was published on October 21, 2026. Automattic’s corresponding advisory explicitly identifies CVE-2026-109618 and CVE-2026-109619. There is an important distinction about “has it patched?”: WordPress.com says it manages PHP patching at the infrastructure level and that every site is covered. However, these announcements", "cited_urls": [ "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, I can provide a detailed answer. However, I must note an important caveat upfront: none of the search results contain any specific statement from Automattic/WordPress.com confirming or denying whether WordPress.com (the managed hosting platform) has patched PHP2Shell on its infrastructure. Here is what is known: PHP2Shell (CVE-2026-109618 & CVE-2026-109619): WordPress & WordPress.com What is", "cited_urls": [ "https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://meowapps.com/php2shell-wordpress/", "https://cve.tools/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://github.com/Anton-Barinov/php2shell-patches", "https://www.brillmark.com/php2shell-php-vulnerability-patch/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—WordPress.com was potentially within the affected ecosystem because PHP2Shell is a vulnerability in PHP itself, not WordPress, but Automattic states that sites hosted on WordPress.com were protected as soon as possible. Its notice explicitly says: “If your site is hosted on WordPress.com … your site is already protected.” Automattic says it worked with the PHP Security team to protect", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://wppoland.com/en/php2shell-wordpress-what-to-do/", "https://www.zarla.com/guides/php2shell", "https://automattic.com/2026/10/21/php2shell/", "https://www.brillmark.com/php2shell-php-vulnerability-patch/", "https://stackharbor.com/en/blog/php2shell-cve-2026-109618-109619-what-we-know/", "https://www.moweb.com/blog/php2shell-cve-2026-109618-cve-2026-109619-php-rce-patch-guide", "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html?m=1&hl=en_US", "https://brandefense.io/blog/php2shell-php-rce-cve-2026-109618-109619/", "https://hamzaahmadaslam.com/blog/php-critical-security-update-php2shell" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, sites hosted on WordPress.com are protected against the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and Automattic has already ensured those services are secured. Source and Details Source: The Repository and reporting on Automattic's official blog statements. Status: Automattic's Artistic Director and Product Lead Ian Stewart stated that WordPress.com, WordPress VIP, WP Cloud, and Pressable were already protected against PHP2Shell", "cited_urls": [ "https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225", "https://www.northjersey.com/story/news/2026/10/22/php-vulnerability-2026-affected-websites-security-risk/92379378007/", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress.com affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: WordPress.com (hosted directly by Automattic) and Tumblr were exposed to the underlying PHP runtime risks of the \"PHP2Shell\" flaws (CVE-2026-109618 and CVE-2026-109619), but Automattic confirmed that hosted infrastructure was secured. Patch Status: Yes, it has been patched. Automattic explicitly stated that websites hosted directly on WordPress.com are safe and protected following the emergency PHP core updates. (Note:", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://timesofindia.indiatimes.com/technology/tech-news/php2shell-governments-on-high-alert-over-critical-website-flaw-wikipedia-hospitals-school-portals-go-dark-what-users-should-know/articleshow/135110798.cms", "https://meowapps.com/php2shell-wordpress/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "wordpress-vip", "company": "WordPress VIP", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WordPress VIP is already protected, according to Automattic—but its public notice does not explicitly confirm the deployed PHP patch versions. As of October 23, 2026, the official statement is that VIP-hosted sites are protected against both CVE-2026-109618 and CVE-2026-109619, with no customer action required. Automattic’s October 21, 2026 announcement states: > “If your site is hosted on WordPress.com, WordPress", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Here is a comprehensive answer based on the latest sources: PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — WordPress VIP Status What is PHP2Shell? PHP2Shell is the name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They are two CRITICAL-severity PHP core vulnerabilities that turn unauthenticated requests into remote code execution and Heartbleed-style memory", "cited_urls": [ "https://escape.tech/blog/php2shell-cve-2026-109618-cve-2026-109619-unauthenticated-rce-in-php-core-now-detected-by-escape/", "https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/", "https://sansec.io/research/php2shell", "https://www.elevationweb.org/blog/critical-php-flaw-what-it-meant-for-your-site/", "https://www.activeset.co/blog/php2shell-wordpress-what-to-check" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WordPress VIP was potentially affected at the PHP-runtime level, but Automattic says it was protected before or when the vulnerabilities were publicly disclosed. Automattic explicitly lists WordPress VIP among its platforms whose sites were already protected against PHP2Shell as of October 21, 2026. The vulnerabilities are in PHP itself, not WordPress core, themes, or plugins. PHP fixed them in", "cited_urls": [ "https://www.zarla.com/guides/php2shell", "https://automattic.com/2026/10/21/php2shell/", "https://tjrobertson.com/php-security-update-wordpress/", "https://wppoland.com/en/php2shell-wordpress-what-to-do/", "https://www.brillmark.com/php2shell-php-vulnerability-patch/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://github.com/NCSC-NL/php2shell", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://wpsecurityninja.com/warnings/" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact: Yes, sites hosted on WordPress VIP use the PHP runtime and are technically exposed to the underlying PHP2Shell vulnerabilities (CVE-2026-109618 and ). Patch Status: Yes, WordPress VIP (along with related Automattic infrastructure like WordPress.com, WP Cloud, and Pressable) is already protected, and no action is required from site owners. Source: Official statements published by Automattic on Automattic News", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://www.facebook.com/AutomatticInc/posts/your-sites-are-protectedtoday-the-php-project-released-security-updates-for-two-/1590848439750954/", "https://customerhub.wpvip.com/lobby/2026/10/20/upcoming-php-security-release-no-action-required/", "https://x.com/wordpressdotcom/status/2113300432864882716" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": true, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WordPress VIP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Impact Status: Yes, WordPress VIP infrastructure relies on PHP—the underlying runtime affected by the critical PHP2Shell remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619). However, sites hosted on the platform were shielded immediately. Patch/Mitigation Status: Yes, the platform is fully protected. Automattic applied early platform-level mitigations and rolled out official PHP updates across the network as soon as the PHP", "cited_urls": [ "https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/", "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://wordpress.com/blog/2026/10/21/php2shell-vulnerabilities/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] }, { "slug": "wp-engine", "company": "WP Engine", "answers": [ { "engine": "ChatGPT", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "WP Engine treated PHP2Shell as applicable to its platform and has since reported all customer sites patched. As of October 23, 2026, the available updates show: Initial response, October 21: WP Engine’s official status notice said it was rolling out PHP patches across customer platforms and had already deployed Cloudflare/Fastly CDN mitigations. This was a patching-in-progress notice—not a claim", "cited_urls": [ "https://wpenginestatus.com/incidents/969801?utm_source=openai", "https://www.reddit.com/r/wpengine/comments/1xcv4kq/php_vulnerability_update/?utm_source=openai" ], "names_status": true, "status_named": "patched", "matches_statement": true, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "match", "excluded": false, "exclusion_reason": null }, { "engine": "Claude", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Based on the search results, here is what is known about WP Engine and PHP2Shell (CVE-2026-109618 & CVE-2026-109619): PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — WP Engine Status What is PHP2Shell? PHP2Shell refers to two critical PHP vulnerabilities that could lead to unauthenticated remote code execution. Patches are available for supported PHP 8.x branches, and exploitation attempts began before public disclosure.", "cited_urls": [ "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://sansec.io/research/php2shell", "https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/", "https://iceboxdesigns.co.uk/blog/php2shell-wordpress-php-vulnerability-cve-2026-109618/", "https://meowapps.com/php2shell-wordpress/" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Perplexity", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes—WP Engine was affected, because PHP2Shell is a vulnerability in the PHP runtime, not WordPress itself. WP Engine reportedly ran vulnerable PHP branches and was still rolling out fixes as of October 22, 2026, with mitigations in place during deployment. The available source says WP Engine planned to update all PHP versions it operates—7.4, 8.2, 8.4, and 8.5—but does", "cited_urls": [ "https://meowapps.com/php2shell-wordpress/", "https://socradar.io/blog/php2shell-cve-2026-109618-cve-2026-109619/", "https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce", "https://netenrich.com/blog/php2shell-cve-2026-109618-cve-2026-109619", "https://github.com/NCSC-NL/php2shell", "https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote", "https://www.zarla.com/guides/php2shell", "https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis", "https://github.com/0xDTC/0xPHP2SHELL-Impact-Analysis/blob/master/Readme.md" ], "names_status": true, "status_named": "patching", "matches_statement": false, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "differs", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Overviews", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Yes, WP Engine was affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and the platform has applied patches across its servers. Impact: WP Engine hosts WordPress sites that rely on the underlying PHP runtime, which was vulnerable to unauthenticated remote code execution flaws rated 9.2 CVSS v4.0. Mitigations & Patching: WP Engine implemented initial network and CDN-layer mitigations (via", "cited_urls": [ "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://www.therepository.email/php-patches-critical-php2shell-vulnerabilities-as-hosts-across-the-wordpress-ecosystem-race-to-protect-customers", "https://watchtowr.com/intelligence/php-cve-2026-109618-faq/", "https://www.reddit.com/r/Wordpress/comments/1xc0w1d/if_your_wordpress_site_is_on_php_81_or_older_the/" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null }, { "engine": "Google AI Mode", "captured_at_utc": "2026-10-23T01:44:55.495Z", "question": "Is WP Engine affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619), and has it patched? Give the source.", "excerpt": "Affected Status: Yes, WP Engine's servers and hosting environments run PHP, meaning the platform was technically exposed to the underlying critical PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) before updates were finalized. Patch Status: Yes, WP Engine has addressed the issue. According to customer communications and developer reports, WP Engine implemented network and server-level mitigations even before PHP officially released its", "cited_urls": [ "https://dev.to/cseeman/patch-your-php-what-php2shell-means-for-wordpress-sites-2akn", "https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html" ], "names_status": false, "status_named": null, "matches_statement": null, "cites_company_page": false, "says_no_statement": false, "contradiction": false, "grade": "no status named", "excluded": false, "exclusion_reason": null } ] } ] }